Does My Website Have to Honor Global Privacy Control? 

There is a setting some of my users have switched on in their browser telling every website they visit not to sell or share their data.

They never clicked anything on my site. They may never see my cookie banner. I do not actually know whether I am required to honor a signal my own interface never asked for.

What Is an Opt-Out Preference Signal?

An Opt-Out Preference Signal is a machine-readable message sent automatically by a browser or extension communicating that a consumer is exercising a privacy right. Global Privacy Control (GPC) is the most widely deployed implementation.

GPC is a technical specification, not a law. What gives it force is that Civil Code Section 1798.135 contemplates a signal sent with the consumer’s consent by a platform, technology, or mechanism, based on technical specifications set in regulations, indicating the consumer’s intent to opt out of the sale or sharing of their personal information or to limit use of sensitive personal information.

Why Is a Cookie Banner Not Enough?

Most privacy compliance assumes the user acts on your property: they see a banner, click a button, and you record the choice. A preference signal inverts that. The user decides once, in their browser, and the decision arrives with every request. There is no interaction with your interface at all.

A consent management platform that renders a banner is not by itself a mechanism for detecting and acting on these signals. Detection is an engineering task: read the signal on the incoming request, treat it as an opt-out, and make sure the downstream systems respect it. Most platforms support this as a configuration you must enable, not a default you inherit.

What About the Link, and What If They Also Click Accept?

Section 1798.135 also addresses the “Do Not Sell or Share My Personal Information” link. And it contemplates that a business honoring preference signals may offer a page letting a consumer consent to that business ignoring the signal.

Whatever approach you take, define the precedence rule between a signal and an on-site choice. Getting that hierarchy wrong in either direction creates a mismatch between what your systems do and what your disclosures say.

Common Mistakes Founders Make

• Assuming the banner covers it. A banner handles users who interact with it. A preference signal arrives from users who never will.
• Enabling detection without checking downstream. Recognising the signal accomplishes nothing if your tag manager and pixels still fire. The test is whether the data flow stops, not whether the signal is detected.
• Letting integrations accumulate outside the consent system. Every tag added directly to the page is one your privacy controls cannot govern. Growth teams add these routinely and in good faith.

A Quick Founder Check

• Does our site detect an opt-out preference signal on incoming requests?
• If it does, what specifically changes, and has anyone verified it in a browser with the signal on?
• Are all tracking tags managed through one consent platform, or do some sit directly in the page?
• What is our rule when a user has the signal enabled and also clicks accept?
• Does our Privacy Policy describe how we treat these signals, and is that accurate today?
• Have we loaded our own site with GPC enabled and watched the network requests?

The Bottom Line

This one is unusually testable. Turn the signal on in a browser, open developer tools, load your own site, and watch what fires. You will know inside five minutes whether you have a problem, which is rare in privacy work.

Download the Data Mapping Worksheet to inventory every tag and integration running today, which is the prerequisite to controlling any of them: https://primumlaw.com/primumlawgroup/data-mapping-worksheet/