Compliance Coverage

Jurisdiction coverage

GPCGuard tracks public universal opt-out and GPC sources separately from product-support status. Supported and beta entries describe the API-layer evidence workflow; they do not mean every customer, data flow, or downstream partner is automatically covered.

This table describes GPCGuard product-support status and public source tracking. It is not legal advice. Applicability depends on the customer's role, processing activities, consumer location, data flows, and legal counsel's interpretation.

California

CCPA / CPRA

Supported

Signal terminology: Global Privacy Control / user-enabled global privacy control
Effective date tracked: Current CCPA/CPRA regulations; 2026 CCPA updates reviewed separately
Public-source summary: California DOJ states that covered businesses that sell or share personal information must honor GPC as a valid opt-out request.
Product note: Supported means GPCGuard can produce API-layer sale/share decision records for configured sites. Customers still confirm applicability, notices, and downstream suppression with counsel.

California DOJ GPC pageReviewed 2026-05-04

Colorado

Colorado Privacy Act

Beta

Signal terminology: Universal Opt-Out Mechanism (UOOM); GPC recognized
Effective date tracked: 2024-07-01 for UOOM acceptance by covered controllers
Public-source summary: Colorado recognizes GPC as a UOOM for sale and targeted-advertising opt-outs under the CPA framework.
Product note: Beta because GPCGuard records API-layer sale and targeted-advertising policy outcomes, but state-specific notice, residency, and downstream enforcement validation remain customer work.

Colorado Attorney General UOOM listReviewed 2026-05-04

Connecticut

Connecticut Data Privacy Act

Beta

Signal terminology: Opt-Out Preference Signal (OOPS)
Effective date tracked: 2025-01-01 for OOPS recognition
Public-source summary: Connecticut AG guidance states covered controllers must honor qualifying opt-out preference signals for sale and targeted advertising.
Product note: Beta because GPCGuard can record the endpoint decision and targeted-advertising flag, while Connecticut-specific consumer-location and downstream handoff review remains customer/legal work.

Connecticut AG CTDPA guidanceReviewed 2026-05-04

New Jersey

New Jersey Data Privacy Act

Beta

Signal terminology: User-selected universal opt-out mechanism
Effective date tracked: 2025-07-15 for universal opt-out mechanism support
Public-source summary: New Jersey law requires covered controllers that process for sale or targeted advertising to allow opt-out through a qualifying universal opt-out mechanism.
Product note: Beta because product evidence fields align with sale and targeted-advertising outcomes, but New Jersey residency and any Division of Consumer Affairs technical-rule updates need customer/legal review.

New Jersey P.L. 2023, c.266Reviewed 2026-05-04

Oregon

Oregon Consumer Privacy Act

Planned

Signal terminology: Universal Opt-Out / opt-out preference signal
Effective date tracked: 2026-01-01 for universal opt-out signals
Public-source summary: Oregon DOJ states covered businesses and nonprofits must honor opt-out signals that meet technical requirements.
Product note: Planned because Oregon adds nonprofit and precise-location considerations outside the current self-serve evidence workflow.

Oregon DOJ Consumer Privacy pageReviewed 2026-05-04

Delaware

Delaware Personal Data Privacy Act

Planned

Signal terminology: Universal opt-out mechanism
Effective date tracked: 2026-01-01 for universal opt-out mechanism recognition
Public-source summary: Delaware DOJ FAQ says universal opt-out mechanisms must be recognized by covered controllers as valid consumer requests.
Product note: Planned because GPCGuard has not published Delaware-specific validation, notice, or workflow guidance for self-serve customers.

Delaware DOJ DPDPA FAQReviewed 2026-05-04

Minnesota

Minnesota Consumer Data Privacy Act

Legal review pending

Signal terminology: Opt-out preference signal / universal opt-out mechanism
Effective date tracked: 2025-07-31 for most covered controllers
Public-source summary: Minnesota statute requires controllers to allow opt-out through an opt-out preference signal for targeted advertising or sale.
Product note: Legal review pending because the statute includes consumer-residence determination language and recognition of other state-approved signals; GPCGuard does not yet publish Minnesota-specific product guidance.

Minnesota Revisor Stat. 325M.14Reviewed 2026-05-04

Texas

Texas Data Privacy and Security Act

Legal review pending

Signal terminology: Authorized-agent opt-out technology / browser setting
Effective date tracked: 2025-01-01 for authorized-agent technology provisions
Public-source summary: Texas law allows consumers to designate an authorized agent using technology such as a browser setting or extension for sale and targeted-advertising opt-outs.
Product note: Legal review pending because Texas includes authorized-agent, residency verification, and ability-to-process conditions that GPCGuard does not currently evaluate on behalf of customers.

Texas Business & Commerce Code Chapter 541Reviewed 2026-05-04

← Back to home