On September 9, 2025, the attorneys general of California, Colorado, and Connecticut and the California Privacy Protection Agency (CPPA) announced a joint investigative sweep of potential failures by businesses to honor consumers’ rights to opt out of the sale and sharing of their personal information and targeted advertising under state comprehensive privacy laws. Notably, the sweep takes specific aim at whether companies are fulfilling consumer opt out requests sent via Global Privacy Control (GPC) signals.
The GPC1 is a browser-level setting or extension developed by an independent group of stakeholders that allows users to broadcast their opt-out choice to all websites they visit through a single step rather than having to make individualized requests to opt out on each website. According to the joint announcement, several “businesses that do not appear to be processing consumer requests to opt out of the sale of their personal information submitted via the GPC” have already received letters requesting “immediate compliance” as required by law.
The announcement signals yet another sign of increased enforcement activity by state privacy regulators, which in recent years have been keen on targeting companies for allegedly failing to process user requests to opt out, including via the GPC. In announcing the joint sweep, the California Attorney General Rob Bonta stated, “California and our sister states are committed to continued collaboration to actively enforce consumers’ important privacy rights and are paying close attention to business compliance with the Global Privacy Control.” The coalition sweep follows the establishment of the Consortium of Privacy Regulators in April 2025, a formal collaboration group between the CPPA and the attorneys general of California, Colorado, Connecticut, Delaware, Indiana, New Jersey, and Oregon.
In addition to California, Colorado, and Connecticut, state comprehensive privacy laws in Delaware, Oregon, Montana, Texas, New Jersey, New Hampshire, and Minnesota also require covered businesses to honor GPC signals (either now or in the near future).2 Businesses operating in these states should take this as an opportunity to shore up their privacy compliance by testing and verifying that their websites and apps are properly functioning and effectuating consumer opt-out choices, including via GPC signals.
[1] The GPC is also sometimes referred to as a type of universal opt-out mechanism, or UOOM. See our earlier client alert for more information on the development of the GPC and the California attorney general’s initial push to get businesses to honor GPC opt-out signals.
[2] In Delaware, universal opt-out mechanisms must be recognized by controllers as valid consumer requests beginning January 1, 2026. Meanwhile, New Jersey regulators are currently in the process of finalizing proposed regulations, including proposed regulations related to opt-out signals; the public comment period, after being extended, closed on September 2, 2025, and final rules are expected sometime in 2026. Maryland’s comprehensive state privacy law, the Maryland Online Data Privacy Act, which takes effect October 1, 2025, allows (but does not require) businesses to honor universal opt-out signals.
