# Do Not Sell or GPC: Which One California Checks First

Source: https://consentvigil.com/blog/2026-11-14-do-not-sell-vs-gpc-california-checks.html

[Home](../index.md) / [Blog](index.md) / Do Not Sell or GPC: Which One California Checks First


Published 2026-11-14

California settled with Disney for $2.75 million in February 2026 over how opt-out choices were presented and carried through. Two details in that settlement matter more than the number. GPC opt-outs were limited to a single device even when the consumer was logged in, and the opt-out tools did not reach embedded third-party ad-tech. The company had a link on its site. It also had a signal problem.

Teams keep asking whether the link or the signal is the one that counts. The answer is both, in different jobs, and the link cannot cover for a signal you ignore. Under 11 CCR section 7025, a business that sells or shares personal information has to process opt-out preference signals. Posting a Do Not Sell or Share link does not replace that duty.

## The link is not a substitute for the signal

Section 7025(e) gives a business two routes, and only two. It can process signals and post the links, or it can process signals in a frictionless manner and omit the links if the conditions in section 7025(g) are met. There is no third route where the links stand in for signal processing. A site that posts a perfect link and drops GPC signals on the floor is non-compliant in the exact way the Disney case punished.

The frictionless route has teeth of its own. It means no fee, no change to the consumer experience, and no pop-up or interstitial in response to the signal. A business that also sells offline cannot use the no-link route at all under section 7025(g)(3)(A). Most sites are better off keeping the link and honoring the signal than trying to qualify for the exemption.

## What honoring a signal actually means

A valid signal has to arrive in a format commonly used and recognized by businesses, such as an HTTP header or a JavaScript object. When it does, it counts as an opt-out for that browser or device and any consumer profile associated with it, including pseudonymous profiles. If the consumer is known, the regulation's logged-in example makes it an opt-out for the consumer too, including account and offline sale or sharing. That is the part Disney got wrong: the opt-out stopped at the device.

The clock matters as well. Cookiebot's guide to the Do Not Sell link puts the processing deadline at 15 business days from receipt, as soon as feasibly possible. Fifteen days is the outside edge, not the target. And the signal has to reach the embedded third parties, not just your own tags. If your GPC handling stops at your first-party analytics while the ad-tech pixels keep firing, you have built the Disney failure with a different vendor list.

Colorado adds a second jurisdiction to the same test. The Colorado Attorney General says GPC is the only mechanism currently recognized there, and businesses inside the Colorado Privacy Act thresholds have had to honor it since July 1, 2024. One signal, two states, same expectation.

## The test to run this week

Enable GPC in a test browser and load your site. Watch the network tab, not the banner. The pixels and SDKs that constitute sale or sharing have to stop, and the opt-out has to follow a logged-in account across devices. Then check the places teams forget: the embedded video player, the chat widget, the tag manager's side-loaded tags. If any of them keep sending data after the signal, the link in your footer is doing public relations, not compliance.

Write down what the test found, including the vendors that kept firing. That note is the record a regulator asks for first, and it is also the punch list for the fix.

Keep reading: [The GPC Signal Is Not a Banner Setting. Test It Like a Request.](https://consentvigil.com/blog/2026-11-05-gpc-opt-out-signal-test.md), [The Footer Opt-Out Link Still Matters, Even With a Banner](https://consentvigil.com/blog/2026-11-08-footer-opt-out-link-do-not-sell.md), [Consent Withdrawal Has to Work Everywhere, Not Just on the Homepage](https://consentvigil.com/blog/2026-11-13-consent-withdrawal-everywhere-not-homepage.md) cover the nearby cases in this series.

## Frequently asked questions

### Does a Do Not Sell link replace honoring GPC signals?

No. Under 11 CCR section 7025, a business that sells or shares personal information must process opt-out preference signals. The choice is between processing signals and posting the links, or processing signals frictionlessly and omitting the links under strict conditions. Posting links instead of honoring signals is not an option.

### How far does a GPC opt-out reach?

It covers the browser or device that sent it and any consumer profile associated with it, including pseudonymous profiles. For a logged-in consumer, the regulation's example extends it to the consumer's account and offline sale or sharing. Limiting it to one device was one of the failures in the Disney settlement.

### How fast must we act on an opt-out?

As soon as feasibly possible and no later than 15 business days after receipt. That deadline applies to the signal and to link requests alike, and the opt-out has to reach embedded third-party ad-tech, not just your own tags.

### Does GPC matter outside California?

Yes. Colorado recognizes GPC as the only opt-out mechanism under its privacy act, and businesses in scope have had to honor it since July 1, 2024. The CPPA board also voted in August 2026 to begin rulemaking on opt-out signals, so the California rules are still moving.