On August 3, Sen. Ron Wyden (D-OR) sent a letter to attorneys general in 10 states and the California Privacy Protection Agency (CalPrivacy) urging them to issue public guidance directing businesses to honor Global Privacy Control (GPC) opt-out signals from their residents regardless of the user’s physical location or IP address. The letter was addressed to officials in California, Colorado, Connecticut, Delaware, Maryland, Montana, Nebraska, New Hampshire, New Jersey and Texas, whose comprehensive privacy laws enable consumers to use universal opt-out mechanisms such as GPC. Wyden warned that many companies rely on flawed commercial geolocation databases to selectively disregard GPC signals from users whose IP addresses appear outside states that mandate compliance, potentially depriving out-of-state college students, business travelers, military personnel, and consumers using virtual private networks of their rights under state law. Wyden noted that companies often deny these rights in secret, with no notification when a GPC signal is disregarded, creating what he called a “dark pattern” that leaves consumers unaware their privacy rights have been violated.

Wyden pointed to California, where staff from CalPrivacy confirmed that state consumers retain their privacy rights regardless of physical location, and urged the other states to adopt a similarly clear posture. He noted that his office’s oversight of major consent management platforms secured commitments from several firms to notify users when a GPC signal is rejected and to provide tools for consumers to self-certify their residency, undermining arguments that compliance beyond automated geolocation filtering is commercially unworkable. The letter called on the attorneys general to establish a bipartisan, multistate task force dedicated to coordinated enforcement of GPC requirements, arguing that joint investigative demands and compliance notices would make clear that geographic filtering cannot be used as a legal loophole. The letter was accompanied by a Congressional Research Service memorandum analyzing state privacy laws and GPC, which noted that at least 15 states now permit consumers to use universal opt-out mechanisms and that several expressly recognize GPC as an approved technology.