Anticipated GPC Surge May Depend on Browser Implementation

California Gov. Gavin Newsom (D) last month signed AB-566, a bill requiring browsers to support universal opt-out preference signals like the GPC by Jan. 1, 2027. The California Privacy Protection Agency supported the bill and may have a rulemaking related to opt-out signals in the near future (see [Re:2511070050]). CalPrivacy Executive Director Tom Kemp and others have predicted that businesses will see an increase in opt-out signals between now and when compliance becomes mandatory (see 2510080054 and 2511130034).

Some browsers, including Brave, DuckDuckGo and Mozilla Firefox, already support GPC natively, though in Firefox it’s not activated by default in the browser’s settings. But other top browsers, including Apple Safari, Google Chrome and Microsoft Edge, lack native GPC options, though users can add the function by downloading a third-party extension like the Electronic Frontier Foundation’s Privacy Badger.

Currently, “tens of millions of people are sending [GPC signals] every month,” estimated Brookman. “It’s going to go up a lot” with the new California law.

However, since the California measure doesn’t require the universal opt-out to be activated by default, the size of the increase will depend partly on how easy companies like Google make the toggle to find in the browser, he noted. Also, since the state law doesn’t specifically mandate that companies use GPC, it’s possible that one or more of the big browsers will develop a universal opt-out mechanism, he said.

“It will be interesting to see what Apple does,” said Brookman, noting that the company has positioned itself as strong on privacy with things like its app-tracking transparency framework. ATT doesn’t apply universally by default, but Apple forces users to choose with every app if they want to allow tracking, he said.

Apple, Google and Microsoft didn’t comment Friday about how they plan to comply with AB-566 and if they will adopt GPC or an alternative preference signal. Last month, Mozilla applauded the new law and suggested other states and the federal government should follow California in requiring universal opt-out mechanisms (see 2510300009).

The people who developed GPC have done a lot of outreach with browsers over the years, said Brookman. “One or two” would “talk to us pretty regularly about it,” he said. “Others we would brief pretty regularly and/or petition.”

The holdout browser companies have been “responsive” but given “plausible reasons” not to support GPC, said the CR official: For example, one argument was that only a handful of states required the signals to be honored. Still, advocates have continued to make the case to the holdouts for GPC without being “entirely successful,” he said. “But then again, at the end of the day on [AB-566], they ended up being neutral, which was a change.”

History of GPC

Work on GPC started after the California Consumer Privacy Act became law in 2018, Brookman said. While “revolutionary,” CCPA was an opt-out law, “which was not what a lot of advocates wanted because opt-outs are practically difficult to use,” he said. “But there was language in [CCPA] which made it sound like you could appoint something or someone to opt out for you.”

So, a few privacy experts started “talking about the idea” that there should be a “standardized signal that could be a way to opt out through your browser,” said Brookman: They included Ashkan Soltani, former executive director of the California Privacy Protection Agency; technologist Robin Berjon; and Sebastian Zimmeck, a professor at Wesleyan University.

Their work borrowed from “Do Not Track,” a browser-based signal that Brookman worked on, he said. That was an “effort to voluntarily send … standardized signals to companies asking to opt out of sharing” and cross-advertising. “After several years, that effort floundered because of the lack of law,” he said. “But once CCPA was in effect and there was a legal hook for it, it seemed to make sense to develop a protocol largely based on Do Not Track -- to do the same thing, but with legal effect now in California.”

“The law was the reason to resurrect the idea,” said Brookman, who noted that “a lot of the syntax” in GPC is like that of Do Not Track. GPC actually is simpler than Do Not Track, which additionally allows users to locally store exceptions, he added.

To make sure it was workable, the developers involved major publishers, including the New York Times, where Berjon worked at the time as vice president of data management, and Brookman’s Consumer Reports. The developers also wrote a short implementation guide.

Meanwhile, “we were always also briefing the regulators about all this in California, and then other states … considering comparable laws.” Eventually, the California attorney general's office formally clarified that GPC is a legally binding form of opt-out in the state, said Brookman. “And then other states started … saying, ‘Well, yeah, this is kind of an obvious idea.’” About half the states’ comprehensive privacy laws now require support for preference signals, he said.

GPC has seen structural changes over the years, though the code itself hasn’t needed much updating, said Brookman. “Originally, it was just … an informal consortium” of about a dozen regular participants, he said. But about a year and a half ago, “we started to go through the W3C … standardization process” to make it “an official web standard, which is going to make deployment easier and more reliable.” Part of the reason for that was to drive adoption by more browsers, said Brookman. “Browsers like things to be standardized.”