{"id":14770,"date":"2025-09-11T01:51:13","date_gmt":"2025-09-11T01:51:13","guid":{"rendered":"https:\/\/newestek.com\/?p=14770"},"modified":"2025-09-11T01:51:13","modified_gmt":"2025-09-11T01:51:13","slug":"california-two-other-states-to-come-down-hard-on-gpc-violators","status":"publish","type":"post","link":"https:\/\/newestek.com\/?p=14770","title":{"rendered":"California, two other states to come down hard on GPC violators"},"content":{"rendered":"
\n
\n
\n
\n
\n
\n
<\/div>\n<\/section>\n

US organizations are being advised to make sure they have systems in place to detect and honor Global Privacy Control (GPC) signals, as a result of the launch this week of a multi-state privacy enforcement sweep to target those who do not.<\/p>\n

The California Privacy Protection Agency (CPPA), as well as the attorneys general of California, Colorado, and Connecticut, announced plans on Tuesday to contact what they called \u201cbusinesses that may not be processing consumer requests to opt out of the sale of their personal information submitted via the GPC as required by law\u201d to request that those businesses comply.<\/p>\n

According to a release<\/a> from the CPPA, the sweep \u201creinforces the three states\u2019 2025 Data Privacy Day educational efforts on the GPC,\u201d which took place at the end of January. In California, for example, it states that the California Consumer Privacy Act<\/a> vests consumers with control over the personal information that businesses collect about them, and includes their right to request that businesses stop selling or sharing their personal information.<\/p>\n

An advisory<\/a> released on Wednesday by the law firm of Clark Hill stated, \u201cthe GPC enforcement sweep does not arise in isolation. It is one of the first major initiatives to emerge from a newly formed multi-state alliance known as the Consortium of Privacy Regulators<\/a>, announced via a memorandum of understanding (MOU) in April 2025. The Consortium includes privacy regulators and attorneys general from California, Connecticut, Colorado, Delaware, Indiana, New Jersey, and Oregon.\u201d<\/p>\n

Time to take \u2018immediate action\u2019<\/h2>\n

In the advisory, lawyers Myria V. Jaworski<\/a>, Chirag H. Patel<\/a> and Ali Bloom<\/a> wrote that while each state\u2019s privacy law may differ, the MOU emphasizes that there are fundamental similarities, such as data access, data deletion, and opt-out, that should be upheld across jurisdictions.<\/p>\n

Defining a GPC as an opt-out preference signal (OOPS) that is built into certain browsers and extensions to allow users to automatically express their opt-out preferences, they said, \u201cthe GPC enforcement means businesses should take immediate action to evaluate whether they have systems in place to detect and honor GPCs or OOPs.\u201d<\/p>\n

Businesses, the advisory said, should consider several key technical and operational measures to comply that include the following steps:<\/p>\n