Universal Opt-Out Mechanisms and the Global Privacy Control
Comprehensive state privacy laws increasingly require businesses to honor universal opt-out mechanisms - a browser or device signal that lets a consumer opt out of the of their personal information across all sites at once. The leading example is the Global Privacy Control (GPC), and California and Colorado have the most substantive guidance requiring businesses to honor such signals.
A universal opt-out mechanism is a browser or device signal that lets a consumer opt out of the sale, sharing, or targeted advertising of their personal information across all sites at once, without having to make a separate request to each individual site. The leading example is the Global Privacy Control (GPC).
Among the comprehensive state privacy laws, California and Colorado have the most substantive guidance and require businesses to honor such signals. By the end of 2026, states with some form of universal-opt-out requirement also include Texas, Montana, Delaware, Nebraska, New Hampshire, New Jersey, Minnesota, Maryland, Connecticut, and Oregon.
The defining feature of a universal opt-out mechanism is scope: a single signal opts the consumer out across all sites at once. This complements, rather than replaces, California's per-site "Do Not Sell or Share My Personal Information" link and its opt-in consent requirement for sensitive data.
Do not confuse a universal opt-out signal with a single business's "Do Not Sell or Share My Personal Information" link. The link is exercised on one site at a time; the universal signal carries the opt-out to every site the consumer visits without a separate request to each.