A visitor turns on Global Privacy Control, loads your homepage, and sees nothing. Your tags may well be quiet, but since January 1, 2026 the silence itself is a problem: California now expects the page to say so.
What changed
The CCPA regulations amendments that took effect on January 1, 2026 (Register 2025, No. 39) turned two "may" clauses into "must" clauses. Section 7025(c)(6) now requires a business to display whether it processed the visitor's opt-out preference signal as a valid request to opt out of sale and sharing. Section 7026(g) requires a means for the consumer to confirm that an opt-out request was processed. Both use the same example wording: "Opt-Out Request Honored". Before the change, the examples read "Opt-Out Preference Signal Honored" and "Consumer Opted Out of Sale/Sharing".
The regulation's example pairs that message with a toggle or radio button showing the consumer has opted out. The quoted string is an example, not a required phrase; any wording that plainly says the request was processed does the job.
What website owners must do
If your site sells or shares personal information, when a visitor arrives with GPC on, show a message in the page text saying the opt-out was processed, and leave your Do Not Sell or Share control switched to its opted-out position for that visitor. A status line that only says "GPC detected" is weaker than it looks, because a detected signal isn't a processed opt-out.
Two details trip people up. First, the duty also covers a business that lawfully sets the signal aside. If a visitor consented to sale or sharing, or declined to leave a financial incentive program, §§ 7025(c)(3) and (c)(4) let you ignore the signal, but you still owe the visitor a display of that choice. Second, don't answer the signal with a pop-up. Section 7025(f)(3) bars notifications and interstitials in frictionless processing, and it expressly allows a display of whether the visitor has opted out. A quiet line in the page or the privacy settings is fine; a modal asking them to reconsider is not.
The test takes a minute: switch GPC on in a browser, load the site without clicking anything, and look for the message or the pre-set toggle.
Where Privisy fits
A full Privisy audit includes a GPC Status Display check. It loads your page with the signal on and reads the visible text and the state of opt-out controls, then tells you whether it found a display, found only a "detected" indicator, or found none while the site was sending data to marketing domains. It sits beside the check for whether trackers actually stop, which is the half of the GPC story covered in our explainer on the Sec-GPC header.
See what your site shows a GPC visitor
Privisy audits your GPC response, including the status display, on the live site.
Get Your Audit