Global Privacy Control (GPC): 12 states now require you to honor it. Free self-check

Checked 20 Oct 2026 against the official sources listed below. Plain-English checklist, not legal advice.

Short answer: Global Privacy Control (GPC) is a browser signal (Sec-GPC: 1) that tells your site "do not sell or share my data". California treats it as a valid opt-out request, and as of 2026 at least a dozen states require covered businesses to honor opt-out preference signals: California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon and Texas (Texas and Nebraska with conditions). Louisiana joins in January 2027 and Vermont in January 2028, per California's privacy agency. If your ad pixels keep firing for a visitor whose browser sends GPC, that is the first thing a regulator tests.

What regulators have already fined

Business	Regulator, date	Amount	The opt-out problem
Healthline Media	California AG, 1 Jul 2025	$1.55M	Failed to let consumers opt out of targeted advertising; must make its opt-out mechanisms work correctly
Tractor Supply	CPPA, 30 Sep 2025	$1.35M	No effective way to opt out of selling/sharing, including through opt-out preference signals such as GPC; must scan its sites and keep a tracker inventory
American Honda	CPPA, 12 Mar 2025	$632,500	Excess verification to opt out, unequal privacy choices, ad-tech sharing without required contract terms
Todd Snyder	CPPA, 6 May 2025	$345,178	Opt-out portal misconfigured, so opt-out requests went unprocessed for 40 days

The CCPA allows an administrative fine of up to $2,500 per violation ($7,500 if intentional), adjusted for inflation, and the Honda order notes fines apply per violation (CPPA).

Who has to care

California's CCPA covers for-profit businesses with annual gross revenue above its threshold ($25 million, adjusted for inflation), or that buy, sell or share personal information of 100,000+ consumers or households, or earn half or more of revenue from selling or sharing it. Other states use their own thresholds (often 100,000 residents, and 35,000 in Connecticut from 1 Jul 2026). If you run Meta, TikTok, Google Ads or similar pixels on a consumer site and pass any threshold, GPC applies to you.

Checklist

Turn GPC on in a browser that supports it (Firefox, Brave, DuckDuckGo, or a GPC extension) and load your site.
Check that ad and "sharing" pixels (Meta, TikTok, Google Ads, Pinterest, Snap, The Trade Desk and others) are blocked or switched to restricted mode for that visitor.
Make sure your consent tool (OneTrust, Shopify's privacy banner, Osano etc.) is configured to read GPC, and is not only geo-targeted to one state.
Put a "Do Not Sell or Share My Personal Information" or "Your Privacy Choices" link in the footer, and make opting out as easy as opting in.
Do not ask for ID or extra details to process an opt-out (Honda, Todd Snyder).
Keep an inventory of every tracker on your site and re-scan regularly (the Tractor Supply order requires at least quarterly scans).
Have contract terms with every ad-tech vendor that receives personal data (Honda, Healthline, Tractor Supply).
Optional: publish /.well-known/gpc.json to state that you honor GPC (GPC specification).

Free 2-minute self-check

With GPC turned on, open your homepage, wait 10 seconds, open the browser console (F12, then Console), paste this and press Enter. It only reads your own page and sends nothing anywhere.

(()=>{const ad=/doubleclick|googleadservices|googlesyndication|facebook\.(net|com\/tr)|tiktok|linkedin|snapchat|sc-static|pinterest|bat\.bing|criteo|taboola|outbrain|adnxs|amazon-adsystem|adsrvr|applovin|stackadapt|reddit|ads-twitter|attn\.tv|rlcdn|liadm|tapad/i;
const hosts=[...new Set(performance.getEntriesByType('resource').map(e=>e.name).filter(u=>ad.test(u)).map(u=>new URL(u).host))];
console.log('GPC signal on in this browser:',navigator.globalPrivacyControl===true);
console.log(hosts.length?'Ad/tracking hosts loaded with GPC on: '+hosts.join(', '):'No known ad/tracking hosts loaded.');})();

A host on that list is not proof of a violation: some vendors run in a restricted, no-sale mode when GPC is on. It tells you where to look first. Automated checks are a start, not a full audit.

Get it done this week

Free: we scan your homepage twice from a US browser (GPC off, then on) and send you a dated report of which ad and tracking hosts still load, whether your opt-out link is visible and whether you publish gpc.json. Email your URL to mininglife7@gmail.com with the subject "Free GPC scan".

Paid, once the free report has proved useful: GPC Monitor re-scans monthly and keeps a dated evidence log of every tracker and how it behaves with GPC on, which is the kind of inventory regulators have ordered. Pricing is sent with your free report.

Why Unadhi exists: small teams deserve the same clear compliance checks big companies buy, at a price a growing business can pay.