With a “Don’t Sell My Data” Signal On, 1 in 3 Websites Tested Contacted Ad Services
By CertScore.ai
With Global Privacy Control (GPC) enabled, 337 of 1,000 websites tested from California contacted ad services ahead of a 2027 browser change.
California is about to make browser privacy opt-outs easier to find. A new website test offers a glimpse of what happens after the signal is sent.
Imagine telling every website you visit, automatically: Don’t sell or share my personal information. No searching for privacy links. No making the same request over and over.
That’s the idea behind Global Privacy Control (GPC), a browser signal that communicates your preference as you browse.
But what happens after a website receives it?
What the GPC test observed
From November 1–8, 2026, CertScore.ai examined 1,000 websites scanned from California with GPC enabled. On 337 of them—33.7%, or roughly one in three—the scanner observed requests reaching recognized advertising and marketing data-collection services. The requests weren’t merely inactive scripts on a page; the services responded.
That doesn't necessarily mean those websites ignored GPC or broke the law; some advertising activity can continue legitimately. Each response is a glimpse of activity most visitors cannot see. The scan captures the connection; it does not follow what happens inside an advertising service afterward. A visit with no such activity leaves open whether the site recognized GPC.
A browser setting arrives in 2027
On January 1, 2027, California’s Opt Me Out Act (AB 566, Lowenthal) will require web browsers—including major browsers such as Chrome, Safari and Edge—to offer an accessible, built-in privacy opt-out signal setting. People won’t have to install a separate extension just to make that request available in those browsers.
What is already required
Websites covered by California’s privacy law already have to honor qualifying opt-out signals. Several other states have similar requirements. Regulators aren’t waiting for 2027: California has brought GPC-related enforcement actions, and authorities in California, Colorado, and Connecticut announced a coordinated GPC investigation in 2025.
California enforcement has real financial stakes for businesses. Disney agreed to $2.75 million in civil penalties after the Attorney General alleged its opt-outs, including GPC requests, did not carry across linked services. Sephora agreed to $1.2 million over allegations that included unprocessed GPC signals, and CalPrivacy fined Tractor Supply $1.35 million for several CCPA failures, including ineffective GPC opt-outs.
California now requires covered businesses to provide a way to confirm their opt-out has been processed, for example with a message such as “Opt-Out Request Honored.” A message alone cannot show everything a website sent behind the scenes.
Try it
Curious about a website you use—or one you run?
Scan any website free at CertScore.ai and explore the cookies, trackers and advertising-related requests our scanner can observe. Results reflect the scan’s selected origin and available evidence.
Loading scan form…
Start with a free scan of one public page. Results describe the scan’s conditions and coverage.
How we tested
From November 1–8, 2026, CertScore.ai reviewed the latest 1,000 distinct websites for which its California-based scans had usable GPC results. The scanner made brief automated visits with GPC enabled and recorded requests reaching recognized advertising or marketing collection services.
Primary sources
Primary sources:California Legislature: AB 566 (Opt Me Out Act)CalPrivacy: Opt Me Out ActCalifornia Attorney General: Sephora settlementCalPrivacy: three-state GPC investigationCalPrivacy: Tractor Supply actionCalifornia Attorney General: Disney settlementCalPrivacy: 2026 opt-out confirmation guide