Universal Opt-Out Mechanism
Definition
A browser- or device-level signal that communicates a consumer's preference to opt out of the sale or sharing of their personal data. Instead of opting out on each website individually, consumers can set their preference once, and websites must honor it. Global Privacy Control (GPC) is the most common implementation.
Legal Definition
Under the CPRA (Cal. Civ. Code 1798.135(b)): businesses must allow consumers to opt out via "an opt-out preference signal sent with the consumer's consent by a platform, technology, or mechanism." Colorado's CPA (C.R.S. 6-1-1306) also mandates recognition of universal opt-out mechanisms as specified by the AG.
State Laws Using This Term
Practical Example
A consumer installs the Global Privacy Control browser extension. When they visit a website, the browser sends a GPC signal. The website detects this signal and automatically opts the consumer out of the sale or sharing of their personal data.
Related Terms
Frequently Asked Questions
Which states require businesses to honor universal opt-out mechanisms?
California, Colorado, Connecticut, Montana, Texas, Delaware, Minnesota, Maryland, Nebraska, and New Jersey either require or will require businesses to honor universal opt-out mechanisms. The specific timelines and requirements vary by state.