The Attorneys General of California, Connecticut, and Colorado, along with the California Privacy Protection Agency (“the Coalition”) announced on September 9, 2025, that they are banding together as a coalition on an investigative sweep of “potential noncompliance” with Global Privacy Control (GPC), that provides businesses with “an easy-to-use browser setting or extension that automatically signals to businesses a consumer’s request to stop selling or sharing their personal information to third parties.”

The Coalition sent letters to businesses that “do not appear to be processing consumer requests to opt out of the sale of their personal information submitted via the GPC as required by law and requested that those businesses come into immediate compliance. This sweep reinforces the three states’ 2025 Data Privacy Day educational efforts on the GPC.”

The press release issued by the Connecticut Attorney General makes it clear that he believes the implementation of GPC is “simple” and provides a video showing businesses how to install GPC. In addition, the press release emphasizes that businesses that sell personal information “must provide a clear and conspicuous link on their website that allows you to submit an opt-out request.” It notes that if a consumer can’t find the link on the website, it is not working, or is difficult to find, “you may report the business to our office by filing a complaint online with the Office of the Attorney General.”

You can bet that if a consumer submits a complaint, the AGs in the Coalition will investigate, and no doubt they are randomly reviewing websites to determine compliance. This Coalition means business, so if you have not updated your website, or implemented GPC to respond to the requirements of California, Connecticut, and Colorado, now is the time to make it a top priority