Your website might be breaking privacy law right now, and it has nothing to do with your cookie banner | Interests
Publish Date: 2026-06-15 14:17:00
Source Domain: www.kpvi.com
Your website might be breaking privacy law right now, and it has nothing to do with your cookie banner
If your business runs any kind of website, e-commerce, a local service, or a membership platform, there is a privacy law you are most likely not complying with. It has nothing to do with your cookie banner. It is called the universal opt-out mechanism, and 12 states now legally require you to honor it. Clym discusses what businesses need to know about the universal opt-out requirement and how state regulators are already enforcing noncompliance.
What a universal opt-out signal is
When a person uses certain web browsers, they can switch on a setting that sends a quiet, automatic signal to every website they visit. That signal says: do not sell or share my personal data. It is called the Global Privacy Control, or GPC, and it is the most widely adopted version of what privacy laws refer to as a universal opt-out mechanism.
The keyword is automatic. The user does not need to find a cookie banner, click a link, or submit a form. The browser silently sends the signal on their behalf every time they load a page. Under state privacy law, that signal carries the same legal weight as if the consumer had manually clicked ‘Do Not Sell My Personal Information’ on your website.
Browsers that send GPC signals by default include Brave and DuckDuckGo’s mobile browser. Firefox and several Chrome extensions also support it. Brave alone has more than 50 million monthly active users. Estimates from 2025 put GPC signals at roughly 5% to 10% of web traffic, a share that is expected to grow as browser adoption expands.
12 states now require you to honor it
The list of states that legally require businesses to recognize and act on GPC signals has grown quickly. As of 2026, those states are California, Colorado, Connecticut, Delaware, Maryland, Minnesota,…
