Opt-out user preference signals are being integrated into browsers and mobile operating systems to give individuals an opportunity to express their preferences all at once, and avoid the “privacy labor” of clicking every cookie banner on every site.
The most prominent of these opt-out signals is the Global Privacy Control (GPC). Additionally, the Internet Advertising Bureau (IAB) has its own opt-out preferences specification called the Global Privacy Platform (GPP). GPC and GPP both come with nuanced ways to interpret and implement signals.
Opt-out signals are required to be honored in certain states, with GPC specifically providing broader coverage for certain state-specific requirements. There has been a trend for more state-specific privacy laws that touch on universal opt-out preference signals.
When GPC implementation is broken, consent mechanisms are often broken too. Getting consent right is critical, and failing to do so can leave companies open to scrutiny.
How should site owners ensure these opt-out signals are honored?
First, getting the technical details right is critical
For GPC in particular, the W3C specs discuss that the Sec-GPC HTTP header (and related DOM property) should be conveyed in the HTTP header and set to Sec-GPC: 1 to express that the user has set a universal preference that their data “not be sold or shared.”
The IAB’s GPP is more complex. GPP contains a series of nesting options that express how IAB’s Multi-State Privacy Agreement (MSPA) signatories should configure or interpret the GPP signals. These nesting options signal whether the GPP serves in “service provider mode” or in “opt-out option mode” with various further approaches.
Second, there are a lot of scoping options to consider
For example, the “further approaches” in GPP’s opt-out signal split out whether a universal opt-out preference should be treated using a “national approach” (the highest common decision) or via state-specific requirements just for specific states with laws that create universal opt-out requirements.
Scoping should also consider what entities have signed onto the IAB’s MSPA and whether a site owner has carried out verification steps to ensure opt-out preference signals are being honored. California’s Attorney General recently settled with Healthline for the company’s alleged failure to verify opt-out signals were honored by data recipients. Healthline was an MSPA signatory using the GPP specifications yet had not made sure that other entities would honor opt-out signals via contractual requirements by either also being bound by MSPA contractual terms or having separate contract terms in place to honor the opt-out signal (see https://iapp.org/news/a/how-a-recent-settlement-represents-a-warning-and-relief-for-the-adtech-industry).
As a technical scoping matter, a universal opt-out signal should apply to all “sell or share” situations at a minimum. (There are also state-specific requirements for displaying a notice back to the user that their universal opt-out signal has been honored.)
When GPC implementation gets trickier is in the edge cases. There is no clear guidance on how to interpret opt-out preference signals when it comes to conversion measurement (including what that entails), frequency capping, and non-unique-identifier-based analytics. The baseline approach can go back to the root question: what are the expectations of a user who has set the universal opt-out signal?
GPC implementation issues also broadly point to deeper issues. Often when GPC implementation is broken, so are consent mechanisms. Getting consent right is critical, and failing to do so can leave companies open to scrutiny.
Enforcers have been clear that ensuring universal opt-out preferences are honored is an enforcement priority, so this will continue to be an important area of focus.
This publication is intended for informational purposes only and is not legal advice. Information in this publication is not intended to create, and receipt does not constitute, an attorney-client relationship. Readers should not act upon this information without seeking professional counsel.