Opt-out signals and tracking tags: what a website has to honor

Most US state privacy laws work on an opt-out basis for ordinary personal data. A site may load advertising and analytics tags by default, and a visitor has the right to tell it to stop selling their data or using it for targeted advertising. The usual way to do that is a link in the footer or a choice in a banner.

Global Privacy Control moves that choice into the browser. When it is switched on, the browser sends a signal with each request, so the visitor does not have to find the link on every site. Laws and regulators refer to this kind of signal as an opt-out preference signal or a universal opt-out mechanism.

The legal effect is the same either way. If the law requires the site to honor the signal, then a visit with GPC switched on has to be treated as an opt-out, and the tags covered by that opt-out have to stop.

CookieScript, a consent vendor, lists 12 states where honoring GPC is legally required in 2026: California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon and Texas. The research notes that vendor lists conflict with each other and that this one was not checked against the statutes, so confirm the position for each state where you have customers.

Regulators have been clear that they are checking. Goodwin reported that on 9 September 2025 the California Attorney General, the California Privacy Protection Agency and the Attorneys General of Colorado and Connecticut announced a joint sweep of businesses that do not honor GPC.

Honoring the signal means more than hiding a banner. The opt-out has to change what the site sends. In the Disney settlement described below, the California Attorney General's complaint was that GPC opt-outs were limited to a single device even for people who were logged in. The expectation that follows is that an opt-out attaches to the person where the business can identify them. How far that reaches for your business is a question for counsel.

The cases share a pattern. Each company had a privacy page, a banner or an opt-out form. In each, the control did less than it claimed. The amounts and descriptions in the table come from law-firm and vendor summaries of the actions, apart from the Disney settlement, where the source is the Attorney General's own press release.

These actions are few, and they have involved well-known brands. They still show what a regulator looks at: whether the opt-out a visitor makes is carried out by the site's tags.

The California Invasion of Privacy Act (CIPA) was written for telephones. From 2022 plaintiffs applied two parts of it to websites. Section 631 covers interception of the contents of a communication, which plaintiffs argued includes chat, search and session-replay tools. Section 638.51 covers pen registers and trap and trace devices, which plaintiffs argued includes any tag that receives a visitor's IP address.

The pen-register theory was the easier one to bring, because it needed no claim that the content of a message was captured. Statutory damages are $5,000 per violation, or three times actual damages if greater, according to Goodwin. Goodwin also reports that the California legislature was told of 4,000 CIPA lawsuits in the state as of July 2026. There is no official count, and trackers kept by law firms and vendors disagree widely.

Many businesses never saw a lawsuit. They received a demand letter asking for a payment to settle. No reliable count of those letters exists.

Governor Newsom signed SB 690 on 30 September 2026. WilmerHale reports that it removes the private right of action for violations of section 638.51 arising from conduct on websites, online applications or mobile apps, so that only the Attorney General may enforce that section there. The firm notes the law does not make the underlying use of pen registers legal. The research confirmed the signing from law-firm reports and could not open the legislature's own bill page.

The law is operative on 1 January 2027 and applies retroactively to pending claims in actions started within two years before that date, which Privacy World reads as cases filed on or after 1 January 2025. The same report says plaintiffs are expected to challenge the retroactive part, and that an appeal in a closely watched pen-register case, Rose v. Variety Media, was still undecided in November 2026.

The change is narrow. Goodwin points out that sections 631 and 632 are intact and that the bill creates no safe harbor. The firm's forecast is that the wave of website tracking suits will shrink and shift. Tools that capture what a visitor types or says, such as chat widgets and session replay, stay exposed to wiretap claims. Regulator enforcement of opt-outs is unaffected.

The figure comes from InfoTrust, a consultancy that sells consent and analytics services, in its State of Consent Compliance 2025 report. The report does not publish its method, so read the numbers as a vendor's findings. It found that the typical site fired 25 tracking tags before any consent interaction. The Meta Pixel was present on 62% of sites and kept firing after opt-out on 30%.

Results varied by sector in the same audit. The share of sites failing the opt-out test was 74% in finance, 71% in media, 57% in e-commerce and consumer goods, and 21% in healthcare.

The likely causes are ordinary. A banner is installed but never connected to the tag manager. A pixel is pasted straight into the page template, so the consent tool cannot hold it back. A new marketing tool is added months later and nobody updates the consent settings. None of this is visible by looking at the page, which is why testing matters.

The test needs a browser and its developer tools. Run it on the home page, a product or article page, the checkout or lead form, and any page that handles sensitive topics. Repeat it after every change to tags, banners or the tag manager.

Consentra's Signal Check runs this kind of check on a schedule and keeps the results. The steps below can also be done by hand.

• Open a private window with no extensions and load the page. Record every third-party request made before you touch the banner.
• Reject or opt out using the banner, reload, and record which advertising and analytics requests still go out.
• Clear the session, use the footer opt-out link instead of the banner, and repeat.
• Clear the session, switch on Global Privacy Control in the browser, load the page without touching the banner, and repeat.
• Log in to an account, opt out, then log in on a second device or browser and check whether the opt-out carried over.
• Look in the page source for pixels pasted directly into templates, which a tag manager setting will not control.
• List each tag that still fired, who owns it inside the business, and the date it was fixed.

A record matters because the regulator cases were about periods of time. Todd Snyder's opt-outs failed for 40 days. A business that can show when a fault appeared, when it was found and when it was fixed is in a better position than one that can only say the banner is working today.

Save the raw evidence along with a summary. Export the network log, take screenshots of the banner and the browser settings used, and note the version of the consent tool and tag manager container. Store these somewhere they cannot be edited later, with the name of the person who ran the test.

Keep the visitor side too. Where your systems log an opt-out against an account or a device, retain that log with its timestamp, so that a later question about one person can be answered from the record.