DxtraBETA
Back to blog
GuidesUnited StatesCaliforniaEngineeringRegulations October 2026Updated 15 min read

Every browser must offer an opt-out switch from 1 January 2027. Here is the GPC integration checklist the enforcement record already wrote

From 1 January 2027, browsers must offer Global Privacy Control. What your stack must do when Sec-GPC: 1 arrives, mapped to the fines already issued.

A code editor on a laptop showing a request header Sec-GPC: 1 and a check of navigator.globalPrivacyControl, beside a printed eight-item integration checklist on a warm desk.

Somewhere in your request logs there is a header you are probably not reading: Sec-GPC: 1.

In 2026 it mostly comes from Brave, DuckDuckGo and Firefox private windows. From 1 January 2027, California's Opt Me Out Act (AB 566) requires browser makers to build in a setting that sends it. Chrome has started work on one. Once that setting exists, the signal moves from privacy enthusiasts to anyone who flips a switch in their browser settings.

The law puts that duty on browser makers, not on you. But if your company is covered by California's privacy law, you have had to honor the signal for years. Since 1 January 2026 you have also had to show visitors that you did. The regulators have been fining companies over exactly this. This post covers what the signal is, who has to act on it, and an integration checklist where every item maps to a fine that already happened.

In a hurry? Read the header server-side, stop the tags before they render, persist the opt-out to the account, show the status, tell your ad partners, and monitor it. The full checklist, with code, is further down.

What the signal is

Global Privacy Control (GPC) is a W3C draft standard with three parts:

  • An HTTP request header: Sec-GPC: 1. 1 is the only valid value, and the header is simply absent when the setting is off.
  • A JavaScript property: navigator.globalPrivacyControl, a read-only boolean that is true whenever the browser would send the header.
  • An optional site support file at /.well-known/gpc.json, where a site can state that it honors the signal.

It means one thing: do not sell or share my personal information. It is not a cookie-banner "reject all". It targets sale and sharing, which in practice means ad tech.

The specification is still a W3C Working Draft. A security review was requested in September 2026 ahead of the next stage, so describe it as a draft standard in anything you publish.

What changes on 1 January 2027

For browsers, a lot. AB 566 adds section 1798.136 to the California Civil Code. A business "shall not develop or maintain a browser that does not include functionality configurable by a consumer" to send an opt-out preference signal. The setting has to be "easy for a reasonable person to locate and configure", and the browser maker has to explain how it works.

For browser support, it is already moving:

  • Brave and DuckDuckGo send GPC by default.
  • Firefox has a setting, and has sent GPC by default in private browsing since version 120.
  • Chrome posted an "Intent to Prototype" in January 2026 that cites the California requirement. Trade press has reported a setting in Chrome's Canary test builds, and Chrome's own status page lists no ship milestone.
  • Apple has made no announcement. WebKit, the engine behind Safari, has a tracked change titled "Add support for GPC" that was marked fixed in May 2026. We found no public statement from Microsoft about Edge.

For volume, expect a ramp, not a cliff. Colorado's rules say a universal opt-out "may not be the default setting" for a tool that comes pre-installed with a device, such as a browser. So Chrome and Safari will most likely ship it switched off, and adoption will climb as people find the setting.

For your obligations, nothing new. AB 566 changes nothing about what a business must do when the signal arrives. That duty already exists, and it is the subject of the rest of this post.

Does this apply to your company?

California. The California Consumer Privacy Act (CCPA) covers a for-profit business doing business in California that meets any one of these:

  • more than $26,625,000 in annual gross revenue in the preceding calendar year (inflation-adjusted in odd-numbered years, so a new figure is due for 2027);
  • buys, sells or shares the personal information of 100,000 or more California consumers or households a year;
  • earns 50% or more of its revenue from selling or sharing personal information.

For most US-facing SaaS and e-commerce teams, the second test is the one to model. Under the CCPA, "sharing" means making personal information available to a third party "for cross-context behavioral advertising, whether or not for monetary or other valuable consideration." A retargeting pixel that fires for every visitor is the kind of tool that definition describes. Regulators have treated third-party trackers, the Meta Pixel among them, as selling or sharing in the cases below.

Other states. About a dozen states, California included, require covered businesses to honor a universal opt-out signal, and trackers disagree on the exact count, partly because Texas, Nebraska and Maryland word the duty differently. Vermont's requirement follows on 1 January 2028.

