Which states require you to honor universal opt-out signals?

A universal opt-out signal is the one privacy obligation you cannot satisfy by waiting for a request. The signal arrives with the page load, and either your site reads it or it does not.

Where the duty is explicit

Colorado. The Department of Law states that beginning July 1, 2024, businesses within the CPA's application thresholds must allow consumers to opt out of the sale of personal data or use of personal data for targeted advertising using GPC, citing C.R.S. section 6-1-1306(1)(a)(IV). Colorado is the only one of these states that names a mechanism: GPC was the first recognized and remains the only one the Department considers valid, under a public list maintained per CPA Rule 5.07.

Minnesota. Section 325M.14, subdivision 3(a) requires a controller to allow a consumer to opt out of processing for targeted advertising, or any sale, through an opt-out preference signal sent with the consumer's consent by a platform, technology, or mechanism.

New Jersey. Section 56:8-166.11(b)(1) requires that, beginning not later than six months following the effective date, a controller processing personal data for targeted advertising or the sale of personal data shall allow consumers to exercise the opt-out right through a user-selected universal opt-out mechanism.

Where the duty arrives by another route

Texas and Nebraska do not impose a standalone universal opt-out duty. They run the same outcome through authorized agents.

Nebraska's section 87-1111(5) lets a consumer designate an authorized agent using a technology including a link to a website, a browser setting or extension, or a global setting on an electronic device, and requires the controller to comply where it can verify the consumer's identity and the agent's authority with commercially reasonable effort.

The practical effect is similar, but the framing differs, and Nebraska attaches four express grounds for declining an agent request. One of those grounds matters here: a controller need not comply where it does not process similar or identical requests received for the purpose of complying with similar or identical laws of another state. Read plainly, that means a business already honoring GPC for Colorado cannot decline it in Nebraska on capability grounds.

The criteria are near-identical

Minnesota, New Jersey and Nebraska each attach requirements to the mechanism, and they converge:

It must not unfairly disadvantage another controller. It must not use a default setting, but require the consumer to make an affirmative, freely given, and unambiguous choice. It must be consumer-friendly and easy to use by the average consumer.

Minnesota and New Jersey add two more: the mechanism should be as consistent as possible with any similar mechanism required by other federal or state law, and it must let the controller determine whether the consumer is a resident of that state and whether the request is legitimate. Minnesota adds that using an IP address to estimate the consumer's location is sufficient for the residency determination.

That convergence is deliberate, and it is why one implementation generally serves all of them.

Minnesota's reciprocity clause

Subdivision 3(d) is worth quoting for planning purposes: a controller that recognizes opt-out preference signals that have been approved by other state laws or regulations is in compliance with this subdivision.

That is an explicit safe harbor. Build to Colorado's recognized mechanism and Minnesota accepts it.

The conflict case nobody builds for

Minnesota's subdivision 3(b) addresses what happens when a universal signal contradicts something the consumer set earlier: a controller-specific privacy setting, or voluntary participation in a loyalty, rewards, premium features, discounts, or club card program.

The rule is that the controller must comply with the opt-out preference signal, but may also notify the consumer of the conflict and offer them a choice to confirm the controller-specific setting or their participation in the program.

Signal wins by default. The consumer can then reinstate their prior choice, but only after being told.

What Colorado requires beyond the signal

Honoring GPC is not the whole Colorado obligation. Businesses must also include, in their privacy policy, an explanation of how requests made through universal opt-out mechanisms including GPC will be processed, under Rule 6.03(4)(e) of the CPA Rules.

This is the visible half. A regulator or a prospective customer can read your privacy policy and see immediately whether you have addressed universal opt-outs at all.

Next step

Universal opt-out is a site-wide engineering change rather than a policy edit, so it is worth knowing which of these laws actually reach you before scoping the work. The free 2-minute Obligation Scan checks your business against every US state privacy law and tells you which apply. See Colorado's universal opt-out rules for the most prescriptive version, Nebraska request methods for the authorized-agent route, and Texas browser opt-out signals for the Texas equivalent.