- Global Privacy Control (GPC) is a browser-level signal that, under the CCPA and similar state laws, is a legally binding “do not sell or share” request. If you receive it, you must stop selling or sharing that person’s data.
- This is not theoretical. Twelve states require businesses to honor universal opt-out signals like GPC as of January 1, 2026, and regulators are fining companies that ignore them, from Sephora’s $1.2M in 2022 to Healthline’s $1.55M in 2025.
- For anyone who buys, sells, or shares leads, GPC can take a lead off the table as resale inventory. A California visitor with GPC on is telling you not to sell or share their information, before they ever fill out your form.
- Most lead operations have no process to detect GPC at capture or pass the opt-out downstream. That is the gap that turns into an enforcement headline.
- From 2027, California will require browsers to ship GPC built-in, so the share of traffic sending the signal is about to climb. Build the workflow now, while it is a process decision and not a penalty.
Quick answers:
- Do I legally have to honor Global Privacy Control?
- Does Global Privacy Control stop me from selling a lead?
- How do I detect the GPC signal on my lead form?
- Is GPC the same as TCPA consent?
- What happens if I ignore Global Privacy Control?
The Opt-Out You Cannot See Is Now Legally Binding
Most lead-gen operators watch the form. They are not watching the signal the browser sends before the form ever loads. That signal is Global Privacy Control, and in a growing list of states it now carries the force of law.
GPC is a setting a person turns on in their browser once. After that, every site they visit receives a “do not sell or share my data” instruction automatically. Per the California Attorney General, that signal “must be honored by covered businesses as a valid consumer request to stop the sale or sharing of personal information.” It is not a suggestion.
For a business that buys, sells, or shares leads, that changes which leads you can legally resell. Below: what GPC is, where it is binding, how it is being enforced, and the workflow to honor it at the lead form without guessing. This is operator guidance, not legal advice; talk to privacy counsel before you finalize a policy.
What GPC Is, and Why It Matters Now
Global Privacy Control is a privacy preference signal built into browsers and extensions. Per the GPC specification, it lets a user “notify businesses of their privacy preferences, such as whether or not they want their personal information to be sold or shared.” The site is blunt about its legal weight: the CCPA “requires businesses to treat a user-enabled global privacy control as a legally valid consumer request to opt out of the sale of their data.”
What changed is reach. GPC used to require a privacy-focused browser or an extension, so adoption was thin.
That is ending. Starting in 2027, California will require browsers to include built-in GPC functionality. A far larger share of your traffic will then arrive already opted out.
GPC is not a cookie banner, and it is not a phone-consent checkbox. It is a standing, automatic opt-out of the sale and sharing of personal data, sent by the browser. The person does not click anything on your site. The signal arrives on its own, and the law treats it as their decision.
The Legal Reality: A Binding Do-Not-Sell-or-Share Opt-Out
Honoring GPC is now mandatory in a dozen states, not just California. Twelve states require businesses to honor universal opt-out mechanisms like GPC as of January 1, 2026: California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, and Texas.
The practical rule across these laws is consistent. When a covered business gets the signal from a consumer in a covered state, it must stop selling or sharing that consumer’s personal information for the covered purposes. You do not get to make them re-confirm. The signal is the request.
The common mistake is assuming this is a California-only problem you can geofence around. With a dozen states live and more drafting similar laws, a national lead operation cannot treat GPC as an edge case. If your traffic is national, your obligation is effectively national.
It Is Already Being Enforced
Regulators have moved from warning to fining, and the amounts are not rounding errors.
| Action | Year | Amount | Issue |
|---|---|---|---|
| Sephora (California) | 2022 | $1.2M | Failed to honor opt-out signals, including GPC |
| Healthline Media | 2025 | $1.55M | Opt-out and data-sharing failures |
| Tractor Supply | 2025 | $1.35M | Opt-out preference signal failures |
| Honda | 2025 | $632,500 | Opt-out process failures |
| Sling TV | 2025 | $530,000 | Opt-out signal failures |
The Healthline action should get every lead operator’s attention. Healthline is a content and lead business in a sensitive vertical, and the penalty landed on how it handled opt-outs and data sharing. That is the same surface a lead-gen site lives on.
What GPC Means If You Buy, Sell, or Share Leads
This is the part generic privacy articles skip, because they are not written for lead operators. A lead is personal information. Selling it, or sharing it with a partner for their own use, is exactly the activity GPC opts a consumer out of.
If you sell or distribute leads, a GPC signal at capture is a no-sale flag on that record. You may still be able to use the lead to provide the service the person asked for. You generally cannot sell or share it for someone else’s marketing. So the lead has value to you, but not as inventory you resell.
If you buy leads, the risk moves upstream to you. A lead collected from a GPC-on consumer and then sold to you may already be out of compliance. You can inherit that exposure.
The fix is provenance. Require your sources to capture and pass the opt-out status. And treat a vendor who cannot tell you whether a lead carried a GPC signal as a vendor handing you risk. Our guide to choosing lead distribution software when you buy and sell leads covers the consent and reconciliation fields that matter here.
