On this page · 11 sections
- What AB 566 requires, clause by clause
- Which browsers send GPC on 1 November 2026
- What your site must already do under the CCPA regulations
- Enforcement so far
- Wire GPC into your tag stack: eight steps
- Decision table: what each tag does when GPC is on
- Worked example: what GPC does to a California remarketing pool
- Beyond California: where the signal already binds
- Implementation checklist
- How eCorpIT can help
- References
Summary. California's Opt Me Out Act (AB 566, Chapter 465 of 2025) adds Civil Code section 1798.136, operative 1 January 2027: a business may not develop or maintain a browser unless it includes a consumer-configurable setting that sends an opt-out preference signal, easy for a reasonable person to locate and configure. The duty falls on browser makers. Websites feel it as volume. Under CCPA regulation section 7025, a business that sells or shares personal information must already treat a Global Privacy Control (GPC) signal as a valid opt-out, stop as soon as feasibly possible and within 15 business days at most, and display whether it processed the signal. Firefox, Brave and DuckDuckGo support GPC, Microsoft offers a US-only Edge setting, and Google lists a setting for eligible users in Chrome 157, due in stable on 3 November 2026. Regulators already act on opt-out failures: Disney paid $2.75 million, Tractor Supply $1.35 million, PlayOn Sports $1.10 million and Ford $375,703. Fines run to $2,663 per violation, or $7,988 if intentional. The fix sits in your tag stack: read the signal, switch Google Ads to restricted data processing, send Meta Limited Data Use, hold back other ad pixels, carry the flag into server-side tagging and CRM uploads, and show the status.
About this article. For marketing, analytics and privacy teams running tag stacks that reach Californians. On 1 November 2026 we read the chaptered text of AB 566 (8 October 2025), the CCPA and its regulations as effective 1 January 2026, CalPrivacy's August 2026 board briefing, the W3C GPC draft, and browser and ad platform documentation. This is general information, not legal advice. Browser features change quickly. No vendor paid for inclusion. Researched with AI assistance and reviewed by our editorial team.
What AB 566 requires, clause by clause
Governor Newsom signed AB 566 on 8 October 2025. The California Privacy Protection Agency, now branded CalPrivacy, sponsored it. The table follows the text.
| Clause of section 1798.136 | What it says | What it means for you |
|---|---|---|
| (a)(1) | A business shall not develop or maintain a browser without consumer-configurable functionality that sends an opt-out preference signal | The duty is on browser makers; the signal stays a user choice |
| (a)(2) | The setting must be easy for a reasonable person to locate and configure | Expect a visible privacy toggle, not a hidden flag |
| (b) | Browser makers must explain publicly how the signal works and what it is meant to do | Close to the test for a valid signal in regulation section 7025(b)(2) |
| (c) | The agency may adopt regulations | Preliminary comments closed 6 April 2026; no proposed text on 1 November 2026 |
| (d) | A browser maker is not liable when a receiving site breaks the law | Liability for ignoring the signal stays with your site |
| (e)(1) | Browser means an interactive application used to locate, access and navigate websites | CalPrivacy says desktop and mobile browsers are both covered |
| (e)(2) | The signal must comply with the CCPA and communicate an opt-out of sale and sharing | GPC is the signal the agency names in its own materials |
| (f) | Operative on 1 January 2027 | No grace period appears in the text |
AB 566 adds no website duty, does not force the signal on by default and does not name GPC. The website obligation already sits in Civil Code section 1798.135 and regulation section 7025, part of the package CalPrivacy dates to March 2023.
