Just the Facts · Article

The privacy signal your site is ignoring

A browser setting can tell your website not to sell its visitor's data — silently, in a header nobody ever sees. Ignoring it has already cost companies over a million dollars each, and it fails on nearly every site we scan.

This is the one finding on your report that is completely invisible from the front of your website. The request arrives in a hidden header. If your site doesn't listen for it, nothing appears to be wrong — and you have no way of knowing you're ignoring thousands of them.

What the signal is

Some browsers can send a Global Privacy Control signal with every page request: a standing instruction that this visitor does not want their personal information sold or shared. It is not a cookie banner and not a link in your footer. It is sent automatically, before the visitor does anything, and your site either honours it or doesn't.

Why it has teeth

California's privacy regulations require businesses that sell or share personal information to process an opt-out preference signal as a valid opt-out request. The rule is technology-neutral — it doesn't name GPC — but GPC is the mechanism that meets the definition, and enforcement has proceeded on exactly that basis.

The Attorney General's first CCPA settlement, with Sephora in August 2022, was $1.2 million, in part for failing to process opt-out requests sent by user-enabled global privacy controls. The AG's own framing is the sentence worth remembering: businesses must treat opt-out requests made by user-enabled global privacy controls the same as requests made by users who have clicked the "Do Not Sell My Personal Information" link.

It didn't stop with Sephora

Healthline — $1.55 million, July 2025, the largest CCPA settlement to date. Among the findings: a consent banner that did not actually disable tracking cookies despite appearing to, and continued sharing with advertising third parties for consumers who had opted out.
Tractor Supply — $1.35 million, September 2025, the largest fine issued by California's privacy agency. The finding names the signal explicitly: no effective mechanism to opt out of selling and sharing, including through opt-out preference signals such as Global Privacy Control.
Todd Snyder — $345,178, May 2025. Not a signal case, but the same underlying failure: a misconfigured privacy portal that silently failed to process opt-out requests for 40 days.

Read those together and the pattern is clear. Regulators have moved on from whether you have a privacy policy to whether your opt-out plumbing actually works.

This is no longer just California

A growing number of states now require honouring a universal opt-out signal — Colorado since July 2024, Connecticut and Texas since January 2025, New Jersey since mid-2025, Oregon since January 2026. Notably it is not universal: several state privacy laws, including Virginia, Utah and Rhode Island, contain no such requirement at all. If someone tells you every new privacy law mandates this, they're overselling it.

How many visitors actually send it

Fewer than the alarm suggests, and this is worth being straight about. GPC is sent by default only by Brave and the DuckDuckGo browser. Firefox supports it but the user has to switch it on. Chrome, Safari and Edge have no native support and need an extension. So today this is a minority of traffic.

That changes. California's Opt Me Out Act, signed in October 2025 and effective January 2027, requires browser developers to offer the setting. Note the limit — it requires browsers to offer it, and does not settle whether it must be on by default. But the direction is one way.

The related failure on the same report

Alongside the signal, we check whether a visitor has any working route to make a data-rights request at all — to ask what you hold, or to have it deleted. That check fails on every single site we have ever scanned. A privacy policy that names a right without providing a way to exercise it is the paperwork equivalent of a locked door with a sign describing the room behind it.

The fix is unglamorous: listen for the signal server-side, treat it as an opt-out for that browser without asking for anything further, don't make the visitor click through a banner to be heard, and give people a real address or form that a human answers. None of that is expensive. All of it is what the fines were actually about.

Educational information, not legal advice. Whether these obligations apply to you depends on your revenue, your data volumes and the states your visitors are in.

Sources

Questions? Contact us