An opt-out preference signal is a setting sent automatically by a browser or extension that tells websites the user does not want their personal information sold or shared. The best-known example is Global Privacy Control (GPC).

Under California law

A business that sells or shares personal information under the CCPA must treat a qualifying opt-out preference signal as a valid request to opt out of sale and sharing. The regulations set the technical specifications a signal must meet.

From 1 January 2027, the California Opt Me Out Act (AB 566) requires browsers operating in California to offer a built-in opt-out preference signal, so more visitors will send one by default.

Several other US state privacy laws also require businesses to recognise universal opt-out mechanisms.

What honouring a signal means in practice

When a browser sends the signal, the site should treat the visitor as opted out of sale and sharing, for example by not loading advertising tags that share data with third parties, without asking the visitor to opt out again.