Careers

Experiences

Industries

Offices

Our Firm

Pages

Our People

Updates

Practices

Warner Norcross + Judd LLP is a corporate law firm with over 230 attorneys serving clients in nine offices throughout Michigan. Among the largest law firms in Michigan, Warner works in virtually all areas of business law.

Michigan Law Firm - Warner Norcross + Judd LLP

While many state comprehensive data privacy laws require that data controllers honor universal opt-out mechanisms such as Global Privacy Control (GPC) signals, California, Colorado and Connecticut have launched <a href="https://cppa.ca.gov/announcements/2025/20250909.html" target="_blank" rel="noreferrer noopener">a joint enforcement effort</a> targeting noncompliance with these requirements. This is <a href="https://oag.ca.gov/news/press-releases/following-data-privacy-day-attorney-general-bonta-reminds-consumers-their-right" target="_blank" rel="noreferrer noopener">not the first time</a> these attorneys general have cooperated on data privacy law efforts and may signal a broader trend of cooperation across states.

core/paragraph

What are universal opt-out mechanisms?

Universal opt-out mechanisms are a browser setting or extension that sends a signal to a website that a consumer is opting out of the selling or sharing of their personal information and targeted advertising. The website should respond to that signal by automatically opting out the consumer of such selling or sharing. This enables consumers to easily opt-out on each website they visit rather than having to submit an opt-out request on an individual basis at each website.

To date, privacy laws in California, Colorado, Connecticut, Delaware, Minnesota, Montana, Nebraska, New Jersey, New Hampshire, Oregon and Texas require business to detect and process these out-out signals. Maryland’s requirement takes effect on Oct. 1.

Implementation was delayed but is now an enforcement priority

While the requirement to recognize GPC signals is not new, enforcement has not been a top priority. However, the three-state coalition is now contacting businesses suspected of violating this requirement and requesting that those businesses cure noncompliance.

Noncompliance can be costly

Businesses that fail to honor GPC requests face multiple enforcement risks. In addition to the potential for class action litigation and reputational damages, states can directly impose fines for noncompliance with their privacy laws:

California: Fines up to $7,500 per violation

core/list-item

Colorado: Penalties up to $20,000 per violation

Connecticut: Fines up to $5,000 per violation

core/list

In addition, privacy regulators are becoming more active and are working closely across state lines. In addition to this investigatory sweep, Delaware, Indiana, New Jersey and Oregon have joined California, Colorado and Connecticut as part of a broader group of regulators that share priorities and sometimes run investigations together as part of the <a href="https://cppa.ca.gov/announcements/2025/20250416.html" target="_blank" rel="noreferrer noopener">Consortium of Privacy Regulators</a>.

When a regulator starts asking questions, it can be costly and risky for a business. California, Colorado and Connecticut can pass along what they find in this sweep to regulators in the Consortium and in other states. Regulators often request detailed information about how a company handles data, including technical setups and recordkeeping. If they discover issues, they may expand their investigation to look for other problems.

Because of this, it is time to review your websites and verify that your data practices align with the universal opt-out mechanism requirements.

If you have any questions about how these principles may impact your company, please reach out to Kelly Hollingsworth, Nate Steed, Sam Poortenga or your Warner attorney.

Partner

Kelly R. Hollingsworth

Associate

Samuel D. “Sam” Poortenga

Nathan W. “Nate” Steed

Cybersecurity and Privacy

Cybersecurity and Privacy Litigation

Data Analytics and eDiscovery Services

Litigation and Dispute Resolution

California, Colorado and Connecticut Launch Joint Investigatory Sweep Targeting Website Global Privacy Control Noncompliance

Warner Norcross + Judd LLP is responsible for the contents of our advertising and this website. Please read our full <a href="/privacy-policy/" aria-label="see privacy policy">privacy policy</a> available on our website. If you have any questions or comments about our website or our Privacy Policy please contact us at <a href="mailto:info@wnj.com">info@wnj.com</a> or 616.752.2000.

California, Colorado and Connecticut Launch Joint Investigatory Sweep Targeting Website Global Privacy Control Noncompliance

professionals