Do companies have to honor Global Privacy Control, and how do I turn it on?

Question

Accepted Answer

Global Privacy Control (GPC) is a browser signal that tells every site you visit not to sell or share your data. Turn it on in Firefox's privacy settings, use Brave or the DuckDuckGo browser (on by default), or add an extension such as Privacy Badger or Disconnect to Chrome. In California it is binding: under CCPA regulation § 7025(b)-(c), a business that sells or shares personal information must treat a compliant signal as a valid opt-out for that browser or device and any linked profile, the signal overrides a conflicting account setting, and since January 1, 2026 the site must display whether it honored the signal (§ 7025(c)(6)). The opt-out must take effect within 15 business days (§ 7026(f)(1)) with no identity verification (§ 7026(d)). Colorado has required businesses to honor GPC since July 1, 2024 (C.R.S. § 6-1-1306(1)(a)(IV)) and Connecticut since January 1, 2025 (Conn. Gen. Stat. § 42-520(e)(1)(A)(ii)). The older "Do Not Track" setting has no legal force; California only requires a privacy policy to say how the site responds to it (Bus. & Prof. Code § 22575(b)(5)). If a site ignores the signal, send a written opt-out and complain to the CPPA or your attorney general. Build the request at https://takeitdown.agentexchange.work/request/privacy (free; you send it, the deadline is tracked).

Do companies have to honor Global Privacy Control, and how do I turn it on?

Related