| name | universal-opt-out |
| title | Universal Opt-Out Mechanism Implementation |
| description | Universal opt-out mechanism implementation across US state privacy laws. Covers Global Privacy Control (GPC) signal technical implementation, state-by-state recognition requirements, browser detection methods, authenticated vs unauthenticated handling, and compliance testing. |
| author | mukul975 |
| author_url | https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/universal-opt-out |
| license | Apache-2.0 |
| version | 0.1.0 |
| execution_mode | open |
| jurisdiction | us |
| practice | data-protection |
| language | en |
Universal Opt-Out Mechanism Implementation
Overview
A universal opt-out mechanism is a browser or device-level signal that communicates a consumer's privacy preferences to websites and online services. The Global Privacy Control (GPC) is the leading universal opt-out mechanism, supported by major browsers (Firefox, Brave, DuckDuckGo) and browser extensions (Privacy Badger, Disconnect). Multiple US state privacy laws now require businesses to recognize and honor these signals.
GPC is defined in the Global Privacy Control specification (published by the GPC project), transmitted via the Sec-GPC: 1 HTTP header and the navigator.globalPrivacyControl JavaScript API.
State-by-State Requirements
| State | Law | Signal Required | Effective Date | Scope |
|---|
| California | CCPA/CPRA | Yes | Jan 1, 2023 | Sale + Sharing |
| Colorado | CPA | Yes | Jul 1, 2024 | Targeted ads + Sale |
| Connecticut | CTDPA | Yes | Jan 1, 2025 | Targeted ads + Sale |
| Montana | MTDPA | Yes | Oct 1, 2025 | Targeted ads + Sale |
| Texas | TDPSA | Not required | N/A | N/A |
| Virginia | VCDPA | Not required | N/A | N/A |
| Oregon | OCPA | Not required | N/A | N/A |
| Kentucky | KPPA | Not required | N/A | N/A |
GPC Technical Specification
HTTP Header
Sec-GPC: 1
The Sec-GPC header is a structured header with a bare item value of 1 (true) or absent (no preference expressed). The Sec- prefix indicates it is a fetch metadata header set by the browser, not by JavaScript.
JavaScript API
navigator.globalPrivacyControl
The navigator.globalPrivacyControl property returns if the user has enabled GPC in their browser or extension, or if GPC is not active.
