Universal opt-out mechanisms: which states require them and how to implement one

What is a universal opt-out mechanism?

A universal opt-out mechanism is a browser-level or device-level signal that communicates a consumer's preference to opt out of the sale or sharing of their personal data. Instead of visiting each website individually and clicking "Do Not Sell My Data," consumers set the signal once and every website they visit is expected to honor it.

The most widely adopted standard is Global Privacy Control (GPC) — a browser setting or extension that sends a machine-readable signal with every web request. As of 2026, ten states require businesses to recognize and honor this signal.

Which states require it?

State	Law	Required Since
California	CCPA/CPRA	Jan 2023
Colorado	CPA	Jul 2023
Connecticut	CTDPA	Jul 2023
Texas	TDPSA	Jan 2025
Montana	MTCDPA	Oct 2024
Oregon	OCPA	Jan 2026
Delaware	DPDPA	Jan 2025
Nebraska	NDPA	Jan 2025
New Hampshire	NHPA	Jan 2025
Minnesota	MNCDPA	Jul 2025

States that do NOT require it: Virginia, Utah, Iowa, Indiana, Tennessee, Florida, New Jersey, Maryland, Kentucky, Rhode Island.

The trend is clear — more states are requiring universal opt-out recognition with each legislative session. Even if your primary markets are in states that don't currently require it, implementing GPC support now is forward-looking compliance.

How Global Privacy Control works

When a consumer enables GPC in their browser (built into Firefox, Brave, and DuckDuckGo; available as an extension for Chrome and Edge), every HTTP request from that browser includes a header:

Sec-GPC: 1

There's also a JavaScript API that websites can check:

navigator.globalPrivacyControl // returns true if GPC is enabled

Your website needs to detect this signal and respond by:

1. Not selling or sharing that consumer's personal data
2. Not loading third-party tracking scripts that would constitute a sale or sharing
3. Treating the signal as a valid opt-out request under applicable state laws

What "honoring" the signal means in practice

Honoring GPC isn't just about detecting the header. It means actually changing your site's behavior for that visitor:

You must stop:

• Firing advertising pixels that share data with ad networks (Meta Pixel, Google Ads, TikTok Pixel)
• Loading retargeting scripts
• Sharing browsing behavior with data brokers or analytics platforms that resell data
• Any other data sharing that constitutes a "sale" under applicable state laws

You can continue:

• First-party analytics (data stays with you)
• Essential functionality cookies
• Payment processing
• Fraud prevention
• Data sharing required by law

The distinction between "sale/sharing" and "processing" is critical. Using data internally is fine. Sharing it with third parties for their independent use or for cross-site advertising is what triggers the opt-out.

Step-by-step implementation

Step 1: Audit your third-party scripts

Before implementing GPC, you need to know what scripts on your site share data with third parties. Common culprits:

• Google Analytics (if configured to share data with Google Ads)
• Meta/Facebook Pixel
• Google Ads conversion tracking
• TikTok Pixel
• Pinterest Tag
• Third-party review platforms
• Retargeting platforms
• Customer data platforms that syndicate data

Step 2: Implement a consent management platform (CMP)

A CMP handles the technical work of detecting GPC signals and managing script loading. Popular options for e-commerce:

• Osano — straightforward, good Shopify integration
• OneTrust — enterprise-grade, more complex
• Cookiebot — good balance of features and simplicity
• Termly — budget-friendly option

Most CMPs can automatically detect the Sec-GPC: 1 header and suppress non-essential scripts.

Step 3: Configure conditional script loading

If you're implementing without a CMP, you need to conditionally load scripts based on the GPC signal:

// Check for GPC signal
const gpcEnabled = navigator.globalPrivacyControl === true;

if (!gpcEnabled) {
  // Load advertising and tracking scripts
  loadMetaPixel();
  loadGoogleAds();
  loadRetargeting();
} else {
  // Only load essential scripts
  loadFirstPartyAnalytics();
}

For tag managers (Google Tag Manager), configure triggers that check the GPC signal before firing advertising tags.

Step 4: Update your privacy policy

Your privacy policy should state:

• That you recognize universal opt-out mechanisms
• Specifically that you honor the Global Privacy Control signal
• What happens when GPC is detected (which data sharing stops)
• How consumers can enable GPC in their browser

Step 5: Test your implementation

1. Install the GPC browser extension (available for Chrome)
2. Visit your site with GPC enabled
3. Open browser developer tools (Network tab)
4. Verify that advertising pixels and tracking scripts are NOT loading
5. Verify that essential functionality still works
6. Test the checkout flow to ensure payment processing is unaffected

Step 6: Document your compliance

Maintain documentation of:

• Your GPC detection implementation
• Which scripts are suppressed when GPC is detected
• Testing results and dates
• Any edge cases or exceptions

This documentation is your evidence of compliance if a state AG inquires.

Common implementation mistakes

Mistake 1: Detecting GPC but not actually changing behavior. Some implementations detect the signal and log it but still fire all the same scripts. This is not compliance.

Mistake 2: Only checking on the first page load. GPC must be honored on every page, not just the landing page.

Mistake 3: Requiring consumers to also click a cookie banner. If GPC is present, it overrides any cookie consent. You cannot require a consumer to additionally interact with a cookie banner.

Mistake 4: Not applying GPC to server-side data sharing. If your server shares customer data with third parties via APIs (not just client-side pixels), GPC must be applied to those flows too.

Mistake 5: Treating GPC as applying only to cookies. GPC is an opt-out of data sale and sharing, not just cookie consent. It applies to all forms of data sharing that constitute a sale under applicable laws.

Stay on top of changes like these — BriefStack monitors all 20 state privacy laws and delivers what matters to your inbox daily.

---

This article is for informational purposes only and does not constitute legal advice. Consult a qualified attorney for guidance specific to your business.