5 California Opt-Out Penalties in 2026: What Honoring GPC Really Means

California spent 2026 proving that a "Do Not Sell" link is not enough. Five companies (Disney, PlayOn Sports, Ford, LocateSmarter and Lyft) were penalized a combined $6.14 million for opt-out processes that were partial, forced or full of friction. General Motors separately agreed to a record $12.75 million penalty over allegations that it sold driver data its privacy policy said it did not sell.

The thread running through the opt-out cases is Global Privacy Control (GPC), a browser setting that tells every site a visitor wants to opt out of the sale or sharing of their data. California treated it as a valid opt-out request in its first California Consumer Privacy Act (CCPA) settlement, with Sephora in 2022, and at least a dozen states now require businesses to honor signals like it, according to the California Privacy Protection Agency (CPPA).

This guide explains what honoring GPC actually requires, which states demand it, and how to test your own site in about 15 minutes.

⚠️ Important: California now requires you to show the result. Since January 1, 2026, CCPA regulation §7025(c)(6) says a business must display whether it has processed a visitor's opt-out preference signal, for example with a message such as "Opt-Out Preference Signal Honored" or a toggle showing the visitor is opted out (CPPA briefing; Nelson Mullins). Honoring the signal silently in the background does not meet the display requirement.

Five Opt-Out Penalties in 2026, and the Lesson in Each

Each case punished a different way of making opt-out harder than it should be. Here are the five, with links to the regulators' own announcements: Disney, PlayOn, Ford, LocateSmarter and Lyft.

Date (2026)	Company (regulator)	Penalty	What went wrong
Feb 11	Disney (Attorney General)	$2.75M	Opt-outs, including GPC, applied only to one device or one streaming service, even for logged-in users; many connected-TV apps had no in-app opt-out
Mar 3	PlayOn Sports (CPPA)	$1.1M	Users had to click "agree" to tracking to use tickets; opt-outs were outsourced to Network Advertising Initiative and Digital Advertising Alliance pages; opt-out signals were not recognized
Mar 5	Ford (CPPA)	$375,703	Required email verification before processing opt-outs; ordered to audit its trackers and honor GPC
Aug 11	LocateSmarter (CPPA)	$116,490	Data broker demanded the last four digits of a Social Security number to opt out; registered late
Oct 29	Lyft (Attorney General)	$1.8M	No opt-out inside the app; logged-in users had to re-enter login and personal details on a web form

The year's largest penalty was different in kind. General Motors agreed to pay $12.75 million, subject to court approval, over allegations that it sold the names, contact details, geolocation and driving data of Californians collected through OnStar to two data brokers from 2020 to 2024, while its privacy policy said it did not sell driving or location data (CalPrivacy). The lesson for small sites: your privacy policy is a factual claim, and regulators test it.

These cases built on 2025's record CPPA fine, $1.35 million against Tractor Supply, which also cited failure to honor GPC (CalPrivacy). Each of the five opt-out failures is something a tester can reproduce from outside: turning on GPC, logging in on a second device, or filling in the opt-out form.

What Honoring GPC Actually Requires in California

Under the CCPA regulations, a business must recognize an opt-out preference signal sent in a commonly used format, such as an HTTP header or a JavaScript property, that makes clear it is meant to opt the consumer out. GPC meets that standard (CPPA). Once it arrives, the rules are specific:

• Stop selling and sharing data tied to that browser or device, any pseudonymous profile linked to it, and the consumer, if known.
• Go account-wide for logged-in users. If the visitor is signed in, apply the opt-out to everything tied to the account. That was Disney's failure.
• Let the signal win conflicts. If GPC conflicts with a visitor's earlier site settings, follow GPC. You may then ask for consent to sell or share, but without dark patterns.
• Act within 15 business days at most, and forward the opt-out to any third party you sold or shared data with in the meantime.
• Display the result on your site, as §7025(c)(6) requires.
• Provide your own opt-out method. Sending visitors to industry opt-out pages instead was one of PlayOn's violations.
• Remove friction. Do not require email verification (Ford), Social Security digits (LocateSmarter) or re-entered login details (Lyft) to process an opt-out.

For most small sites, the practical meaning is simple: when GPC is on, advertising pixels and other tags that sell or share data must not fire, or must run in a mode that does not sell or share, and your banner should say the signal was honored.

