GPC vs Do Not Track: One Signal Died, the Other Cost Disney $2.75 Million
Do Not Track was a polite request with nobody on the other end. Browsers sent it for years, sites ignored it for years, and nothing happened because no law said a site had to listen. Global Privacy Control looks like the same idea with a different name, and that resemblance is exactly why teams keep getting it wrong. The signal changed. The law behind it changed more.
California's first GPC enforcement landed in 2022: a $1.2 million settlement with Sephora, and the attorney general's complaint named the failure to honor GPC opt-outs. In February 2026 the Disney settlement raised the stakes to $2.75 million, and the details were worse than the number. For consumers who opted out through GPC, Disney limited the request to a single device even when the consumer was logged in, and the opt-out did not reach embedded third-party ad-tech. The signal was there. The honoring stopped halfway.
Do Not Track failed because nobody had to listen
Do Not Track was a header with no statute behind it. No state law adopted it, no regulator enforced it, and the advertising industry's own working group walked away from it. A site could log the header, ignore it, and answer no questions about either step. The mechanism worked fine. The obligation never existed.
GPC inherited the same transport idea, a browser setting that tells every site the visitor does not want personal information sold or shared, and landed in a different legal world. California's regulations at 11 CCR section 7025 treat a valid opt-out preference signal as a request to opt out of sale and sharing. Colorado requires covered controllers to honor universal opt-out mechanisms for sale and targeted advertising, and its attorney general recognizes GPC as the only one so far. The header is the same shape. The sentence behind it is new.
What GPC actually sends
When a visitor turns GPC on, the browser adds a Sec-GPC: 1 header to every request and sets navigator.globalPrivacyControl to true for scripts on the page. That is the whole signal. There is no account, no email, no confirmation click. The simplicity is the point: one setting, every site, no per-site chore. It is also why the honoring has to be automatic. A signal that arrives on every request cannot wait for a banner click that never comes.
The regulations also say what counts as honoring it. The signal must be treated as an opt-out for that browser or device and for any profile linked to it, including the consumer's account when the business knows who they are. A GPC opt-out that stops at the device is the Disney mistake, written into a settlement. And since the updated regulations took effect on January 1, 2026, the business must also show on its website whether it has processed the signal, for example with an "Opt-Out Request Honored" message or a settings toggle showing the opt-out.
The regulation that gives it teeth
Section 7025 gives a business two routes. Process the signals and post the Do Not Sell or Share links, or process them in a frictionless manner and omit the links if the section 7025(g) conditions are met. What is not an option is posting the links instead of honoring the signals. The links are not a substitute for the signal. They are the fallback for visitors who never send one.
Two details in the regulation catch teams that otherwise do the work. First, when a GPC signal conflicts with an earlier banner choice, the signal wins. A visitor who accepted last month and turned GPC on yesterday has opted out. Second, once a visitor has opted out through a signal, the business should wait at least 12 months before asking them to opt back in. A re-prompt that fires on the next visit is not a second chance. It is a violation with a timestamp on it.
Colorado, and the 2027 browser rule
California is not the only state in play. Colorado has required honoring universal opt-out mechanisms since July 1, 2024, and the signal there covers sale and targeted advertising, a slightly different pair than California's sale and sharing. A site that serves both states needs one signal path and two scope checks, not two banners.
The next change is already law. California's Opt Me Out Act, AB 566, signed in October 2025, requires browsers to offer a built-in opt-out preference signal setting from January 1, 2027. GPC traffic is about to grow because the setting will sit in the browser itself instead of behind an extension install. The teams that treat GPC as a rounding error today will meet it as default traffic in a year.
The check to run this week
Turn GPC on in your own browser, load your site, and watch three things: whether the signal reaches your CMP, whether the opt-out extends to the logged-in profile, and whether the page shows the signal was processed. Then open the network tab and check whether the third-party pixels still fire with the sale and sharing flags on. If any of those four fails, the banner is not the problem. The honoring is.
Keep reading: Do Not Sell or GPC: Which One California Checks First, Cleared Cookies, Fresh Banner: Why Consent Keeps Coming Back, The Consent Record Is the Product: What a Regulator Actually Asks For cover the nearby cases in this series.
Frequently asked questions
What is the difference between GPC and Do Not Track?
Do Not Track was a header with no law behind it, so sites could ignore it. GPC is the same kind of browser signal, but California's regulations at 11 CCR section 7025 and Colorado's privacy act give it legal effect as an opt-out of sale and sharing, and regulators have fined companies for ignoring it.
Does my site have to honor GPC if we do not sell data?
The duty falls on a business that sells or shares personal information. If your site passes data to ad-tech through pixels or SDKs and those flows count as a sale or sharing, you are in scope. A business that does neither is not covered by section 7025.
What did Disney get wrong in the $2.75 million settlement?
According to the attorney general's announcement, Disney limited GPC opt-outs to a single device even when the consumer was logged in, and the opt-out tools did not reach embedded third-party ad-tech. The settlement shows regulators test whether the opt-out follows the profile and reaches the pixels, not just whether the banner mentions it.
How do I test whether my site honors GPC?
Turn GPC on in your browser and load your site. Check that the CMP records the opt-out, that it extends to the logged-in account, and that the page shows the signal was processed. Then check the network tab to confirm third-party pixels stop sending sale and sharing data.