As more states give consumers the ability to automatically opt out of certain uses of their personal information, Senator Ron Wyden (D-Ore.) is urging state regulators to take a more coordinated approach to enforcing those rights.
In an August 3rd letter to attorneys general and privacy regulators in 11 states, Senator Wyden called for clearer guidance and collective enforcement around Global Privacy Control, a technology that allows consumers to communicate an opt-out preference automatically through their browser rather than submitting individual requests to every website they visit.
Wyden’s focus is particularly relevant for ecommerce businesses because honoring these signals can involve more than simply detecting whether GPC is enabled. His letter raises questions about how businesses determine which consumers are entitled to protections under state law, particularly when location data does not accurately reflect where a consumer resides.
What Is Global Privacy Control?
Global Privacy Control, or GPC is a browser-based signal designed to tell websites that a consumer does not want their personal information sold or shared. Instead of navigating individual privacy menus or opt-out links, a consumer can enable GPC through a supported browser or browser extension and have that preference communicated automatically to websites.
According to a Congressional Research Service memorandum accompanying Wyden’s letter, at least 15 states have enacted comprehensive privacy laws allowing consumers to use universal opt-out mechanisms to exercise certain privacy rights. California, Colorado, Connecticut, Oregon and New Jersey are among the states whose regulators have specifically recognized GPC as a valid mechanism.
California and Colorado have already taken particularly clear positions. California regulators state that covered businesses must honor valid opt-out preference signals, while Colorado currently recognizes GPC as its approved universal opt-out mechanism.
For businesses, that means GPC is increasingly becoming an operational compliance issue rather than simply an emerging privacy technology.
Wyden Takes Aim at IP-Based Filtering
The central concern in Wyden’s letter is the use of IP geolocation to determine whether a GPC signal must be honored.
According to Wyden, some businesses honor GPC only when a consumer’s IP address indicates that the consumer is physically located in a state whose privacy law requires businesses to recognize universal opt-out signals. He argues that this approach can produce incorrect results because an IP address does not necessarily establish where a consumer legally resides.
A California resident traveling in another state, for example, may appear to be outside California when visiting an ecommerce site. The same problem can arise for college students, interstate commuters or members of the military stationed away from their home state.
Virtual private networks add another complication. A VPN can make a consumer’s traffic appear to originate from the location of the VPN server rather than the consumer’s actual location. Wyden argues that relying exclusively on that information could result in a privacy-conscious consumer enabling GPC while having the signal disregarded because the website incorrectly assumes the consumer is outside a covered state.
The CRS analysis attached to the letter acknowledges the complexity. GPC itself does not communicate a user’s state of residence, and businesses may potentially rely on IP addresses, information consumers previously supplied or other sources when attempting to determine residency. CRS also noted that these residency “edge cases” have not yet played a role in state GPC enforcement actions, leaving important questions about the use of IP geolocation unresolved.
Wyden Wants Clearer Guidance From States
Wyden is asking state officials to clarify their expectations. Specifically, he is urging regulators to tell businesses that GPC signals from their residents should be honored even when those residents are temporarily located elsewhere or are using VPNs. Where a business believes a consumer is outside the state, Wyden argues that it should not silently reject the signal based solely on an IP address. Instead, he wants businesses to provide notice and an easy way for consumers to confirm their residency.
The letter points to changes being made by several consent management platforms as evidence that alternatives to simple GeoIP filtering are technically possible. Some platforms told Wyden’s office that they already honor GPC regardless of IP address, while others have committed to adding notices, residency self-certification options or mechanisms allowing users to correct an incorrectly inferred location.
Wyden also called for the creation of a bipartisan, multistate attorney general task force focused specifically on GPC enforcement. His proposal would encourage states to coordinate investigative demands and compliance notices where businesses allegedly fail to honor consumer signals.
There is already some precedent for coordinated enforcement. In 2025, privacy regulators in California, Colorado and Connecticut announced a joint investigative sweep focused on businesses that failed to honor GPC and other opt-out preference signals.
Enforcement Is Already More Than Theoretical
Businesses should also recognize that enforcement of GPC requirements has already resulted in significant settlements.
California’s 2022 enforcement action against Sephora included allegations that the retailer failed to honor GPC signals and resulted in a $1.2 million settlement. In 2025, Healthline agreed to a $1.55 million settlement involving allegations that it continued sharing consumer information with advertisers despite GPC opt-out signals. And in February 2026, California announced a $2.75 million settlement with Disney involving, among other issues, how opt-out requests were applied across services and devices associated with consumer accounts.
Those actions differ factually from the IP-geolocation practices Wyden is now targeting. In fact, CRS noted that residency verification has not yet been central to previous GPC enforcement cases. That distinction is important: Wyden’s letter is asking regulators to establish clearer expectations in an area where enforcement precedent remains limited.
What Ecommerce Businesses Should Watch
For ecommerce businesses subject to state privacy laws, Wyden’s letter is a reason to review how GPC signals are currently handled.
Businesses should understand whether their websites and consent-management systems recognize GPC, whether compliance varies based on a visitor’s apparent geographic location, and what happens when IP-based location information conflicts with other information the business may already have about a consumer.
They should also pay attention to whether regulators respond to Wyden’s request for formal guidance or coordinated enforcement. The CRS analysis notes that several state laws use concepts such as “commercially reasonable” efforts when determining how businesses should respond to universal opt-out mechanisms. What regulators ultimately consider commercially reasonable—particularly when IP location information is uncertain—could have meaningful implications for implementation.
For small and medium-sized ecommerce businesses, clarity will be particularly important. Many rely on third-party consent-management platforms to implement privacy choices, making it essential to understand not only what state law requires but also how those vendors configure GPC recognition and geolocation settings.
Wyden’s proposal does not itself change the law. But it puts increased attention on a specific implementation question that regulators may soon address more directly: when a consumer sends a valid privacy signal, how far can a business rely on geolocation before deciding not to honor it?
As state regulators consider Wyden’s request, ecommerce businesses should watch closely for new guidance—and ensure they understand how their own systems currently respond when a customer says, through GPC, “do not sell or share my data.”
Join the EIA today to help strengthen and shape policies that affect all ecommerce businesses. Together, we can continue to create the future of ecommerce. Subscribe to EIA email updates to stay informed on key developments and their impact on your business.
Ecommerce Innovation Alliance provides members with analysis of litigation and regulatory developments affecting online commerce and digital marketing. This post is for informational purposes only and does not constitute legal advice. Businesses should consult qualified counsel about their specific circumstances.