Which browsers send GPC on 1 November 2026
GPC is the signal in practice. The W3C draft defines an HTTP request header, Sec-GPC: 1, plus a JavaScript property, navigator.globalPrivacyControl. It is still an editor's draft and a work item of the W3C Privacy Working Group. Support comes from the sources named in the table.
| Browser | GPC status | Source |
|---|---|---|
| Firefox | Enable in settings | GPC project guide |
| Brave | On by default | Brave |
| DuckDuckGo browser | On by default | DuckDuckGo |
| Microsoft Edge | Setting under Privacy, search and services; currently available in the US | Microsoft Support |
| Google Chrome | Listed for eligible users from Chrome 157 on desktop, Android and iOS; entry still marked proposed; stable scheduled for 3 November 2026 | Chrome Status, Chromium Dash |
| Apple Safari | No Safari setting documented; Safari 27 adds a WKWebView API to switch the GPC header on or off | Safari 27 release notes |
| Extensions | Privacy Badger, OptMeowt, Disconnect and others | GPC project site |
Google does not define eligible users in that entry. PiunikaWeb reported in August 2026 that a Chromium code review keeps GPC eligibility configurable by region. If Chrome shows the toggle only where law requires it, the signal may cluster in California first.
The practical effect of 1 January 2027 is that GPC moves from privacy-focused browsers to the browsers most of your visitors use. If your opt-out handling has only been tested against a few Brave users, it has not really been tested. Chrome now ships on a two-week release cycle, so recheck often.
What your site must already do under the CCPA regulations
The CCPA applies to a for-profit business doing business in California that meets one of three thresholds: annual gross revenue above $26,625,000 (the 2025 inflation-adjusted figure), buying, selling or sharing the personal information of 100,000 or more consumers or households, or earning 50% or more of revenue from selling or sharing personal information. The money figures adjust every odd-numbered year, so expect new ones for 2027.
If you sell or share personal information (sharing includes cross-context behavioural advertising), the regulations set out what you owe a visitor who sends a valid signal.
| Requirement | Regulation | What it means in your tag stack |
|---|---|---|
| Treat a signal sent as an HTTP header or JavaScript object as an opt-out of sale and sharing | 7025(b), (c)(1) | Read the Sec-GPC header and the navigator property on every page load |
| Apply it to the browser, any pseudonymous profile tied to it and the consumer if known | 7025(c)(1) | Cookie IDs, ad IDs, CDP profiles and, when logged in, the account and offline sales |
| Ask for nothing extra to process it | 7025(c)(2) | No email confirmation step before the opt-out takes effect |
| The signal beats a conflicting site setting | 7025(c)(3), 7026(k) | A past accept-all does not override GPC; you may flag the conflict and offer consent, otherwise wait 12 months before asking |
| A missing signal later is not consent | 7025(c)(5) | Keep the account-level opt-out when the user logs in on another device |
| Show whether you processed it | 7025(c)(6), 7026(g) | Status text or an opted-out toggle |
| Stop as soon as feasibly possible, within 15 business days at most, and tell third parties | 7026(f) | Tags that can stop at once must; notify vendors who received data before you complied |
| Optional frictionless route | 7025(e) to (g) | No pop-up or changed experience; the opt-out link can then go if your privacy policy says so and the signal fully covers the opt-out |
The 15 business days are an outer limit: the regulations' own example says a site that can stop real-time ad transfers instantly must do so, not wait. A cookie banner alone is not an acceptable opt-out method under section 7026(a)(4).
The regulations effective 1 January 2026 say a business must display the status, and CalPrivacy's August 2026 briefing repeats it. Older third-party copies, including Cornell's, still say may. The regulation's example wording is Opt-Out Request Honored; the briefing uses Opt-Out Preference Signal Honored.
Enforcement so far
Regulators have treated opt-out signals as a priority for four years, before any browser was required to offer one.
