In California under CCPA, it actually goes beyond just frontend regulation and cookie banners, and into the realm of backend tracking management: https://oag.ca.gov/news/press-releases/attorney-general-bont...

The California Attorney General ruled that if a user presents a GPC signal, the company should update all of their backend systems to opt out of tracking in the same way as if the user clicked a "Do Not Sell My Personal Information" button.