  • Colorado recognizes only one signal: GPC.
  • Since 1 July 2026, Connecticut's law has applied to anyone who offers consumers' personal data for sale, with no volume test, and to anyone who processes sensitive data. Its general threshold fell to 35,000 consumers. Whether an ad pixel counts as a "sale" under Connecticut's definition has not been settled.
  • Most other states count residents, with main thresholds as low as 25,000 in Montana. Texas and Nebraska have no numeric test at all; they exempt businesses that count as small under federal small-business definitions, although even those need consent before selling sensitive data.

Dates and thresholds move often enough that we recommend a maintained tracker over any table, including ours.

Below every threshold? The regulators may not reach you, but the lawyers can. California's wiretap law (CIPA) is being used against websites that run pixels, chat widgets and session replay, with no size threshold. A July 2026 California Assembly committee analysis quotes the bill's sponsor: lawsuits against California businesses rose from about 600 in early 2025 to 4,000, and "Tens of thousands more have received demand letters". The defendants it names include a plumbing company and a bakeshop. A law signed on 30 September 2026 (SB 690) changes one part of CIPA, the pen-register section. From 1 January 2027, only the Attorney General can sue a private business under that section over conduct on a website or app, and the change reaches back to pending claims in suits filed within the two years before that date. SB 690 does not touch the wiretap section, which plaintiffs also use against pixels, session replay and chat tools. Honoring GPC is not a defense to a CIPA claim. But the engineering lesson is the same: know what your pixels do, and be able to stop them.

What the California rules require when the signal arrives

The CCPA regulations (11 CCR §7025 and §7026, as amended from 1 January 2026) set out the duty:

  • Treat it as a valid opt-out of sale and sharing "for that browser or device and any consumer profile associated with that browser or device, including pseudonymous profiles". Where you know who the person is, apply it to them.
  • Show the visitor you processed it, on your website. This has been mandatory since 1 January 2026. The regulation's own example is the text "Opt-Out Request Honored" shown on the site, together with a toggle or radio button showing that the person has opted out. The exact wording is not prescribed.
  • If it conflicts with a setting the person made on your site, process the signal. You may then tell them about the conflict and offer a chance to consent. If they consent, you may set the signal aside for that known person, but you must still display their status.
  • If it conflicts with a financial incentive such as a loyalty discount, you may tell the person that honoring the signal withdraws them from the program, and ask them to confirm. If you do not ask, process the signal.
  • Stop selling and sharing as soon as feasibly possible, and within 15 business days at most. Notify every third party you sold or shared the person's data with after the request and before you complied, and direct them to comply and to pass the request on.
  • Do not add friction. The rules bar you from requiring a verified request for an opt-out. Demanding identity verification first is exactly what regulators have fined.

At its August 2026 meeting, the board of California's privacy regulator took up formal rulemaking on opt-out preference signals. Law-firm reports of the meeting say it voted to have staff draft the text, so expect more detail.

The enforcement record, read as a bug list

Every case below is a large company. Every one turns on an engineering failure, not a policy failure. The Attorney General's cases are court settlements with civil penalties, and the CPPA's are administrative fines agreed by stipulated order. In each, the "what broke" column summarizes what the regulator alleged or found.

CaseWhat brokeThe test that would have caught it
Sephora, California Attorney General, $1.2M (2022)Third-party trackers treated as a sale; GPC ignoredLoad the site with GPC on and list every third-party request
Honda, CPPA, $632,500 (2025)Required identity verification and excessive personal information before people could opt out; a privacy management tool that did not offer choices in a symmetrical way; data shared with ad tech companies without the required contract termsOpt out with no login and no extra details; check that every ad tech partner is under contract
Todd Snyder, CPPA, $345,178 (2025)A misconfigured privacy portal left opt-out requests unprocessed for 40 daysContinuous monitoring, not a one-off launch check
Healthline, California AG, $1.55M (2025)Trackers kept sharing data with advertising companies after people opted outAssert zero ad-tech requests after an opt-out
Tractor Supply, CPPA, $1.35M (2025)The opt-out form did not switch off third-party ad trackers; opt-out signals such as GPC not honored until July 2024End-to-end test of form, then cookies
Jam City, California AG, $1.4M (2025)Alleged: no CCPA-compliant opt-out in any of its 21 mobile apps, and data of 13- to 16-year-olds sold or shared without opt-in consent (settled)Check every app, not only the website, for a working opt-out
Disney, California AG, $2.75M (2026)Opt-out toggles applied per service and often per device; GPC applied per device, even for signed-in usersOpt out on one device; check another signed-in device
PlayOn Sports, CPPA, $1.10M (2026)Trackers such as the Meta Pixel; banner offered only "Agree"; opt-out preference signals ignored, although it ran only one targeted ad campaign on its ticketing platform"It's only one campaign" is not a scoping argument
Ford, CPPA, $375,703 (2026)Required email verification before processing opt-outsNo authentication on the opt-out path

(CPPA is the California Privacy Protection Agency, which uses the public name CalPrivacy.)