How to Detect and Honor It at the Lead Form
You cannot honor a signal you do not read. Detection is a small engineering task, and it is the foundation of the whole workflow.
There are two ways the signal arrives. In the browser, scripts can read the property navigator.globalPrivacyControl, which is true when the user has GPC on. On the server, the request carries a Sec-GPC: 1 header. Your tag manager or form handler should check for both before any sale or sharing logic runs.
Once you detect it, the workflow is short:
- Read the signal on page load, before any ad tags, pixels, or lead-sharing scripts fire.
- Flag the lead as sale-opted-out in your CRM at the moment of capture, tied to that record.
- Suppress the sale and sharing paths. Keep the lead for the service the person requested, but pull it out of any resale, list-share, or cross-context advertising flow.
- Pass the flag downstream to every platform and buyer that touches the lead.
- Log it. Store that the signal was received and what you did, so you can show a regulator a process, not a promise.
GPC Is Not TCPA, and It Is Not Your Cookie Banner
Operators conflate three different obligations because they all involve consent. They are separate regimes, and honoring one does not cover the others.
| Signal | What it governs | What you must do |
|---|---|---|
| Global Privacy Control | Sale and sharing of personal data (state privacy laws) | Stop selling or sharing that person’s data |
| TCPA consent | Calling and texting a consumer | Get prior express written consent before you dial or text |
| Cookie or consent banner | Ad and analytics cookies in the browser | Honor the person’s cookie choices for tracking |
A lead can be fully TCPA-consented to call and still carry a GPC signal that bars you from selling it. The phone-consent checkbox does not override the browser opt-out. You need a clean answer on all three, because each has its own enforcement path. For the cookie and tag layer, our Google Consent Mode setup guide and our server-side tracking guide for lead buyers cover the mechanics.
Who Needs to Act Now, and Who Can Wait
Match the urgency to your exposure.
Act now if you sell, share, or buy leads and your traffic includes consumers in any of the twelve states. That is most national lead operations. Three forces stack up: a binding signal, active enforcement, and rising browser adoption. The cost of waiting is going up, not down.
You have a little more room if you are a single-location service business. If you collect leads only to serve your own customers and never sell or share the data, the sale-and-share opt-out has less surface area for you. Even then, GPC still touches your ad and analytics tags, so it is worth confirming your setup honors it.
Wherever you land, the move is the same: read the signal, honor it at the data layer, and document what you did. The businesses that get fined are not the ones with an imperfect policy. They are the ones with no process at all.
Frequently Asked Questions
Do I legally have to honor Global Privacy Control?
If you are a covered business under the CCPA or one of the other state privacy laws that mandate universal opt-out mechanisms, yes. Twelve states require honoring signals like GPC as of January 1, 2026, and the California Attorney General states that GPC must be treated as a valid request to stop the sale or sharing of personal information. Whether you are a covered business depends on your revenue and data volume, so confirm your status with counsel. If you are covered and your traffic includes those states, honoring GPC is mandatory, not optional.
Does Global Privacy Control stop me from selling a lead?
For a consumer in a covered state who has GPC on, yes. The signal is a do-not-sell-or-share request, so you cannot sell that lead or share it with a partner for their own marketing. You can usually still use the lead to deliver the specific service the person asked you for. The practical effect is that the record has value to your own business but is not inventory you can resell. Treat a GPC-on lead as sale-opted-out from the moment of capture.
How do I detect the GPC signal on my lead form?
Two ways. In the browser, your scripts can read the navigator.globalPrivacyControl property, which is true when the user has GPC enabled. On the server, the incoming request includes a Sec-GPC: 1 header. Check for the signal on page load, before any ad pixels or lead-sharing scripts run, then flag the record and suppress the sale and sharing paths. The fastest way to find a gap is to load your form in a GPC-enabled browser and watch whether your pixels and lead-share calls still fire.
Is GPC the same as TCPA consent?
No. They govern different things. TCPA consent is about whether you can call or text a person, and it requires prior express written consent before you dial. GPC is about whether you can sell or share a person’s data under state privacy law. A lead can be fully consented to call and still carry a GPC signal that bars you from selling it. You need to satisfy both, plus your cookie and consent-banner obligations, because each has its own rules and its own enforcement.
What happens if I ignore Global Privacy Control?
You take on enforcement risk under state privacy law. Regulators have issued real penalties for failing to honor opt-out signals, including Sephora’s $1.2M California settlement in 2022 and a $1.55M action against Healthline Media in 2025, among others. Beyond the fines, ignoring GPC means you may be selling or sharing data you no longer have the right to monetize. That can also expose your buyers downstream. The defensible position is a documented process that detects the signal and honors it at the data layer.
Get Your Lead Compliance Reviewed Before a Regulator Does
Honoring Global Privacy Control is part of a larger question: does your lead data carry the consent and opt-out status it needs at every hop, from capture to sale to dial? If you want a second set of eyes on your capture, distribution, and buyer workflow before an enforcement letter arrives, book a free consultation with Elevarus. Bring your lead-flow diagram and your current consent and opt-out handling, and we will map where the gaps are. This is operator guidance, not legal advice, so pair it with your own privacy counsel.
