A privacy signal can be one bit.
The supply chain behind it can contain dozens of companies.
That mismatch is the central problem with global opt-out mechanisms.
A browser can send a simple instruction such as:
Do not sell or share my personal information.
The difficult part is making sure that preference survives every handoff that follows.
The browser can express the choice once
Global Privacy Control, or GPC, is a browser-based signal designed to communicate an opt-out preference automatically to websites.
California regulators currently describe GPC as an opt-out preference signal that covered businesses must honor for applicable sale or sharing rights. In September 2025, California, Colorado, and Connecticut privacy regulators announced a coordinated sweep focused on businesses that may have failed to process GPC requests. See CalPrivacy’s enforcement announcement.
California also enacted the Opt Me Out Act in 2025, requiring browsers operating in California to provide built-in opt-out preference signals beginning in 2027. See CalPrivacy’s announcement.
That solves one usability problem.
The user does not need to hunt for a privacy link on every site.
One preference must cross many systems
Now imagine the website uses:
- an analytics provider,
- an ad exchange,
- a demand-side platform,
- a measurement vendor,
- a data broker,
- a server-side tag gateway,
- and several downstream processors.
The original site receives the signal.
What happens next?
Does it suppress the relevant outbound event?
Does it attach an opt-out flag to downstream requests?
Do intermediaries understand the flag the same way?
Does a broker already holding a profile update its state?
Does the choice apply only to future sharing, or does it also affect retained data?
Those are implementation questions, not interface questions.
The ad industry itself recognizes the propagation problem
IAB Tech Lab’s current privacy standards portfolio explicitly focuses on communicating privacy preference signals through the digital advertising supply chain. Its Global Privacy Platform and related standards exist because a preference that stops at the visible website is not enough for a multi-party ecosystem. See IAB Tech Lab’s Privacy Standards.
That does not prove every intermediary honors every signal correctly.
It proves the industry understands that the signal needs a transport mechanism.
Compliance has to be tested in the data flow
A website can display Your privacy choices were saved while still sending data to outside services.
That does not automatically mean the transfer violates a law; some processing may remain permitted or necessary.
But the message cannot be evaluated from the button alone.
A real audit compares network behavior, server-side processing, vendor configuration, and downstream contracts before and after the preference is expressed.
The Surveillance Economy is full of settings that look local but govern distributed systems.
An opt-out is only as strong as the farthest system that is supposed to remember it.