California Privacy Protection Agency Announces Joint Investigative Privacy Sweep

What happened

The California Privacy Protection Agency announced a joint investigative sweep with Colorado and Connecticut to enforce compliance with the Global Privacy Control (GPC) signal. The sweep targets businesses that fail to process consumer requests to stop the sale or sharing of personal data via GPC. The effort builds on the three states' 2025 Data Privacy Day education campaign and puts violators on notice to comply immediately.

Why it matters

Any firm that receives a GPC signal must have a functional process to honor the opt‑out request or risk enforcement scrutiny similar to this multi‑state sweep.

Business impact

Failure to recognize and act on GPC signals could trigger investigations, legal exposure, and reputational damage across the affected states.

Checklist

• Audit GPC handlingHigh priority

  Verify that systems detect and honor Global Privacy Control opt‑out signals for all consumer requests.

• Update privacy noticesMedium priority

  Ensure disclosures explain how GPC requests are processed and the rights afforded under California law.

• Train staffHigh priority

  Educate relevant teams on the legal obligation to honor GPC requests and the consequences of non‑compliance.

Who reported it

Discussion