Your Website Needs to Honor GPC Signals

Start free Explore demo

Does your website respond to GPC signals?

If your website has visitors in the U.S., you may be required to detect and honor GPC signals.

GPC enables browser-based opt-out for data sales, sharing, or targeted advertising. Users activate the signal once, then it’s automatically applied across every site they visit.

Many websites do not detect and respond to these signals correctly. But regulators have made GPC compliance a priority, and are scanning for non-compliance at scale.

Read our GPC guide

How does GPC work and who needs to honor it?

Global Privacy Control is a signal setting built into a browser or an extension. When a user activates the signal, it automatically informs every website the user visits with that browser. 

The signal opts that visitor out of data collection and use for sales, sharing, and targeted advertising. Unlike with a consent banner, GPC doesn’t require any user interaction on websites.

An increasing number of states require businesses to honor these signals on their websites, and are actively fining those that fail to honor them. 

By January 2027 California will require all major browsers to include built-in recognition of universal opt-out mechanisms, like GPC, so companies can expect many more website visitors with the signal activated.

Regulators are increasing action on GPC non-compliance

In 2025, privacy regulators in seven U.S. states formed the Consortium of Privacy Regulators to coordinate investigations across states: California, Colorado, Connecticut, Delaware, Indiana, New Jersey, and Oregon.

Their first coordinated action targeted businesses failing to honor GPC signals. Automated scanning tools mean detection has become a case of when, not if.

Escalating CPPA enforcement

states with active privacy laws

states coordinating enforcement through the Consortium so far

states requiring recognition of opt-out signals so far

joint GPC enforcement sweep to date and other enforcement actions already completed

Handling GPC signals correctly

Responding to GPC signals in line with state requirements involves more than adding a line to your privacy policy. Your website needs to detect signals, apply visitor preferences across every data category, display visual confirmation, and document every session.

Cookiebot™ CMP identifies GPC signals from browsers, extensions, and devices, displaying an "Opt-Out Request Honored" confirmation to visitors where required. No ongoing manual monitoring required.

Visitor preferences for data sale, sharing, and targeted advertising are applied automatically, in line with applicable U.S. state requirements.

Opt-out preferences are applied across the vendors, platforms, and services connected to your website to keep your consent setup coherent across your digital ecosystem.

California requires businesses that can identify a returning visitor across devices or browsers to extend their GPC opt-out to all those sessions. Cookiebot CMP supports this requirement as part of its standard configuration.

Read Cookiebot and GPC signal documentation
Cookiebot bg shield

GPC support that works across your teams

Getting GPC right has implications beyond your legal team. Here is what correct signal handling can mean for each part of your business.

Unhandled GPC signals can suppress analytics data and limit how ad platforms like Google process your consent signals. Correct opt-out handling helps protect your measurement and campaign reporting.

Support audit readiness and reduce manual oversight as U.S. state requirements evolve. Cookiebot CMP delivers automated signal detection, correctly displayed recognition, documented opt-out records, and consistent vendor application.

Cookiebot CMP integrates GPC detection into your existing consent setup without custom development. No additional code. No ongoing manual configuration or updates.

Read Cookiebot and GPC signal documentation

How Cookiebot CMP Handles GPC

Cookiebot CMP includes GPC signal detection and opt-out handling as part of its standard consent management setup. No separate module to activate and nothing extra to configure.

  • Automatically detects GPC signals from browsers, extensions, and devices
  • Displays “Opt-Out Request Honored” confirmation to visitors where required
  • Applies opt-out preferences consistently across vendors, platforms, and touchpoints
  • Maintains documented consent records to support audit readiness
  • Adapts automatically as U.S. state opt-out signal requirements expand
  • Works within your existing consent infrastructure without custom development
See how website consent management works
Cookiebot bg shield
Get Cookiebot CMP Support

Get started with Cookiebot CMP

Sign up for your free account in one click.
Choose your banner and copy the code.
Copy the code in your site’s header. Done!

Start 14-day free trial
Cancel any time Cancel any time

Frequently asked questions

GPC is a browser-based signal that automatically opts visitors out of data sale, sharing, and targeted advertising. Visitors enable it once in their browser or privacy extension, and it applies across every website they visit.

As of mid-2026, California, Colorado, and Connecticut explicitly require GPC recognition by name. Nine additional states — Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, and Texas — require recognition of a universal opt-out mechanism (UOOM) more broadly. The list is expected to grow.

A UOOM enables visitors to communicate privacy preferences automatically, without interacting with individual websites. GPC is the most widely recognized UOOM under current U.S. state privacy laws.

Failing to honor GPC signals may put your website out of step with U.S. state privacy laws, potentially exposing your business to regulatory fines and enforcement action. Regulators use automated scanning tools to identify sites that are not honoring GPC signals.

In April 2025, privacy regulators from seven states formed the Consortium of Privacy Regulators to coordinate enforcement. Their first joint action, in September 2025, targeted businesses that failed to honor GPC signals.

Yes. Enacted California law requires major browser vendors to include built-in UOOM support from January 1, 2027, significantly increasing the number of visitors who arrive at websites with GPC already active.

Enable GPC in a supported browser or privacy extension, visit your website, and verify that the signal is being detected and applied. You can also run a free scan with Cookiebot to review your cookies, trackers, and consent configuration.

Cookiebot CMP detects GPC signals automatically and applies visitor opt-out preferences across data sale, sharing, and targeted advertising. It also displays the required "Opt-Out Request Honored" confirmation and maintains records to support regulatory inquiries.