Universal Opt-Out Mechanisms, State by State

California gets the attention, and California is not the only state involved. Colorado and Connecticut already require businesses to recognize a browser-level opt-out, and Texas requires it through an authorized-agent provision that comes with conditions. Vermont has the requirement written down with a future start date. Virginia, which is often listed alongside the rest, reads differently in the sections tracked here, and that difference is the most useful thing in this article.

Below is what each statute asks for, when it started asking, and what the practical scope question looks like for a site that serves visitors from more than one of these states.

What a universal opt-out mechanism is

A universal opt-out mechanism is a preference a person sets once, in their browser or on their device, that then travels with every request they make. Instead of finding and clicking a link on each site individually, the visitor configures the setting one time and every site they visit receives it. State statutes describe this in deliberately protocol-neutral language: a "universal opt-out mechanism", an "opt-out preference signal", or a technology used to designate an agent. Legislatures avoided naming a specification so that the duty would survive changes in how the signal is carried.

Global Privacy Control is the implementation with traction. It travels as a Sec-GPC: 1 request header and as a navigator.globalPrivacyControl boolean that any script on the page can read. Keeping the concept and the protocol separate is worth the effort: the statutes create a duty toward a category of signal, and GPC is the member of that category your visitors are sending today. Handling GPC correctly is how the duty gets discharged in practice, but the statutory wording is what defines the duty, and no two states word it the same way.

Those differences decide which date applies to you, which legal construct the signal fits inside, and, in one case, whether a signal-recognition duty appears in the tracked sections at all.

California: the reference implementation

The CCPA and its implementing regulations set the pattern the other states borrow from. Section 7025 requires a business to treat a qualifying opt-out preference signal as a valid request to opt out of sale and sharing for that browser or device, along with any consumer profile associated with it. The statute behind the regulation, Civil Code section 1798.135, handles the relationship between the signal and the posted opt-out links, exempting a business that lets consumers opt out through an opt-out preference signal from the two-link requirement.

California also supplies the enforcement anchor for the whole category. In August 2022 the California Attorney General announced a $1,200,000 settlement with Sephora, the state's first public CCPA settlement, which included a finding that the company did not honor Global Privacy Control opt-out signals and did not cure the violations within the thirty-day cure period then available. That case is why "we support the signal in the consent tool" and "the signal is honored on the live site" are treated as separate claims.

The California detail runs deeper than one section of this article can carry, so the rest of this piece stays on the other states.

Colorado: recognition required since July 1, 2024

The Colorado Privacy Act puts the mechanism inside the consumer rights section. Section 6-1-1306 grants consumers the rights to access, correct, delete, and port their personal data, and to opt out of targeted advertising, the sale of personal data, and profiling. The same section mandates honoring technical universal opt-out signals, GPC among them, since July 1, 2024. That date has now been live long enough that a site still ignoring the signal for Colorado traffic has been out of step for two years rather than two months.

The obligations that surround the right sit in section 6-1-1308, the controller duties: specify processing purposes, minimize collection, secure the data, and publish a transparent privacy notice. SB 25-276 amended the existing sensitive-data duty in subsection (7) rather than adding a separate one: it inserted "or sell", so the duty now reads that a controller "shall not process or sell" a consumer's sensitive data, which now includes precise geolocation, without consent. The signal work and the notice work are separate projects, and a compliance program that only does the notice half leaves the signal half undone.

Connecticut: recognition required since January 1, 2025

The Connecticut Data Privacy Act splits the work differently from Colorado: the rights sit in one section and the signal duty in another. Section 42-518 grants the rights to access, correct, delete, and obtain a portable copy of personal data, and to opt out of targeted advertising, sale, and profiling. The duty to honor a universal opt-out signal is a controller duty in section 42-520, in force since January 1, 2025. Public Act No. 25-113 renumbered it on July 1, 2026, from subsection (e)(1)(A)(ii) to (c)(1)(A)(ii).

Connecticut has kept legislating around that core. Since July 1, 2026, Public Act No. 25-113 has struck "solely" from the profiling opt-out, so it reaches any automated decision that produces a legal or similarly significant effect, and it gave consumers whose data was profiled for such a decision the rights, "if feasible", to question the result, be told the reason for it, and review the personal data used. From October 1, 2026, Public Act No. 26-64 extends the deletion right to publicly available information that has been collated into a consumer profile on a publicly accessible website or made available for sale, and to any inference generated from that information.

Section 42-520's other controller duties have moved too. Since July 1, 2026, Public Act No. 25-113 has required the privacy notice to say whether the controller collects, uses, or sells personal data to train large language models, and has barred selling sensitive data without consent. From October 1, 2026, Public Act No. 26-64 bars a controller from selling precise geolocation data, and adds a parallel ban for third parties to section 42-521. Facial recognition sits outside section 42-520: from October 1, 2026, section 45 of Public Act No. 26-100 puts the signage and policy duties for facial recognition used on a controller's premises for security, fraud prevention, and similar purposes in section 42-524(a)(2), and excuses them where the consumer consented in the course of a commercial transaction. Section 66 of the same act repealed Public Act No. 26-64's earlier version of those duties. None of that changes the signal duty, which has applied since the start of 2025.

Texas: the signal as an authorized agent

Texas is the state worth reading closely, because the Texas Data Privacy and Security Act arrives at the same outcome through a different legal construct. Instead of naming a universal opt-out mechanism directly, Texas puts it inside the authorized-agent provision of section 541.055, which governs the methods a controller must offer for submitting consumer requests. Subsection (e) lets a consumer designate an agent using a technology: a link to a website, a browser setting or extension, or a global setting on a device. GPC is that kind of technology, with a caveat in subsection (f): the technology may not use a default setting and must require the consumer's affirmative, freely given, and unambiguous choice to opt out (§ 541.055(f)(2)). A signal a browser sends by default may not qualify.

