GPC Signal Compliance Now Carries Real Legal Exposure for U.S. Marketers
The Development
Global Privacy Control (GPC), a browser-level signal allowing users to opt out of the sale or sharing of personal data, is now a live enforcement target for U.S. regulators. California's CPPA has issued multiple fines exceeding $1 million for companies failing to honor GPC signals, beginning with a $1.2 million settlement against Sephora in 2022. With more than 20 states now enforcing privacy laws, GPC compliance is no longer a California-only concern. The signal is detectable via JavaScript across all major browsers and can be honored either through a consent management platform (CMP) or a custom JSON-based implementation. GPC proponents report 150 million users globally, though actual traffic carrying the signal is difficult to quantify and has shown no measurable impact on data collection for companies that have implemented compliance tools.
Our Take
The asymmetry here is the story: GPC compliance carries near-zero operational cost to marketing performance today, yet non-compliance carries seven-figure legal exposure. Most marketing teams have deprioritized GPC because the data impact is invisible—and that logic is exactly what regulators are counting on. The Sephora fine wasn't a warning shot; it was the opening of an enforcement pattern. As CPPA activity intensifies and additional states adopt CCPA-aligned frameworks, GPC will function as a low-effort audit trigger for regulators looking for provable violations. The fix is straightforward—most CMP providers already support GPC signal detection natively. The real gap isn't technical; it's organizational. Legal and marketing teams aren't talking, and no one owns the compliance-to-data-collection handoff. That gap is where the fines are being issued.
The Exploit
Action Item
If your CMP provider supports GPC signal detection and it isn't yet enabled, loop in your legal team this week to activate it and document the implementation—California regulators have demonstrated they will fine on this specific failure point.