Before the end of 2025, 10 states will require websites to honor consumers’ broadcasted requests to opt out of all sharing of their personal data with the global privacy control (GPC) or a similar universal opt-out mechanism. GPC, a browser-based setting for consumers to automatically opt out, is said to be simple for consumers to use, simple for companies to implement and simple for regulators to check. But it turns out to have several complexities for companies, underscored by a study of 11,000 sites revealing that many of them did not translate GPC into opt-out signals. This article went behind the study’s findings and looked at GPC’s pitfalls, including misconfigurations, privacy signal system glitches, the ease of consent fraud and issues in due diligence, with insights from an original developer of GPC and experts at Moritt Hock, Neal Gerber & Eisenberg, the Network Advertising Initiative, Orrick and Raptive.