The framing has a consequence. In Texas the signal is not a special category of communication, it is an ordinary opt-out request arriving from an agent the consumer designated by technical means, which the controller must honor if it can verify, with commercially reasonable effort, the consumer's identity and the agent's authority. The rights being exercised through that agent are the targeted advertising and sale opt-outs in section 541.051, subsection (b)(5). The duty to comply applies from January 1, 2025, six months after the Act's general July 1, 2024 effective date, and it is conditional. Under § 541.055(e)(1)-(4), a controller is not required to comply if the agent does not communicate the request clearly and unambiguously, if the controller cannot verify with commercially reasonable effort that the consumer is a Texas resident, if it lacks the ability to process the request, or if it does not process similar or identical requests it receives to comply with another state's similar laws. That last condition is the one a multi-state site should read twice: a controller already processing the signal for Colorado or Connecticut cannot rely on it. Two statutes, two constructions, one behavior on the wire when the duty applies: the tracker has to stop.

Vermont: on the books, effective January 1, 2028

The Vermont Data Privacy and Online Surveillance Act belongs on this list for planning purposes and not for this quarter's remediation list. Its controller duties section, section 2415e, requires a non-default opt-out preference signal mechanism alongside data minimization, consent for sensitive-data processing and sale, and a detailed privacy notice. It also bars targeted advertising to, and sale of the personal data of, a consumer the controller "has actual knowledge, and willfully disregards," is at least 13 but younger than 18 (§ 2415e(a)(7)). A known child's data is sensitive data, so it falls under the consent rule instead. The consumer rights it pairs with are in section 2415d, which consolidates access, correction, deletion, portability, the opt-outs, and a right to obtain a list of the third parties to which the controller has sold the consumer's personal data.

The effective date is January 1, 2028. Say that out loud before putting Vermont in a status report, because a control that is not yet a live obligation should not be tracked as an open finding. The useful planning point is that Vermont asks for the same machinery Colorado, Connecticut, and Texas already ask for, so a site that honors the signal today has already built most of what 2028 will want.

Virginia: an opt-out right without a signal mandate in the sections we track

Virginia is on nearly every list of state privacy laws, which is why it is worth being precise about what the Virginia Consumer Data Protection Act actually says here. Section 59.1-577 grants Virginia consumers the rights to confirm processing and access their data, correct inaccuracies, delete personal data, obtain a portable copy, and opt out of targeted advertising, the sale of personal data, and profiling. The section describes those rights as invoked by submitting a request to a controller.

The Virginia sections tracked here grant an opt-out right exercised by request and do not impose a duty to recognize a universal opt-out signal. Controller duties in section 59.1-578 cover data minimization, reasonable security, opt-in consent for sensitive data, and a clear privacy notice that explains how to exercise those rights. Since July 1, 2026, SB 338 has added one flat prohibition to that list: a controller may not sell or offer for sale a consumer's precise geolocation data (§ 59.1-578(A)(6)), and unlike the sensitive-data rule, consent does not lift the ban. It is a ban on the sale itself, not an opt-out, so it leaves the signal question where it was. That makes Virginia the instructive contrast in this set: an opt-out regime built entirely around the request path, where the posted mechanism carries the whole burden.

The practical reading is narrow. It means a request-handling process has to exist and work in Virginia, and it does not mean a site operating nationally can skip signal handling, because Colorado, Connecticut, and Texas visitors are hitting the same pages.

Others

Other states, including Oregon, have their own universal opt-out requirements that this regulation library does not yet track section by section.

What this means if you operate in more than one state

The technical failure mode is identical in every one of these states: a tracker that keeps firing after the signal arrives. A free GPC check answers that question once for all of them. The legal wrapper varies, the dates vary, the vocabulary varies, and the network trace looks the same in each case: a request to an advertising or social endpoint that left the page after the browser said not to.

A multi-state program usually resolves this in one of two ways. The first is geographic gating: detect the visitor's state and apply the matching rule set. That approach inherits every weakness of IP-based geolocation, and it multiplies the number of code paths that need testing, since each state's variant is a configuration that can drift on its own schedule. The second is a single national posture: honor the signal for every visitor, everywhere, and keep the request-path mechanisms working alongside it. The second is fewer moving parts, and fewer moving parts is the whole game in a control that has to keep working through theme changes and tag additions.

One implementation, several statutes

Read together, the tracked statutes ask a site to do one thing on the wire: notice the signal and stop the sale and sharing that follows. That is why one correct implementation satisfies all of them. Read the signal on both the header path and the JavaScript path, map your tag categories to what counts as sale or sharing, and enforce that mapping at a point every tag routes through. The Colorado date, the Connecticut date, and the Texas authorized-agent construction change what you would tell a regulator about why you did it. They do not change the code.

The obligations that do not collapse into the signal are the posted mechanisms. Virginia's request path has to work on its own, and California layers California's separate posted-link duties on top of the signal duty, with a frictionless-processing path that changes what has to be posted without changing the duty to honor the signal. Treat those as a second workstream rather than a substitute for the first.

One last thing about all six jurisdictions at once: signal handling is a control that decays. A configuration that passed in Colorado in 2024 and in Connecticut in 2025 can stop passing after a template change, a newly hardcoded pixel, or a vendor swap, and nothing in the deploy pipeline announces it. The date a state's requirement started is a fact about the calendar. Whether the tracker stopped firing this week is a fact about your site, and it is worth checking on a schedule rather than at a launch.