Some browsers and browser extensions send a simple signal on every page load: “do not sell or share my data.” That signal is called Global Privacy Control (GPC). If your tag setup never checks for it, the signal is effectively ignored.
That gap is getting harder to defend. On November 5-6, 2026, the board of the California Privacy Protection Agency (CPPA) will discuss proposed amendments to its rules on opt-out preference signals, including whether to advance them to formal rulemaking. The CPPA’s proposed text (dated October 8, 2026) names GPC directly and adds worked examples covering cookie syncing, fingerprinting and cross-device profiles.
The proposal is not final. But it shows clearly how the regulator reads the existing rules, and most of what it describes can be tested on your site this week.
What the proposal changes
The California Consumer Privacy Act (CCPA) regulations already require businesses that sell or share personal information to treat an opt-out preference signal as a valid request to opt out. The current rules describe the signal only by its format, an HTTP header or a script value: “an HTTP header field or JavaScript object.” The proposed text adds the words “like Global Privacy Control (GPC).”
The proposal also spells out what “honoring” the signal means in practice:
- Scope: the signal applies to “that browser or device and any consumer profile associated with that browser or device, including pseudonymous profiles.” If the person is known, for example logged in, it applies to their account too.
- Visible confirmation: a business “must display whether it has processed the consumer’s opt-out preference signal.” The text gives “Opt-Out Request Honored” as an example.
- Timing: one example says a site that starts selling or sharing data “before determining whether it has received” the GPC signal has not complied “as soon as feasibly possible.”
- Cookie syncing: another example says that when a site receives a GPC signal, it must configure its website to stop third-party tracking technologies from cookie syncing for cross-context behavioral advertising.
- Cookie banners are not enough: the proposal states that a cookie banner or cookie controls is “not by itself an acceptable method for submitting requests to opt-out of sale/sharing.”
Why this matters beyond California
Enforcement on this point is not theoretical. In March 2025, the CPPA announced that Honda would pay a $632,500 fine. The final order found that opting out of cookies on Honda’s site took at least two clicks while “Accept All” took one. Among the required fixes: add a “Reject All” button and apply GPC to known consumers.
For teams in the Gulf Cooperation Council (GCC) and the wider Middle East and North Africa (MENA) region, the lesson travels. If you do business in California and meet the CCPA thresholds, these rules can apply even when your headquarters is in Dubai or Riyadh, and several other United States (US) states have their own opt-out rules. And even where local law differs, the same question comes up in every privacy review: does your tracking actually stop when a user says no?
5 checks to run this week
1. Confirm whether GPC reaches your site
GPC is sent as a request header (Sec-GPC: 1) and exposed in the browser as navigator.globalPrivacyControl. Open your site in a browser with GPC turned on and check both. Then ask whether your consent management platform (CMP) reads the signal at all, and for which regions.
2. Watch what fires before the decision
Load a landing page with GPC on and record the network requests. If advertising pixels or third-party tags fire before your CMP or Google Tag Manager (GTM) has read the signal, you have the timing problem described in the proposal. Fix the order, not just the outcome.
3. Check cookie syncing and server-side flows
Blocking a pixel in the browser does not help if the same data leaves through another route. Review cookie-sync calls from ad partners, and if you use server-side tracking (SST), confirm your server container receives the GPC state and suppresses sharing to advertising destinations.
4. Extend the opt-out to known users
If a visitor with GPC logs in, the opt-out should follow their account into your customer relationship management (CRM) system, audience exports and ad-platform uploads. This was one of the required fixes in the Honda order.
5. Show the result, and keep analytics honest
Add a visible confirmation such as “Opt-Out Request Honored,” and make sure your privacy choices are symmetrical: rejecting should take no more clicks than accepting. Then check how the opt-out affects Google Analytics (GA). Decide, and document, which GA features count as sharing (for example, advertising features and audience exports to ad platforms), and annotate reports so traffic changes after the fix are not misread as a drop in demand.
Final thoughts
GPC turns privacy choices into something a regulator can test from a laptop. The CPPA proposal may change before it is final, but the direction is clear: receive the signal, act on it before anything is shared, and show the user it worked. A short technical audit this week costs far less than a remediation order later.
Sources
- California Privacy Protection Agency, Proposed Text of Regulations (Opt-out Preference Signals), October 8, 2026
- California Privacy Protection Agency, Board Meeting Agenda, November 5-6, 2026
- California Privacy Protection Agency, CCPA statute and regulations, effective January 1, 2026
- California Privacy Protection Agency, “Honda Settles With CPPA Over Privacy Violations”, March 12, 2025
- California Privacy Protection Agency, Stipulated Final Order, American Honda Motor Co., March 7, 2025
How Gmetrics can help
Our Data Privacy & Governance team audits what your tags actually send when a visitor opts out, from browser pixels to server-side flows and analytics setups. We fix the order of operations, not only the final result. To talk through your setup, contact Gmetrics.
