Universal opt-out mechanism implementation across US state privacy laws. Covers Global Privacy Control (GPC) signal technical implementation, state-by-state recognition requirements, browser detection methods, authenticated vs unauthenticated handling, and compliance testing.
Universal opt-out mechanism implementation across US state privacy laws. Covers Global Privacy Control (GPC) signal technical implementation, state-by-state recognition requirements, browser detection methods, authenticated vs unauthenticated handling, and compliance testing.
A universal opt-out mechanism is a browser or device-level signal that communicates a consumer's privacy preferences to websites and online services. The Global Privacy Control (GPC) is the leading universal opt-out mechanism, supported by major browsers (Firefox, Brave, DuckDuckGo) and browser extensions (Privacy Badger, Disconnect). Multiple US state privacy laws now require businesses to recognize and honor these signals.
GPC is defined in the Global Privacy Control specification (published by the GPC project), transmitted via the Sec-GPC: 1 HTTP header and the navigator.globalPrivacyControl JavaScript API.
State-by-State Requirements
State
Law
Signal Required
Effective Date
Scope
California
CCPA/CPRA
Yes
Jan 1, 2023
Sale + Sharing
Colorado
CPA
Yes
Jul 1, 2024
Targeted ads + Sale
Connecticut
CTDPA
Yes
Jan 1, 2025
Targeted ads + Sale
Montana
MTDPA
Yes
Oct 1, 2025
Targeted ads + Sale
Texas
TDPSA
Not required
N/A
N/A
Virginia
VCDPA
Not required
N/A
N/A
Oregon
OCPA
Not required
N/A
N/A
Kentucky
KPPA
Not required
N/A
N/A
GPC Technical Specification
HTTP Header
Sec-GPC: 1
The Sec-GPC header is a structured header with a bare item value of 1 (true) or absent (no preference expressed). The Sec- prefix indicates it is a fetch metadata header set by the browser, not by JavaScript.
JavaScript API
navigator.globalPrivacyControl// boolean: true or undefined
The navigator.globalPrivacyControl property returns if the user has enabled GPC in their browser or extension, or if GPC is not active.
true
undefined
Detection Code
functiondetectGPC() {
// Check JavaScript APIconst jsGPC = navigator.globalPrivacyControl === true;
// The HTTP header is checked server-side// This function covers client-side detection onlyreturn {
gpcEnabled: jsGPC,
timestamp: newDate().toISOString(),
userAgent: navigator.userAgent,
};
}
With GPC enabled: verify third-party advertising tags do NOT fire
Without GPC: verify third-party advertising tags fire normally
Inspect network requests to confirm suppression
Test 3: Authenticated vs. Unauthenticated
Visit with GPC while logged out: verify session-level opt-out
Log in with GPC: verify account-level opt-out persists
Log in without GPC after prior GPC opt-out: verify prior opt-out persists (account-level)
Test 4: No Pop-Up or Interstitial
Visit with GPC: verify no pop-up asks to confirm or modify signal
Verify consent banner does not override or question GPC signal
Test 5: Conflict Resolution
Set account preference to opt-in to sale/targeted ads
Visit with GPC enabled
Verify GPC takes precedence (opt-out applied)
Liberty Commerce Inc. Implementation
Technology stack: Consent management platform (CMP) with GPC signal handler, tag management system (TMS) with server-side control, privacy operations dashboard.
Architecture:
Edge proxy detects Sec-GPC: 1 header on incoming requests
Request metadata includes gpc_opt_out: true flag
TMS evaluates flag before injecting any tags
CMP state updated for session/account
Server-side data sharing pipeline checks flag before transmitting to third parties
Compliance dashboard reports GPC detection rates and opt-out volume
