Global Privacy Control (GPC)

GPC was originally created to take advantage of new opt-out privacy laws in the United State. Starting with the enactment of the California Consumer Privacy Act in 2018, several U.S. states have passed privacy laws that give consumers the legal right to opt out of the sale or share of their data, or the use of their data for cross-context targeted advertising. Many of those state laws make explicit provision for the exercise of those rights through universal opt-out mechanisms such as the GPC. At least two states have specifically identified GPC as a valid means to exercise legal opt-out rights. A minority of states provide for rulemaking procedures to allow regulators to expand on the specifics of how universal opt-out requests should be honored; other states may rely upon informal guidance or enforcement actions to provide clarity on the scope of legal obligations around GPC signals.

GPC could potentially be used to indicate rights in other jurisdictions as well. For example, the GDPR potentially affords data subjects the right to limit the sharing of personal information under Articles 7 and 21. Many other countries around the world have adopted affirmative privacy legislation — often modeled on the GDPR; a regulator in one of those countries could determine that GPC invokes a legal right that requires some response from a recipient.

Other US state privacy laws, such as those in Virginia and Utah, give consumers new opt-out rights around data sales and targeted advertising but are silent on the legal effect of global opt-out signals. Regulators enforcing those statutes may determine that a user activating a signal such as GPC may be sufficient to legally exercise opt-out rights in those jurisdictions.

However, GPC is not necessarily intended to invoke every new privacy right in every jurisdiction. For example, GPC is not intended to globally invoke data deletion rights on every website visited by the user. GPC is also not intended to limit a first party’s use of personal information within the first-party context (such as a publisher targeting ads to a user on its website based on that user’s previous activity on that same site).

Given the complexities of existing consent frameworks, publishers who accept the GPC signal should disclose how they treat the GPC signal in that jurisdiction and how they deal with conflicts between the signal and other specific privacy choices that the person has already made directly with the publisher, including instances where third party sharing may be permitted such as sharing to service providers/processors, sharing at law or at the direction of the individual.

User agents SHOULD strive to represent what the user agent best believes to be the person's preference for the Global Privacy Control value. While studies have shown that people do not want their data sold or shared, some jurisdictions have enacted "opt-out" legal frameworks where consumers have to take an affirmative action to express a preference to limit data sharing of the use of their data for targeted advertising.

Different jurisdictions have different prerequisites before a platform can enable a universal opt-out. For example, the most recent regulations promulgated under the California Consumer Privacy Act state:

The platform, technology, or mechanism that sends the opt-out preference signal shall make clear to the consumer, whether in its configuration or in disclosures to the public, that the use of the signal is meant to have the effect of opting the consumer out of the sale and sharing of their personal information. The configuration or disclosure does not need to be tailored only to California or to refer to California ([CPPA-REGULATIONS], §7025(b)(2)).

Colorado and other jurisdictions are more prescriptive about requirements for a valid universal opt-out signal. For example, Colorado’s regulations explicitly provide “a Universal Opt-Out Mechanism may not be the default setting for a tool that comes pre-installed with a device, such as a browser or operating system” ([COLORADO-REGULATIONS], Rule 5.04(a)).

Currently California and Colorado are the only jurisdictions in the United States that empower regulators to issue detailed regulations on topics such as universal opt-outs. Other statutes state relatively high level legal requirements that may be augmented by informal guidance (such as an FAQ) or through enforcement.

The legal landscape around global opt-outs is also changing. In 2023, several new states passed laws that include requirements to honor global opt-outs, though some of those states’ provisions differ considerably. Additionally states may revise their legal requirements as California has already amended the original CCPA that was passed in 2018.

In addition to the United States, other jurisdictions may recognize universal privacy signals and may impose their own requirements before such signals are deemed legally bindinging.

For more information on the latest legal requirements, please review the implementation guide which will provide more up-to-date information about the latest legal guidance around global opt-outs.

User agents are expected, where required, to present all the appropriate notices to people to ensure that the rights they wish to avail themselves of are effectively binding.