← CCPA/CPRA · Opt-outs and sensitive data

Regs 7025 — Honour opt-out preference signals (Global Privacy Control)

high opt-out-of-saleconsent

Requirement

A business that sells or shares personal information treats a browser opt-out preference signal such as Global Privacy Control as a valid request to opt out of sale and sharing for that browser or device and any known consumer, and may display whether the signal was honoured.

What the engine looks for

Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.

Required element 1 — any one of

global privacy controlgpcopt-out preference signalopt-out preference signalsbrowser signalbrowser signalsdo not track

Required element 2 — any one of

honor…honour…respect…process…treat…validrecogni…opt-out

Supporting terms — specificity signals

regs 7025frictionlessdisplay

Contradiction markers

Finding any of these outranks coverage — a policy that admits the gap is worse than silence.

we ignore gpc we do not honor do not respond to

Equivalent controls elsewhere

Matched on shared topics. Satisfying this control usually moves these too.

Framework	Control	Title	Shared topics
GLBA	Reg P 1016.7-1016.10	Opt-out of sharing with nonaffiliated third parties	consent opt-out-of-sale
GDPR	Art.6	Lawful basis for processing	consent
GDPR	Art.7	Conditions for consent	consent
GDPR	Art.21	Right to object, including to direct marketing	consent
COPPA	312.5	Verifiable parental consent before collection	consent
NDPA 2023	s.25	Lawful basis for processing	consent
NDPA 2023	s.26	Conditions for valid consent	consent
GDPR	Art.8	Conditions for a child's consent to online services	consent