Documentation explains which universal opt-out mechanisms are recognized

CPRA regulations (11 CCR § 7026) require businesses that honor opt-out preference signals to disclose which signals they recognize in their privacy policy. If your middleware.ts silently honors the GPC Sec-GPC: 1 header but the privacy policy makes no mention of it, the disclosure requirement is violated even though the technical implementation is correct. California consumers have a right to know which browser-based signals they can use — they cannot benefit from GPC protection they don't know your site respects. This is a documentation gap, not a technical one, but it is independently enforceable.

Add an Opt-Out Preference Signals section to your privacy policy listing every universal opt-out mechanism you honor. This section is required by CPRA regulations even if GPC is the only signal you support.

## Opt-Out Preference Signals (add to privacy policy)

We recognize and honor the following universal opt-out preference signals:

**Global Privacy Control (GPC):** If your browser sends a Sec-GPC: 1 header,
we automatically treat this as an opt-out of the sale or sharing of your
personal information. No additional action is required.

GPC is available in Brave (built-in), Firefox (via privacy settings),
and the Privacy Badger browser extension.

To opt out manually: /do-not-sell

Update the privacy policy's effective date after adding this section. If you later add support for IAB's Global Privacy Platform or other signals, add them here promptly — the disclosure obligation tracks the signals you honor.