Which States Require You to Honor Opt-Out Signals

California's privacy agency lists at least a dozen states that require businesses to honor opt-out preference signals or universal opt-out mechanisms such as GPC (CPPA, August 2026):

• California, Colorado, Connecticut, Delaware, Maryland, Minnesota
• Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas
• Louisiana from January 2027 and Vermont from January 2028, according to the same briefing

Two of the newest laws go the other way. Oklahoma's law (effective January 1, 2027) and Alabama's (May 1, 2027) do not require businesses to recognize opt-out preference signals (WilmerHale; Hunton). Louisiana is a borderline case: its text lets consumers opt out through an authorized agent "using a technology," such as a device setting, rather than naming universal opt-out mechanisms (FPF).

Enforcement is coordinated. In September 2025, California's privacy agency and the attorneys general of California, Colorado and Connecticut launched a joint sweep targeting businesses believed to be failing to honor GPC (CPPA). Honoring GPC for every visitor, rather than geo-targeting by state, is the simplest way to cover all of these laws at once. State details: California • Colorado • Connecticut • Texas.

See What Your Site Does With GPC

ScanComply's free privacy scan now includes an informational Global Privacy Control check. It looks for a /.well-known/gpc.json declaration and for GPC handling in your page code, alongside checks for trackers that load before consent and a "Do Not Sell or Share" link. It reports what it finds; it does not prove your site honors the signal, so pair it with the manual test below.

Run a Free Privacy Scan

How to Test Your Site's GPC Handling in 15 Minutes

You do not need special tools. Brave and DuckDuckGo send GPC by default, Firefox offers it as a setting, and extensions such as Privacy Badger and OptMeowt add it to other browsers (Global Privacy Control).

1. Turn GPC on in one of those browsers and open a private window, so old cookies and consent choices do not interfere.
2. Confirm the signal is sent. In the developer tools console, type navigator.globalPrivacyControl and check that it returns true; in the Network tab, request headers should include Sec-GPC: 1 (W3C GPC specification).
3. Load your homepage and a product or checkout page. Watch the Network tab for requests to advertising and social media domains, and note which cookies are set.
4. Repeat with GPC off. If the same ad pixels fire and the same cookies appear either way, the signal is probably being ignored.
5. Look for the on-page confirmation, such as "Opt-Out Preference Signal Honored," or a banner toggle already switched to opted out.
6. Log in to a customer account with GPC on, then check from a second device that the opt-out applied to the whole account.
7. Optionally publish /.well-known/gpc.json containing {"gpc": true, "lastUpdate": "YYYY-MM-DD"}. The specification makes this file optional, and it only states your intent; it does not show the signal is honored.

Write down what you tested, when, and what you saw. Dated evidence is what you will want if a sweep letter ever reaches your inbox.

What Changes Next: More Signals in 2027 and Sharper Rules

GPC traffic is about to grow. From January 1, 2027, California's Opt Me Out Act (AB 566) requires browsers to offer Californians a built-in way to send an opt-out preference signal (CPPA). Sites that only tested with privacy-focused browsers should expect the signal from more visitors.

The rules are also getting more specific. The CPPA board's November 5 to 6, 2026 meeting agenda included staff-recommended amendments that would (CPPA staff memo):

• name GPC as an example of an opt-out preference signal
• add examples on cookie-syncing and pseudonymous advertising profiles
• clarify that signals must be honored before cookies or other tracking technologies that sell or share data are set
• require businesses subject to metrics reporting to disclose how many opt-outs arrived through signals

Staff recommended advancing the draft to formal rulemaking with a 45-day public comment period, and the item was scheduled for discussion and possible action on November 6 (agenda). The board's decision had not been posted when this article was published, and any amendments would still have to complete the rulemaking process. For everything else that lands on New Year's Day, see 9 privacy law changes hitting websites on January 1, 2027.

California's 2026 cases turned "honor the opt-out" into a checklist: recognize GPC, apply it account-wide, show the visitor it worked, and never make people prove who they are just to say no. With at least a dozen states requiring the same thing and browsers adding the signal in 2027, GPC handling is now basic website hygiene, not an edge case.

Run a free scan, do the 15-minute browser test, and fix what fails before January 1.

This article is general information, not legal advice. Consult qualified counsel about obligations specific to your business.

Sources: CA Attorney General: Disney • CalPrivacy: PlayOn Sports • CalPrivacy: Ford • CalPrivacy: LocateSmarter • CA Attorney General: Lyft • CalPrivacy: General Motors • CPPA opt-out signal briefing, Aug 2026 • CPPA staff memo, Nov 2026 • W3C GPC specification