Global Privacy Control in 2027: is your website honoring browser opt-out signals?

What does AB 566 change on January 1, 2027?

It moves the opt-out signal, best known today as Global Privacy Control (GPC), from an optional add-on to a standard browser feature. Civil Code section 1798.136, added by AB 566 and operative January 1, 2027, says a business shall not develop or maintain a browser that lacks a consumer-configurable setting to send an opt-out preference signal to the businesses the consumer interacts with. The setting must be easy for a reasonable person to find and configure, and the browser maker must explain publicly how the signal works.

The law puts the duty to build the setting on browser makers, and it says they are not liable when a receiving business ignores the signal. The obligation to act on the signal stays with the website. Until the setting is standard, a visitor may need an extension or a browser that already supports it. Once it ships in every browser, any Californian can turn it on from the browser's own settings.

Do businesses already have to honor Global Privacy Control?

Yes, if they sell or share personal information. Under Cal. Code Regs., tit. 11, section 7025(b), a business that sells or shares personal information must process a qualifying opt-out preference signal as a valid request to opt out. California has treated Global Privacy Control this way for years. A California Privacy Protection Agency staff presentation recounts that the Attorney General said in January 2021 that GPC satisfies the regulations.

Section 7025(c) spells out what processing means:

• The opt-out applies to that browser or device and any consumer profile associated with it, including pseudonymous profiles, and to the consumer if the business knows who they are.
• The business may not demand more information than the signal itself provides.
• If the signal conflicts with a consumer's saved settings, the business must still honor it, though it may ask the consumer to consent to sale or sharing.
• The business must display on its site whether it processed the signal, for example "Opt-Out Request Honored."

The privacy policy must also explain how the business processes opt-out preference signals under section 7011.

Which firms does this reach?

Any business covered by the CCPA whose website sells or shares personal information. Coverage turns on the definition of a business in section 1798.140(d), including a gross revenue threshold the agency adjusted to $26,625,000 in 2025. "Sharing" in the CCPA covers disclosing personal information for cross-context behavioral advertising, which is what many advertising and retargeting pixels do. A firm that has never thought of itself as selling data can still be sharing it through a marketing tag. For RIAs, broker-dealers and insurance agencies, the CCPA's exemption for information collected under GLBA is tied to that information, so it should not be assumed to cover website analytics and advertising data. Confirm the scope with counsel. Our guide to the CCPA GLBA exemption explains where that line usually falls.

What have regulators penalized so far?

Opt-outs that did not work, did not reach far enough, or came with friction. Four recent actions show the pattern:

• Honda, March 2025, $632,500: the CPPA alleged consumers had to verify themselves and provide excessive personal information to opt out, and that the privacy tool did not offer choices symmetrically.
• Healthline, July 2025, $1.55 million: the Attorney General alleged data kept flowing to advertising partners after consumers opted out, and reminded businesses that GPC opt-outs must be honored.
• Tractor Supply, September 2025, $1,350,000: the CPPA Board's order found the website did not honor opt-out preference signals until July 2024 and the privacy policy lacked the required signal disclosures.
• Disney, February 2026, $2.75 million: the Attorney General alleged GPC opt-outs were limited to a single device even when the consumer was logged in to their account.

The agency is also preparing more rules. A staff presentation to the CPPA Board recommends naming GPC explicitly as an opt-out preference signal, clarifying how signals apply to pseudonymous profiles and tracking timing, and requiring businesses to report signal metrics. The Board has not adopted those changes yet, so watch for a formal rulemaking notice.

How can you test whether your site honors Global Privacy Control?

Turn the signal on and watch what your site does. A practical test takes under an hour:

1. Enable Global Privacy Control in a browser or extension that supports it, clear cookies, and load your home page and a high-traffic landing page.
2. Open the browser's developer tools and check whether advertising, retargeting or social media tags still load and send data.
3. Look for a visible confirmation that the opt-out was honored, as section 7025(c) requires.
4. Log in to a test account, if your site has one, and confirm the opt-out attaches to the account rather than only the browser.
5. Read your privacy policy and confirm it explains how signals are processed.

If you use a consent management platform, confirm it is configured to act on the signal when the page loads rather than only after a banner choice, and test the live site rather than the vendor's settings page.

What should a firm do this quarter?

• Inventory every tag, pixel and embedded script on your website and note which send data to advertising or analytics vendors.
• Decide with counsel whether any of them count as selling or sharing under the CCPA.
• Run the five-step signal test above and save screenshots as evidence.
• Update the privacy policy's signal language if it is missing, and confirm the annual policy review is on the calendar.
• Ask your web agency or marketing vendor to confirm in writing how their tools respond to GPC.

How does s90 help?

s90 helps firms across Los Angeles and Orange County map the data their websites and applications collect, test controls like opt-out signal handling, and keep the evidence a regulator or client would ask to see. If you are also preparing for the CCPA's automated decision-making rules, the same data map serves both. If you want a second set of eyes on your site before browsers start offering the signal by default, we are glad to help.