The GPC enforcement wave: a record fine, a tri-state sweep, and the finding that breaks most implementations

What changed

For four years, Global Privacy Control sat in an awkward place: legally binding in California since the Sephora settlement, but enforced rarely enough that many teams filed it under theoretical. That period is over. The timeline:

When	What	Amount
Sep 9, 2025	CA + CO + CT (with the CPPA) announce a joint investigative sweep of businesses not processing GPC opt-outs; letters demand immediate compliance	—
Feb 11, 2026	Disney/ABC settle with the California AG — the largest CCPA settlement to date	$2.75M
early Mar 2026	PlayOn Sports — CPPA action for forced tracking acceptance, third-party-redirect opt-outs, and ignoring GPC	$1.1M
early Mar 2026	Ford — CPPA action for putting verification steps in front of opt-out requests	~$375K

Behind the sweep sits the Consortium of Privacy Regulators formed in April 2025 — seven states plus the CPPA coordinating enforcement. This is infrastructure, not a one-off.

The Disney finding is the one that changes implementations

Most GPC implementations do this: browser sends the header, the CMP flips the opt-out for that browser on that device. Disney did that too. The AG’s position: when the user is logged in — a “known consumer” — the opt-out must apply across the consumer’s entire relationship, every device and surface included. Device-scoped honoring was cited as a violation, alongside connected-TV apps that offered no in-app opt-out at all.

That converts GPC from a cookie-layer feature into an identity-layer requirement: the signal has to propagate from the browser into your CRM, your audience syncs, and your other platforms. Very few stacks do this today.

What this does not change

No new law took effect here — these are 2022-era CCPA obligations being enforced as written. And the scope is wider than California: as of January 2026, twelve states require honoring a universal opt-out mechanism, with CA, CO, and CT explicitly recognizing GPC. What changed is the probability of consequences, and the precision of what “honoring” means.

What to do

If you implement:

1. Verify receipt first — our GPC & DNT Tester shows what your own browser sends; confirm your CMP actually consumes it on every template, not just the homepage.
2. Fix scope: on login, join the GPC opt-out to the account and propagate it to ad platform syncs and server-side destinations. Device-only is now a named violation.
3. Delete any verification step in front of opt-outs — Ford’s ~$375K was for exactly that — and kill flows that hand the user to a third party instead of processing the request yourself (PlayOn’s pattern).

If you govern:

1. Treat a sweep letter as litigation-adjacent: the coalition’s letters asked for immediate compliance, and the 2026 fines are what non-response ripens into.
2. Audit the full path — signal received → CMP state → tag behavior → downstream sharing stopped. The Consent Checker reads the first half; the second half is where the fines happened.
3. Log GPC receipt and disposition. When a regulator asks, “we honor it” without records is an assertion, not a defense.