universal-opt-out

name	universal-opt-out
title	Universal Opt-Out Mechanism Implementation
description	Universal opt-out mechanism implementation across US state privacy laws. Covers Global Privacy Control (GPC) signal technical implementation, state-by-state recognition requirements, browser detection methods, authenticated vs unauthenticated handling, and compliance testing.
author	mukul975
author_url	https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/universal-opt-out
license	Apache-2.0
version	0.1.0
execution_mode	open
jurisdiction	us
practice	data-protection
language	en

Universal Opt-Out Mechanism Implementation

Overview

A universal opt-out mechanism is a browser or device-level signal that communicates a consumer's privacy preferences to websites and online services. The Global Privacy Control (GPC) is the leading universal opt-out mechanism, supported by major browsers (Firefox, Brave, DuckDuckGo) and browser extensions (Privacy Badger, Disconnect). Multiple US state privacy laws now require businesses to recognize and honor these signals.

GPC is defined in the Global Privacy Control specification (published by the GPC project), transmitted via the Sec-GPC: 1 HTTP header and the navigator.globalPrivacyControl JavaScript API.

State-by-State Requirements

State	Law	Signal Required	Effective Date	Scope
California	CCPA/CPRA	Yes	Jan 1, 2023	Sale + Sharing
Colorado	CPA	Yes	Jul 1, 2024	Targeted ads + Sale
Connecticut	CTDPA	Yes	Jan 1, 2025	Targeted ads + Sale
Montana	MTDPA	Yes	Oct 1, 2025	Targeted ads + Sale
Texas	TDPSA	Not required	N/A	N/A
Virginia	VCDPA	Not required	N/A	N/A
Oregon	OCPA	Not required	N/A	N/A
Kentucky	KPPA	Not required	N/A	N/A

GPC Technical Specification

HTTP Header

Sec-GPC: 1

The Sec-GPC header is a structured header with a bare item value of 1 (true) or absent (no preference expressed). The Sec- prefix indicates it is a fetch metadata header set by the browser, not by JavaScript.

JavaScript API

navigator.globalPrivacyControl  // boolean: true or undefined

The navigator.globalPrivacyControl property returns if the user has enabled GPC in their browser or extension, or if GPC is not active.