Universal Opt Out

Universal Opt-Out Mechanism Implementation

Overview

A universal opt-out mechanism is a browser or device-level signal that communicates a consumer's privacy preferences to websites and online services. The Global Privacy Control (GPC) is the leading universal opt-out mechanism, supported by major browsers (Firefox, Brave, DuckDuckGo) and browser extensions (Privacy Badger, Disconnect). Multiple US state privacy laws now require businesses to recognize and honor these signals.

GPC is defined in the Global Privacy Control specification (published by the GPC project), transmitted via the Sec-GPC: 1 HTTP header and the navigator.globalPrivacyControl JavaScript API.

State-by-State Requirements

GPC Technical Specification

HTTP Header

Sec-GPC: 1

The Sec-GPC header is a structured header with a bare item value of 1 (true) or absent (no preference expressed). The Sec- prefix indicates it is a fetch metadata header set by the browser, not by JavaScript.

JavaScript API

navigator.globalPrivacyControl  // boolean: true or undefined

The navigator.globalPrivacyControl property returns true if the user has enabled GPC in their browser or extension, or undefined if GPC is not active.

Detection Code

function detectGPC() {
    // Check JavaScript API
    const jsGPC = navigator.globalPrivacyControl === true;

    // The HTTP header is checked server-side
    // This function covers client-side detection only

    return {
        gpcEnabled: jsGPC,
        timestamp: new Date().toISOString(),
        userAgent: navigator.userAgent,
    };
}

Server-Side Detection (Node.js/Express example)

function checkGPCHeader(req) {
    const gpcHeader = req.headers['sec-gpc'];
    return gpcHeader === '1';
}

app.use((req, res, next) => {
    if (checkGPCHeader(req)) {
        req.gpcOptOut = true;
        // Apply opt-out before rendering page
        res.locals.suppressThirdPartyTags = true;
        res.locals.suppressCrossSiteBehavioralAds = true;
    }
    next();
});

Implementation Architecture

Layer 1: Signal Detection

HTTP Request Arrives
  │
  ├─► Server-Side Check
  │     └─ Parse Sec-GPC header from request
  │
  ├─► Client-Side Check (for SPAs)
  │     └─ Read navigator.globalPrivacyControl
  │
  └─► Combined Result
        ├─ GPC detected = true → Apply opt-out
        └─ GPC not detected → Normal processing

Layer 2: Scope Determination

Layer 3: Consumer Identity Resolution

Authenticated Consumer (logged in):

• Associate GPC opt-out with consumer account
• Set persistent flag: sale_opt_out = true, targeted_ads_opt_out = true
• Override any prior opt-in (most recent preference per CO Rule 5.13)
• Persist across sessions and devices (account-level)

Unauthenticated Consumer (not logged in):

• Apply opt-out to current browsing session
• Set first-party session cookie to maintain state during session
• Apply on each new session when GPC signal is present
• Do not require identity verification

Layer 4: Enforcement

Upon detecting GPC signal, the system must:

1. Suppress third-party advertising tags before page render:

   • AdReach Network pixel — BLOCKED
   • Cross-context behavioral advertising tags — BLOCKED
   • Retargeting/remarketing pixels — BLOCKED
   • Social media tracking widgets — BLOCKED

2. Allow first-party processing:

   • First-party analytics (where data stays with controller or service provider under contract)
   • Essential functionality cookies (session, cart, security)
   • Contextual advertising (based on current page content, not behavioral profile)

3. Update server-side systems:

   • Data sharing pipeline: suppress outbound feeds to third-party ad partners
   • CMP state: update consent management platform to reflect opt-out
   • Consumer profile: flag account (if authenticated) for persistent opt-out

Compliance Rules by State

California (CPPA Regulations §7025)

• §7025(a): Must process opt-out preference signals as valid opt-out requests
• §7025(b): Two-step opt-out process prohibited
• §7025(c): Must not require consumer to verify identity
• §7025(d): Must not display pop-up or notification questioning the signal
• §7025(e): If consumer not identifiable, apply to browser/device
• §7025(f): If authenticated user has different prior setting, GPC takes precedence as most recent expression
• Scope: Sale AND sharing (cross-context behavioral advertising)