Does the CCPA require honoring Global Privacy Control?

Most CCPA opt-out advice stops at the "Do Not Sell or Share My Personal Information" link. The link is only half the rule. If a browser sends your site an opt-out preference signal, California treats that as the consumer opting out, and you have to honor it whether or not the person ever clicks your link. Global Privacy Control is the signal that makes this real, and ignoring it is exactly what recent enforcement has gone after.

What is an opt-out preference signal?

An opt-out preference signal is a message a browser, extension, or device sends automatically to every site a consumer visits, telling each business the consumer wants to opt out of the sale or sharing of their personal information. Global Privacy Control, or GPC, is the leading example. It travels as an HTTP header field or a JavaScript object, so the business receives it in the background without the consumer filling in a form or hunting for a link. California Civil Code section 1798.135(b) recognizes the signal, and the CCPA regulations at 11 C.C.R. section 7025 spell out how a business must respond to it.

Which businesses have to honor it?

The duty is not universal. Under the CCPA regulations, a business must treat GPC as a valid opt-out if three things are true: it is a "business" that must comply with the CCPA, it collects personal information from consumers online, and it sells or shares that personal information. "Share" here means disclosing personal information for cross-context behavioral advertising, which sweeps in a lot of ordinary ad-tech and analytics setups that companies do not think of as selling data. If you do not sell or share, you do not have to process the signal, but you still owe the rest of the CCPA.

What do you have to do when a signal arrives?

Section 1798.135(b) lets a business use the signal as its opt-out method instead of the two homepage links, or alongside them. When GPC arrives, you stop selling and sharing the personal information tied to that browser or device, including any pseudonymous profile connected to it. If the consumer is logged in and therefore known to you, you apply the opt-out to their whole account. The California Privacy Protection Agency's guidance sets the outer limit at 15 business days from receiving the request. You cannot charge a fee for using the signal or degrade the consumer's experience because they sent it.

The frictionless option

A business that processes GPC in a "frictionless" manner, meaning it does not charge the consumer, change their experience, or throw up an interstitial, can skip posting the "Do Not Sell or Share My Personal Information" link entirely. That is the trade the regulations offer: honor the signal cleanly and you lose the link obligation. You still have to describe the opt-out right and the signal in your privacy policy. For the link-based route, see CCPA Do Not Sell or Share, and pair this with your CCPA notice at collection.

Next step

If your site runs advertising or analytics that count as selling or sharing under the CCPA, the free 2-minute Obligation Scan checks whether you are required to honor Global Privacy Control and lists the opt-out, link, and privacy-policy steps that go with it, so a background signal does not turn into an enforcement action. The US state privacy laws hub shows how this sits inside your wider CCPA duties.