You've implemented Global Privacy Control. Your systems recognize browser-based opt-out signals. You've told your team the "Do Not Share" link can come off the homepage.
Not so fast.
These myths persist because regulations vary by state, each drafting its own version of opt-out signal recognition. California went first, Colorado followed with a grace period, and Connecticut set a later trigger date. Legal teams often assume "universal opt-out mechanisms" replace older link requirements. They don't, at least not automatically.
Here's what the regulations actually say.
Myth 1: If You Honor Opt-Out Signals, You Can Remove the Homepage Link
Reality: Under the CPRA, you must meet seven specific conditions before removing the homepage opt-out link, even if you process opt-out preference signals perfectly.
The California Privacy Protection Agency's regulations (CPRA Regulation § 7025(g)) require that you:
- Charge no fee for signal usage
- Make no change to the user's product or service experience
- Display no notification, pop-up, text, graphic, animation, sound, video, or interstitial in response to the signal
- Disclose the opt-out right and signal instructions in your privacy notice
- Apply the opt-out to all selling or sharing for cross-context Behavioural Advertising, online and offline
- Require no additional information from the consumer (like an email address)
- Allow the preference to work without requiring account login
Miss one criterion and the homepage link stays. If you show a confirmation banner when the signal arrives, you've triggered the interstitial prohibition. If your offline data-sharing operation isn't covered by the signal, you've failed the completeness test.
Myth 2: All State Laws Treat Opt-Out Signals the Same Way
Reality: California, Colorado, and Connecticut each conceptualize opt-out signals differently, and their homepage link requirements diverge.
California treats opt-out preference signals as a potential replacement for the homepage link, but only if you satisfy the seven-part test above.
Colorado gives you the option to honor "user-selected universal opt-out mechanisms" until July 1, 2024, when recognition becomes mandatory. The statute doesn't explicitly state whether honoring the signal eliminates other opt-out method requirements.
Connecticut won't require signal recognition until January 1, 2025. Until then, it's optional. The Connecticut Data Privacy Act references "opt-out preference signal[s]" that meet the state's formatting requirements, but the interplay with homepage links isn't spelled out with California's precision.
Your compliance posture can't assume uniformity. If you operate in all three states, you're managing three timelines and three interpretations.
Myth 3: Opt-Out Signals Are "Set It and Forget It" for Your Tech Stack
Reality: You must route the signal through every system that sells or shares data for cross-context Behavioural Advertising, including offline channels.
CPRA Regulation § 7025(g)(3) requires that the opt-out apply to all selling or sharing, whether online or offline. If your CRM feeds an offline direct-mail partner or your point-of-sale system shares transaction data with a retail media network, the browser signal must propagate to those systems.
This isn't just a front-end issue. It's an architecture problem. Your Tag Manager can suppress third-party pixels when it detects Global Privacy Control, but that won't stop your backend API from syncing hashed email identifiers to a data broker. You need signal persistence across session boundaries, device switches, and logged-out states.
The regulation also prohibits requiring login for the preference to apply to offline sharing. You need a durable, cross-channel suppression mechanism that doesn't depend on authentication.
Myth 4: A Privacy Notice Mention Satisfies the Disclosure Requirement
Reality: CPRA Regulation § 7025(g)(2) requires that you explain how consumers can implement the opt-out preference signal, not just that the right exists.
A generic statement like "You may opt out of targeted advertising" doesn't meet the standard. You must describe the signal mechanism itself. That means explaining what Global Privacy Control is, how to enable it in supported browsers, and what happens when your systems receive it.
If you support multiple signals (GPC, a browser extension, or a device-level setting), describe each one. If your implementation has limitations (for example, the signal only works for web traffic, not in-app activity), disclose them.
The disclosure isn't a courtesy. It's a precondition for removing the homepage link under California law.
Myth 5: Once You Meet the Seven Criteria, You're Done
Reality: You must continuously verify that no pop-up, notification, or experience change occurs when the signal is processed.
CPRA Regulation § 7025(g)(1) integrates by reference the prohibitions in § 7025(f)(2) and (f)(3). If your analytics dashboard shows a confirmation message to internal users when a signal arrives, and that message is visible to the consumer, you've violated the interstitial ban.
Similarly, if your A/B testing platform changes the layout or content for users with an active opt-out signal, you've altered the experience. The regulation doesn't allow exceptions for inadvertent changes.
Audit your signal-handling code quarterly. Check for modal dialogs, toast notifications, or layout shifts triggered by the signal. Review your feature-flagging and experimentation tools to ensure they don't treat opted-out users as a separate cohort with different UI.
What to Do Instead
Start with a compliance matrix. List California, Colorado, and Connecticut in columns. List your current opt-out mechanisms (homepage link, privacy notice link, account settings, opt-out signal recognition) in rows. Mark which states require which mechanisms, and note the effective dates.
For California, map each of the seven criteria to a technical control or policy document. Assign an owner to each criterion. Schedule quarterly reviews to confirm continued compliance.
For Colorado and Connecticut, track the mandatory recognition dates (July 1, 2024, and January 1, 2025, respectively). Don't assume that meeting California's standard will satisfy Colorado or Connecticut. Wait for implementing regulations or Attorney General guidance that clarifies the homepage link question.
Test your signal propagation. Enable Global Privacy Control in a browser, visit your site, then check whether your offline systems receive the suppression. If they don't, build the integration before you remove the homepage link.
Finally, document your decision. If you choose to keep the homepage link even though you technically meet the seven criteria, explain why. If you remove it, record the date, the compliance verification, and the systems covered. When an auditor or regulator asks, you'll have contemporaneous evidence of your reasoning.