| Action | Date | Regulator | Amount | Opt-out finding |
|---|---|---|---|---|
| Sephora | 24 Aug 2022 | California Attorney General | $1,200,000 | First CCPA settlement; GPC must be treated as a valid opt-out |
| Healthline Media | 1 Jul 2025 | California Attorney General | $1,550,000 | Opt-outs from targeted advertising failed; CalPrivacy says GPC was emphasised again |
| Joint GPC sweep | 9 Sep 2025 | CPPA with California, Colorado and Connecticut AGs | Compliance letters | Businesses not processing GPC told to comply |
| Tractor Supply | 30 Sep 2025 | CPPA Board | $1,350,000 | No effective opt-out, including through signals such as GPC |
| Walt Disney Company | 11 Feb 2026 | California Attorney General | $2,750,000 | GPC applied only to the device, even for logged-in users |
| PlayOn Sports | 3 Mar 2026 | CPPA Board | $1,100,000 | Forced agreement to tracking, pointed users to industry opt-out pages, did not recognise signals |
| Ford Motor Company | 5 Mar 2026 | CPPA Board | $375,703 | Email verification before opt-out; must audit trackers and honour GPC |
Three patterns stand out. Remedies now include tracker audits, for Tractor Supply and Ford. Friction counts: Ford required email verification, and PlayOn sent users to the NAI and DAA tools instead of offering its own method. Scope counts: Disney's opt-outs stopped at the device or service, not the account.
Privacy World reported that Senator Ron Wyden wrote in August 2026 to attorneys general in 11 states asking them to expect businesses to honour the signal regardless of a resident's location or IP address, a test he considers flawed.
Wire GPC into your tag stack: eight steps
These steps assume Google Tag Manager, Google Ads, GA4 and Meta.
1. Detect the signal once, before any tag fires
Read the browser property in a tag on the Consent Initialization - All Pages trigger and push it to the data layer.
// Runs before any marketing tag
window.dataLayer = window.dataLayer || [];
var gpcOn = navigator.globalPrivacyControl === true;
window.dataLayer.push({ event: 'gpc_detected', gpc: gpcOn });
On the server, check the header. The draft says a server must ignore Sec-GPC unless its value is exactly 1.
2. Decide your scope
You can honour GPC only for visitors you place in California, or for all US traffic. IP geolocation misplaces travellers and VPN users, and Senator Wyden has asked attorneys general to look past it. All-US is the simplest position to defend; California-only keeps more remarketing reach but needs a documented reason.
3. Turn on Google Ads restricted data processing
Google's documented route for US state laws is restricted data processing (RDP). Set it per user in the Google tag:
gtag('config', 'TAG_ID', { 'restricted_data_processing': true });
In Tag Manager, the Google Ads Conversion and Remarketing tags have an Enable Restricted Data Processing field that a data layer variable can drive. Google says RDP stops users being added to remarketing lists while conversion tracking continues, and that in states that name GPC, Google itself turns off ads targeting and activates RDP when it receives the signal. For server-to-server remarketing pings, Google asks for rdp=1 on the request.
4. Map GPC to consent mode where it helps
You can also set consent mode's ad_user_data and ad_personalization to denied for GPC visitors so every consent-aware Google tag behaves the same way. In Tag Manager, use your consent template's updateConsentState API rather than the gtag consent update command, as Google advises.
Do not switch off analytics by reflex. The W3C draft says GPC is not designed to address collection within the same context, and Google says Google Analytics acts as a service provider under its US state privacy terms unless you have enabled sharing with Google products and services.
5. Send Meta Limited Data Use
With Meta's Limited Data Use (LDU) flag on, Meta says it processes the data in its role as a service provider or processor, for people in the states it lists, which include California. Set it before init:
// LDU for California: country 1 (USA), state 1000 (California)
fbq('dataProcessingOptions', ['LDU'], 1, 1000);
fbq('init', 'PIXEL_ID');
Pass 0, 0 to let Meta geolocate. For the Conversions API, add data_processing_options, data_processing_options_country and data_processing_options_state to each event. Meta warns that retargeting and measurement are limited with LDU on.
6. Hold back everything else
Any ad or data vendor without service-provider terms that restrict its use of the data should not fire for GPC visitors. Add a trigger exception (gpc equals true) to those tags. Tractor Supply was also cited for missing contract terms, so check the paperwork too.
7. Carry the flag server-side and offline
Google says that with server-side Tag Manager you only need consent mode in the web container, because consent parameters travel with each request and Google's server tags respect them. Non-Google destinations need their own checks. Read the header at your edge or application server too, so the opt-out reaches the Conversions API, offline conversion imports and CRM audience exports.
