In announcing a joint investigation into the implementation of Global Privacy Controls (GPC) earlier this week, the California Privacy Protection Agency (CPPA) and attorneys general from California, Colorado and Connecticut reemphasized the need for companies to understand how their websites operate, collect personal data and honor consumer privacy rights.
GPC are intended to be a user-friendly way for consumers to automatically signal their requests to companies to stop selling or sharing personal data without having to specifically opt-out of such actions on each website. GPC can be set by the consumer through a browser setting or extension.
In its announcement of the investigation, the CPPA provided guidance to consumers for how to set GPC, noting that it is “estimated that the average person produces 1.7 MB of data per second or 6,120 MB of data per hour.” With this in mind, companies that operate in California, Colorado and Connecticut should immediately consider reviewing their website compliance mechanisms, including if and how they capture and honor consumer GPC signals. It is important to note that having a cookie banner and consent mechanism is not enough, because with GPC, the opt-out should be captured automatically without the consumer having to take any specific action.
California, Colorado and Connecticut are not the only states to require compliance with GPC or universal opt-out mechanisms for the residents of their states. The comprehensive state privacy laws in New Hampshire, Montana, Nebraska, New Jersey, Minnesota and Texas also currently have requirements, and those in Maryland (October 1), Delaware and Oregon (January 1, 2026) will go into effect soon.
In addition to our ongoing monitoring of CPPA news, guidance and enforcement actions, we regularly work with clients on website privacy compliance issues like GPC and other opt-out mechanisms. Please do not hesitate to reach out to our team if you have any questions or require assistance in navigating this evolving legal landscape.
