A browser signal now satisfies one CCPA opt-out, not every right

The revenue mechanism

A publisher that sells or shares reader data for advertising under California's Consumer Privacy Act must offer at least two ways for a consumer to opt out, and California's Attorney General now treats a specific browser signal, the Global Privacy Control, as one that satisfies that duty automatically. The AG's own current guidance page, retrieved 16 September 2026, states that for businesses collecting personal information online, one acceptable opt-out method is a user-enabled global privacy control such as the GPC, and that it must be honored by covered businesses as a valid consumer request to stop the sale or sharing of personal information, without the consumer filling out a separate form on every site.

What the documents show

The AG's page describes the GPC as a proposed technical standard, developed in response to the CCPA, available as a built-in setting in some browsers, including Firefox, DuckDuckGo and Brave, or as an extension in others, functioning as what the page calls a stop selling or sharing my data switch. The signal's own specification site, also retrieved 16 September 2026, states that over a dozen organizations are developing the GPC specification together, and that the mechanism is required under state privacy laws such as the CCPA and similar statutes elsewhere. That site separately states, as its own claim rather than an audited figure, that around 40 million consumers use browsers or tools supporting the signal, and that named publishers including the New York Times and Washington Post have pledged to respect it.

The assumptions exposed

The AG's guidance describes what a business must do once it detects the GPC signal; it does not create a new consumer right beyond the opt-out CCPA already provides, it recognizes one technical way of exercising a right that already existed. The 40-million-user figure is the GPC project's own self-reported estimate, not an independently audited count, and a publisher-pledge list on the same site records stated intentions, not verified compliance audits. Honoring the signal answers only the opt-out-of-sale-or-sharing requirement; it does not satisfy separate obligations such as responding to a specific access or deletion request, which still need their own channel.

What to check before you rely on it

This is an editorial checklist, not legal advice. Check a publisher's compliance tooling against the AG's current guidance page directly, since it is a living statement that can be updated, and test whether the site's own consent platform actually detects the GPC header rather than only showing a manual cookie banner.

• Does my site's consent tooling actually detect the GPC browser signal, or only present a manual opt-out form?
• Am I treating the GPC's self-reported adoption figures as an audited measure of how many of my own readers send the signal?
• Does honoring GPC cover only the opt-out-of-sale right, leaving separate access and deletion request channels still required?

The Attorney General's recognition of the GPC gives a publisher a technical mechanism to automate one CCPA obligation; it does not replace the rest of a compliance program built around the statute's other rights.