DxtraBETA
Back to blog
GuidesUnited StatesCaliforniaE-commerceSmall Business October 2026Updated 7 min read

Every browser gets a "do not sell my data" switch. For most small Shopify stores the laws behind it do not apply, but just in case, it is a ten-minute fix

From 1 January 2027 every browser must offer Global Privacy Control. Most small Shopify stores are not covered, but the fix takes ten minutes. Here is how.

A laptop showing an online store with a browser privacy switch, labelled Do not sell or share my data, turned on, beside a checklist of three steps and a ten-minute timer on a warm desk.

You may have seen the headline: California is making every web browser add a "do not sell or share my data" switch.

For most small stores, the laws behind that switch do not apply. Here is the short version of what is changing, the answer on whether it applies to you, and the ten minutes worth spending anyway.

In a hurry? Turn on Shopify's data sharing opt-out page, move any hand-pasted tracking code into Shopify's pixel settings, and test with a browser that sends the signal. The steps are below.

What is changing

The switch is called Global Privacy Control (GPC). When it is on, the browser tells every site it visits: do not sell or share my personal information. In practice, that is about ad tracking: the pixels that follow a visitor from your store to their Instagram feed.

As of October 2026, only a few browsers send it, such as Brave, DuckDuckGo and Firefox's private windows. From 1 January 2027, a California law requires browser makers to offer the setting. Chrome is already working on one.

The law puts the duty on browser makers. Nothing new lands on your store on that date.

Does the law behind it apply to you?

Probably not, though only your own numbers can settle it. California's privacy law (the CCPA) covers a for-profit business that does business in California and meets any one of three tests:

  • more than $26,625,000 in annual gross revenue;
  • buying, selling or sharing the personal data of 100,000 or more Californians or households a year;
  • earning half its revenue from selling or sharing personal data.

About a dozen states, California included, require businesses to honor the signal. Most count residents, with thresholds as low as 25,000 in Montana. Texas and Nebraska largely exempt businesses that count as small under federal small-business definitions, which covers most independent stores. A typical Shopify store is likely to be below all of them.

When a small business can cross the line. The 100,000 test counts people, not revenue. Picture a UK independent book publisher with a big US readership, selling to customers in California. It can have a million US visitors a year and a Meta pixel on every page. Roughly one in nine Americans lives in California, so that pixel may be sharing data on more than 100,000 Californians a year. Upload the mailing list to Meta for ad targeting and the count may grow. Visitors are not the same as unique people, and no regulator has ruled on any one pixel by name, so this is a reason to check your numbers, not a verdict. But being small and based abroad does not settle it.

Connecticut is the other one to know. Since 1 July 2026, its law covers any business that offers Connecticut residents' personal data for sale, whatever the numbers. Whether an ad pixel counts as a "sale" there has not been settled.

Why spend ten minutes anyway

The pixels are what the big penalties were about. Several of California's best-known privacy settlements, including Sephora, Healthline and Disney, were about ad trackers that kept running after people said no. Those were large companies. The problem was the same one your store has: a pixel nobody switched off.

Lawsuits do not check your size. California has a separate wiretap law that lawyers are using against websites with pixels and chat widgets.

  • A July 2026 California Assembly committee analysis quotes the bill's sponsor as counting 4,000 lawsuits, and adding: "Tens of thousands more have received demand letters".
  • The defendants it names include a bakeshop and a plumbing company. It says one law firm targeted about 40 plumbing and HVAC companies.
  • The law allows $5,000 per violation, or three times the actual damages if that is more.

A law signed on 30 September 2026 (SB 690) stops private lawsuits under one part of that law over website and app tracking from 1 January 2027. It also reaches back to pending claims in suits filed in the two years before that date. It does not touch the wiretap part, which lawyers also use against pixels and chat tools.

Honoring GPC is no defense to these suits on its own. But knowing which trackers your store runs, and being able to stop them, is the same job.

Every browser must offer the signal from 1 January 2027. Once every browser has the switch, some of your customers will turn it on. A store that respects it quietly looks better than one that does not.

The ten-minute fix

1. Turn on Shopify's opt-out page. In your Shopify admin, go to Settings > Customer privacy, then click Data sharing opt-out page. Turn on "Use automated settings" (or pick the regions yourself), choose where the link sits in your store menu, and save. Shopify says that when the GPC header is present, it "activates opting out of data sale or sharing or targeted advertising by Shopify and third parties" for visitors in those regions.

2. Find the tracking code Shopify cannot see. Shopify only controls the pixels it manages. Anything pasted directly into your theme, or added by an app outside Shopify's pixel system, is on its own. Shopify's own help page says that if you have "manually installed third-party cookies or pixels or integrated them through apps", you "may need to use a third-party cookie banner or add custom logic". Ask whoever built your store to check the theme code, and move what they find into Shopify's pixel settings where possible.

3. Test it. Install Brave, or turn on Firefox's "Tell websites not to sell or share my data" setting, and visit your store. Your ad pixels should not load. Shopify applies the opt-out only to visitors in the regions your opt-out page covers, so test from one of those regions, or ask a customer there to try it. Whoever built your store can confirm it in the browser's developer tools in a couple of minutes, or the free scan below checks it for you.

The relief of knowing, not guessing

If you would rather not check this by hand, the free privacy scan drives a real browser through your store. It tests whether your site respects the GPC signal, which cookies and trackers fire before consent, and whether "Reject all" actually works. You get a risk band with cited findings in under a minute, with no account.

If the scan finds gaps, Dxtra's consent management honors GPC for you. Tags only fire after consent, the opt-out is passed on to the ad partners you have connected, and each visitor sees their status on your store and in your Transparency Center. Every consent decision is logged with a timestamp. Plans start at $10/month, with a 14-day money-back guarantee on the START plan.

Sources

Current as of 15 October 2026. Thresholds, deadlines, Shopify settings and lawsuit numbers move; check the linked source before you rely on any of them.

This article is general information, not legal advice. Rules change; confirm anything that matters with the California Privacy Protection Agency, your state attorney general or a qualified adviser before you rely on it. The publisher example is illustrative, not a real business.

Know where you stand in a minute

Most small stores are fine on the law and one setting away from being fine on the pixels. Run the free scan to find out which one you are, and then get started with Dxtra from $10/month.

Ready to get compliant?

Start your privacy program today — from $10/month.

Get StartedProduct Tour