California Privacy Protection Agency, Colorado and Connecticut launch joint sweep of GPC violators

What happened

• The sweep targets businesses that fail to process consumer requests to stop the sale or sharing of personal data via GPC.
• The effort builds on the three states' 2025 Data Privacy Day education campaign and puts violators on notice to comply immediately.

Why it matters

Any firm that receives a GPC signal must have a functional process to honor the opt‑out request or risk enforcement scrutiny similar to this multi‑state sweep.

Business impact

Failure to recognize and act on GPC signals could trigger investigations, legal exposure, and reputational damage across the affected states.

What to check

1. 1

   Audit GPC handlingHigh priority

   Verify that systems detect and honor Global Privacy Control opt‑out signals for all consumer requests.

2. 2

   Update privacy noticesMedium priority

   Ensure disclosures explain how GPC requests are processed and the rights afforded under California law.

3. 3

   Train staffHigh priority

   Educate relevant teams on the legal obligation to honor GPC requests and the consequences of non‑compliance.