GPC Best Practices Guide

(Quick Reference Guide — Informational Only, Not Legal Advice)

What You Need to Know

• Global Privacy Control (GPC) is a type of Universal Opt-Out Mechanism (UOOM) approved in California, Colorado, Connecticut, and other states.

• When enabled in a browser, GPC communicates a legally binding opt-out of selling, sharing, and targeted advertising.

• Regulators are actively conducting enforcement sweeps to confirm businesses are honoring GPC.

Learn more about enforcement activity »

What’s Changing in 2026

Beginning January 1, 2026, proposed CCPA regulations will require explicit, user-facing confirmation when a UOOM signal is honored.

Examples of acceptable confirmation methods include:

• Displaying a message such as: “Opt-Out Preference Signal Honored”

• Showing a pre-selected toggle or radio button in a privacy menu

Best Practices Checklist

• Enable GPC in Your CMP

  • Confirm GPC detection and processing are configured See [GPC for more details.]

• Review & Align Classifications

  • Validate that cookies are categorized correctly ☐ Avoid misclassifications (e.g., marketing cookies labeled as analytics)

• Test & Retest Regularly

  • Audit all opt-out mechanisms: GPC, UOOM, cookie banners, “Do Not Sell/Share” links ☐ Perform functional tests to ensure signals work as intended

• Tell Consumers When Honoring Signals

  • Prepare to display confirmation messaging by 2026 ☐ Evaluate UI options (for example, an on-page banner or a toggle in the privacy menu)

Disclaimer: This checklist is provided for informational purposes only and does not constitute legal advice. Organizations should consult with their legal counsel for guidance tailored to their specific circumstances.

How GPC Works in Osano

When GPC is enabled in your Osano Cookie Consent configuration:

• If a visitor’s browser or extension sends a GPC signal, Osano automatically:

  • Enables “Do Not Sell” in your consent manager

  • Disables and locks the Targeted Advertising switch

  • This behavior applies regardless of jurisdiction.

How to Test GPC in Osano:

1. Install a GPC browser extension or use Firefox in private mode.

2. Visit your site.

3. Confirm that:

• “Do Not Sell” is enabled

• The Targeted Advertising toggle is disabled and locked

Best Practices to Ensure Full Coverage

• Review Your Cookie Classifications

  • Ensure no cookies or scripts are left “Unclassified.”

  • Every cookie should be assigned to the appropriate category.

• Classify Sharing or Selling Cookies as “Targeted Advertising”

  • Any technology that may involve sharing or selling data should be categorized under Targeted Advertising.

  • This ensures Osano enforces GPC correctly when detected.

• Review Service-Level Agreements with Vendors

  • Some systems may share or sell data indirectly.

  • Example: Google Analytics data being shared with Google Ad Manager.

  • Review your contracts and settings to confirm whether adjustments are needed on a case-by-case basis.