// Express middleware: record GPC for this request and the account
app.use((req, res, next) => {
req.gpc = req.get('Sec-GPC') === '1';
if (req.gpc && req.user) {
recordOptOut(req.user.id, 'gpc'); // your own persistence function
}
next();
});
Exclude opted-out accounts from Customer Match and similar uploads. Google states that since 1 July 2023 restricted data processing is not available in California where the advertiser engages in cross-context behavioural advertising, including Customer Match.
8. Show the status, publish gpc.json and test
Display the status text, or an opted-out toggle in your privacy settings. Under the frictionless route, the status is allowed but a pop-up is not. Publish a support resource at /.well-known/gpc.json:
{ "gpc": true, "lastUpdate": "2026-12-01" }
Test with Firefox's GPC setting, the GPC reference server and an automated browser; the W3C draft defines a WebDriver command to set GPC for a test session. Check the network panel: Google Ads hits should carry RDP, Meta events LDU, and blocked vendors should send nothing.
Decision table: what each tag does when GPC is on
| Tag or data flow | GPC off | GPC on, visitor in scope |
|---|---|---|
| Google Ads conversion tag | Normal | RDP on; conversions still counted |
| Google Ads remarketing tag | Normal | RDP on; no additions to remarketing lists |
| GA4 with sharing and ads personalisation off | Normal | Keep running |
| Meta Pixel and Conversions API | Normal | LDU with state 1000, or geolocation |
| Other ad pixels without service-provider terms | Normal | Do not fire |
| Customer Match and CRM audience uploads | Include | Exclude the person |
Worked example: what GPC does to a California remarketing pool
An illustrative scenario with stated assumptions, not measured data. Replace the inputs with your own logs.
- Monthly California sessions: 400,000.
- GPC share today (assumption): 6%, which is 24,000 sessions.
- GPC share after browsers expose a setting (assumption): 25%, which is 100,000 sessions.
Remarketing-eligible sessions fall from 400,000 - 24,000 = 376,000 to 400,000 - 100,000 = 300,000: 76,000 fewer, a drop of 76,000 / 376,000 = 20.2%.
Measure the real share now: log the weekly ratio of requests carrying Sec-GPC: 1 to all California requests, so the step change is visible when it comes.
Beyond California: where the signal already binds
CalPrivacy's August 2026 briefing lists at least 12 states that require businesses to honour opt-out preference signals or universal opt-out mechanisms: California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon and Texas. It adds Louisiana from January 2027 and Vermont from January 2028. Our guide to new US state privacy laws for 2027 compares those statutes.
Teams in India running US marketing stacks should note the different model: GPC is a US opt-out from sale and sharing, while India's DPDP Act is consent-based. A stack serving both needs separate logic, as our guide to DPDP consent for GA4, ad pixels and CRM explains.
Implementation checklist
- By 15 November 2026: inventory every tag, pixel and server-side destination; mark which vendors have service-provider terms.
- By 30 November: add GPC detection to the data layer and server logs; agree scope with counsel and record the reason.
- By 10 December: wire RDP, Meta LDU and trigger exceptions; propagate account-level opt-outs to the CRM, CDP and audience uploads.
- By 15 December: add the status display, publish
/.well-known/gpc.jsonand update the privacy policy.
- By 20 December: run automated tests with GPC on and off and keep the network captures as evidence.
- From 1 January 2027: track GPC share and list sizes weekly; recheck after Chrome, Edge and Safari releases.
How eCorpIT can help
eCorpIT is a Gurugram-based technology organisation, founded in 2021, assessed at CMMI Level 5 and MSME certified, with senior-led engineering teams working across AWS, Microsoft and Google platforms. Our server-side tagging and consent measurement service can audit your tag stack, wire opt-out signals into it and hand over test evidence for your counsel. Talk to us at /contact-us/.
Last updated: 1 November 2026.