The integration checklist

1. Read the header server-side, before any tag renders. 

// Any server or edge runtime: decide before the page (and its tags) render
const gpc = request.headers.get("sec-gpc") === "1";

if (gpc) {
  // record the opt-out, and do not render sale/sharing tags on this response
}

Server-side is the reliable place: the decision is made before a single third-party script loads. That is the gap Healthline and Tractor Supply fell into.

2. Check it client-side too, before initializing any pixel. 

// undefined in browsers without GPC support, so compare to true
if (navigator.globalPrivacyControl === true) {
  // do not initialize ad or retargeting pixels
}

3. Persist it to the account. When a signed-in user, or a user you can recognize, arrives with GPC, write the opt-out to their profile so it follows them to other devices and apps. That is the Disney lesson.

4. Show the status. A line on the page ("Opt-Out Request Honored") and a toggle in account privacy settings. This has been mandatory in California since 1 January 2026.

5. Tell your ad partners. Blocking new data is half the job. The California rules also require you to notify the third parties you sold or shared the person's data with between the request and the moment you complied, and to direct them to comply. Build the downstream call into the same code path as the block, so the two cannot drift apart.

6. Never gate the opt-out. No login, no email verification, no "confirm you are human" step on the way out. That was Ford's fine.

7. Publish /.well-known/gpc.json. It is optional, but it is the only machine-readable way to say you honor the signal:

{ "gpc": true, "lastUpdate": "2027-01-01" }

Under the spec, true means you intend "to abide by GPC requests at least to the extent" you are legally obligated. Set lastUpdate to the date you made the statement. Only publish true while items 1 to 6 actually work, because a public claim that outlives a broken integration is its own problem.

8. Monitor continuously. Put a GPC-on crawl in CI or a scheduled job, and fail it if any sale or sharing request leaves the page. Todd Snyder's opt-out requests went unprocessed for 40 days. Test with Brave, Firefox and Chrome's test builds.

Where Dxtra fits

If you would rather not build this yourself, this is what Dxtra already does:

  • Consent management honors GPC, and the Dxtra consent banner shows each visitor their opt-out status on your own pages, which is where California's rules require that status to be displayed. The same status appears in your Transparency Center, the public privacy portal on your subdomain.
  • The opt-out follows a known person across devices, not just the browser it arrived on. Dxtra does this without storing the person's name or email address: each data subject has a pseudonymous identifier, not a name or email address, and it is matched against a salted hash when they identify themselves.
  • Tag management is server-side and consent-aware: analytics, advertising and marketing tags only fire after consent, so an opted-out visitor's data is not sent to begin with.
  • The opt-out is passed on to the ad partners you have connected, not just applied to new data.
  • Every consent decision is logged, GPC opt-outs included, with a timestamp, the categories, the mechanism used and the visitor's jurisdiction. When someone asks you to prove it, that log is the evidence.

Every plan includes all 16 platform capabilities. Plans differ only in usage limits:

PlanPriceDomainsLanguagesData subjectsAI regenerations a month
Start$10/month1English + 1Up to 50,0001
Growth$25/month3English + 2Up to 200,0002
Scale$100/month5English + 3Up to 1 million3
Enterprise$1,000/month10English + 10Up to 100 million10

Enterprise also includes dedicated deployment assistance on request. You can upgrade at any time, and the Start plan comes with a 14-day money-back guarantee.

Want to see what your site does? The free privacy scan drives a real browser against your site and tests its GPC behavior, alongside cookies, trackers and a working "Reject all". It returns a risk band with cited findings. No account needed.

Sources

Current as of 15 October 2026. Effective dates, thresholds, browser support and enforcement figures move; check the linked source before you rely on any of them.

This article is general information, not legal advice. Rules change; confirm anything that matters with the California Privacy Protection Agency, your state attorney general or a qualified adviser before you rely on it.

Ship it before the browsers do

The teams that come out of 2027 fine are not the ones with the longest privacy notice. They are the ones whose tags stop when the header says stop. Get started with Dxtra, take the product tour to see consent and tag management end to end, or scan your site first.

Ready to get compliant?

Start your privacy program today — from $10/month.

Get StartedProduct Tour