Do we have to honour universal opt-out signals such as Global Privacy Control?
In a growing group of states, yes. Where the statute recognises a universal opt-out mechanism, an automated browser signal is a legally binding request, not a preference you may weigh.
The answer differs between the federal level and the states, see the rows below.
The answer by level
Colorado
Colorado requires controllers to honour a universal opt-out mechanism and the Attorney General maintains a public list of recognised mechanisms.
Colo. Rev. Stat. §§ 6-1-1301 to 6-1-1313California
California treats an opt-out preference signal as a valid request to stop sale and sharing, and the signal must be honoured for the browser or device it comes from.
Cal. Civ. Code § 1798.100 et seq.Connecticut
Connecticut requires recognition of an opt-out preference signal for targeted advertising and sale of personal data.
Conn. Gen. Stat. §§ 42-515 to 42-525Texas
Texas requires controllers to allow an opt-out through a universal mechanism for targeted advertising and sale.
Tex. Bus. & Com. Code ch. 541
Source lines
- Colorado requires controllers to honour a universal opt-out mechanism and the Attorney General publishes the list of recognised mechanisms.
- California treats an opt-out preference signal as a valid request to stop the sale and sharing of personal data from that browser or device.
- Connecticut and Texas require the same recognition for targeted advertising and sale of personal data.
What it means for the company
Wire the signal into the same pipeline as a manual opt-out, because a banner that only stores a click will fail in these states.
| Level | Requirement | Source |
|---|---|---|
| Colorado | Colorado requires controllers to honour a universal opt-out mechanism and the Attorney General maintains a public list of recognised mechanisms. | Colo. Rev. Stat. §§ 6-1-1301 to 6-1-1313 |
| California | California treats an opt-out preference signal as a valid request to stop sale and sharing, and the signal must be honoured for the browser or device it comes from. | Cal. Civ. Code § 1798.100 et seq. |
| Connecticut | Connecticut requires recognition of an opt-out preference signal for targeted advertising and sale of personal data. | Conn. Gen. Stat. §§ 42-515 to 42-525 |
| Texas | Texas requires controllers to allow an opt-out through a universal mechanism for targeted advertising and sale. | Tex. Bus. & Com. Code ch. 541 |
What it means for the individual
Turning the signal on in your browser carries the request to every site you visit, without filling in a form each time.
Source lines
- Colorado consumer data privacy actColo. Rev. Stat. §§ 6-1-1301 to 6-1-1313 · read 2026-08-25 · proof 8c12544fcf34b729
- California Consumer Privacy Act, as amended by the CPRACal. Civ. Code § 1798.100 et seq. · read 2026-08-25 · proof 8c12544fcf34b729
- Connecticut consumer data privacy actConn. Gen. Stat. §§ 42-515 to 42-525 · read 2026-08-25 · proof 8c12544fcf34b729
- Texas consumer data privacy actTex. Bus. & Com. Code ch. 541 · read 2026-08-25 · proof 8c12544fcf34b729
Next step
Test one page with the signal enabled and confirm that sale and targeted advertising stop server side, not only in the banner state.
This page reports what the sources say, with the identifier and address of the publisher. It is not legal advice and does not decide an individual matter.
Next step
Three ways to put the register to work in your own practice.
Start with your task
Litigation
Find support in a judgment
Search guiding decisions, see what became final and follow changes in the law.
In-house, deals
Map the rules in a transaction
Move from theme to act and on to the article that carries the duty.
Compliance
Assess the risk in a process
Risk scoring per legal area, with the sources behind every score.