On September 9, the California Privacy Protection Agency (CPPA) and the Attorneys General of California, Colorado, and Connecticut announced a joint enforcement sweep targeting businesses that may be failing to honor consumer opt-out requests under state privacy laws. The joint effort centers on the Global Privacy Control (GPC), a browser setting that automatically signals to companies that a consumer does not want their personal information sold or shared.
The sweep underscores increasing state-level enforcement of consumer privacy protections, particularly where businesses fail to recognize or process opt-out signals. Regulators emphasized that refusal to honor GPC requests could amount to violations of state privacy statutes, including laws modeled after the California Consumer Privacy Act. The announcement also follows earlier CPPA enforcement actions and highlights unfair, deceptive, or abusive practices (UDAP) concerns tied to ignoring consumer choices in online tracking and data sharing.
Specifically, the coalition’s announcement emphasized that businesses:
- Must recognize GPC signals as opt-out requests. Companies are required to process GPC submissions as valid consumer opt-outs rather than forcing consumers to make site-by-site requests.
- Cannot impose obstacles to opting out. State privacy laws require a clear “Do Not Sell or Share My Personal Information” link or equivalent mechanism, without conditioning compliance on account creation or other barriers.
Regulators are contacting suspected noncompliant businesses and directing them to come into compliance immediately, signaling that additional actions may follow.
Putting It Into Practice: The multistate sweep signals that honoring opt-out rights is an active enforcement priority for state privacy regulators, building on the CPPA’s recent rulemaking on ADMT, cybersecurity audits, and risk assessments (previously discussed here). Businesses should not only confirm their systems detect and process Global Privacy Control signals, but also review opt-out mechanisms for clarity and accessibility.