Respect the Global Privacy Control signal

• A US state privacy law covers your business. California's CCPA covers businesses with more than $25 million in annual revenue (adjusted for inflation), or that buy, sell or share the personal information of 100,000 or more California consumers or households, or earn half their revenue from selling or sharing it. Other states use their own thresholds, often based on the number of residents whose data you handle.
• You use advertising pixels, retargeting or other tools that share visitors' data with third parties for advertising. In California, sharing for cross-context behavioural advertising counts as 'sharing' even without money changing hands.

• California requires covered businesses to treat opt-out preference signals such as Global Privacy Control as a valid request to opt out of selling and sharing (CCPA §1798.135(e) and Cal. Code Regs. tit. 11 §7025).
• Colorado, Connecticut, Texas, Montana, Minnesota, Maryland and New Hampshire also require honouring universal opt-out signals; New Jersey from 15 July 2025, and Oregon and Delaware from 1 January 2026.
• Firefox, Brave and DuckDuckGo send GPC by default or with one setting, so some of your visitors already send it, and regulators have tested sites for it.

• A list of advertising and marketing tools that receive visitor or customer data (pixels, conversion APIs, audience uploads).
• Your privacy notice's 'Do Not Sell or Share' or opt-out section, if you have one.

Copy it into your AI builder. Fill in anything in [brackets] first, and review every change before you ship it.

Add support for the Global Privacy Control (GPC) signal so it works as an opt-out of selling or sharing personal data.

1. DETECT IT
- In the browser: navigator.globalPrivacyControl === true.
- On the server: the request header Sec-GPC: 1.
- Treat either one as the visitor's opt-out for this browser.

2. HONOUR IT
- Don't load advertising, retargeting or cross-site tracking for this visitor: ad pixels (Meta, Google Ads, LinkedIn, TikTok, X), audience or conversion uploads, and third-party data sharing for advertising.
- If you send server-side conversion events, skip them for this visitor or send them with the platform's restricted mode (for example Google Ads restricted data processing, Meta Limited Data Use), whichever the code already supports.
- Analytics used only for your own purposes, not shared for advertising, can follow the normal cookie choice.

3. REMEMBER IT
- If the visitor is signed in, save the opt-out on their account (opted_out_of_sale_share = true with a timestamp and source = "gpc") so it also applies on other devices and in data you send to partners server-side.
- Never ask them to undo it, and don't show a banner that overrides it.

4. SHOW IT
- In the cookie or privacy settings, show a short line: "Your browser's Global Privacy Control signal is on. We treat it as a request not to sell or share your personal information."

5. DOCUMENT IT
- Add a paragraph to the privacy notice's opt-out section explaining that you honour GPC, and keep a "Do Not Sell or Share My Personal Information" link (or "Your Privacy Choices") in the footer if you sell or share.

When you're done: list every file you changed, explain each change in one line, and give me a step-by-step test for each numbered item above. Don't change anything unrelated.

• Treating GPC as a cookie-banner signal only and still sending server-side conversion data.
• Honouring it on the website but not for signed-in users on other devices.
• Showing a pop-up asking people to turn the signal off.

1. 1Use Firefox with Settings → Privacy → 'Tell websites not to sell or share my data' on, or Brave (on by default).
2. 2Open the site, then DevTools → Console and type navigator.globalPrivacyControl: it should say true.
3. 3In DevTools → Network, filter for facebook, doubleclick, googleadservices, linkedin and tiktok: nothing loads.
4. 4Turn GPC off: behaviour goes back to normal (subject to the cookie choice).
5. 5Sign in with GPC on, then sign in on another browser without it: the account still shows opted out.

• Global Privacy Control
• California Privacy Protection Agency: regulations

General guidance for common problems, not legal advice. Whether a rule applies depends on where you operate, who your users are and the size of your business.