Global Privacy Control (GPC): what it is and who has to honour it

By the Privacyboard teamPublished 28 October 2026Updated 4 November 20269 min read

Short answer

Global Privacy Control (GPC) is a browser setting that sends a signal, the Sec-GPC: 1 header, telling every site a person visits not to sell or share their personal data. California and Colorado require businesses that sell or share data to treat it as a valid opt-out, and trackers count about a dozen US states in total. Honouring it does not need a pop-up.

Global Privacy Control, or GPC, is a signal that a visitor's browser sends to a website to say "do not sell or share my personal data". Some US privacy laws treat it as a valid opt-out request, so a business that sells or shares data has to stop when it receives the signal. This guide explains what GPC is, who must honour it, how to handle it on a website and how to test it, as of 4 November 2026.

#What is Global Privacy Control?

GPC is a setting or extension in a person's browser or phone that automatically tells every site they visit not to sell or share their personal information. The visitor switches it on once, and the browser sends it with every request instead of the person finding an opt-out link on each site.

The project is run as a coalition. According to globalprivacycontrol.org, it was initially led by Ashkan Soltani and Sebastian Zimmeck, working with publishers, browsers and advocacy groups such as The New York Times, The Washington Post, Mozilla, Brave, DuckDuckGo, Consumer Reports and the EFF. The site lists Brave and DuckDuckGo as sending the signal by default, Firefox as offering it in settings, and extensions such as Privacy Badger and OptMeowt for other browsers.

#Who publishes the GPC specification?

GPC started in the W3C Privacy Community Group in April 2020. In November 2024 it became an official work item of the W3C Privacy Working Group. The current text on w3.org is a Working Draft dated 24 September 2026, which means it is not yet a finished standard and can still change. Its editors come from Wesleyan University, Brave, Consumer Reports and The Washington Post.

That distinction matters. The technical standard is a draft, but the legal duty to honour the signal comes from laws and regulations, not from the W3C.

#How does GPC work technically?

The specification defines three parts:

An HTTP header, Sec-GPC. The browser sends it only when the preference was on at the start of a top-level navigation. The value must be exactly 1, and servers should ignore any other value.
A JavaScript property, navigator.globalPrivacyControl. It is a read-only boolean that returns true when the header would be sent. Scripts on the page can read it, so a consent banner or tag manager can react.
An optional file, /.well-known/gpc.json. A site can publish it to state that it supports GPC. It describes what the site says, not whether it honours a given visitor's signal.

According to the specification, the signal means a request not to sell or share personal information with third parties and not to use it for cross-context targeted advertising. It does not exercise deletion rights, and it does not limit what a site does with data for its own first-party purposes.

#How is GPC different from Do Not Track?

Both are browser signals, but they ended up in very different places.

	Do Not Track (DNT)	Global Privacy Control (GPC)
Meaning	A general "do not track me" preference	"Do not sell or share my personal data" and no cross-context targeted ads
Standard status	W3C Working Group Note (17 January 2019); the working group concluded	W3C Working Draft (24 September 2026) on the Recommendation track
Why	The group found there had not been sufficient deployment, and saw no sign of support from browsers or third parties	Backed by browsers, publishers and several state regulators
Legal effect	None that we found in the laws below	Treated as a valid opt-out request under California regulations and several other US state laws

In short, DNT was a request that sites could ignore. GPC is a request that some laws require you to follow.

#Which laws say you must honour GPC?

The duty exists in some US states. It is not part of the GDPR or the ePrivacy Directive, neither of which mentions GPC.

Settled, from the state's own materials:

California. The Attorney General says businesses that sell or share personal information must offer at least two ways to opt out, and that for online businesses a user-enabled global privacy control is one acceptable method. Section 7025 of the CCPA regulations says a business that sells or shares data must process a signal in a commonly recognised format, such as an HTTP header or JavaScript object, that is meant to opt the consumer out, as a valid request.
Colorado. The Attorney General says businesses that meet the Colorado Privacy Act thresholds must honour opt-out requests from universal opt-out mechanisms from 1 July 2024, and that GPC is currently the only mechanism it considers valid.
Connecticut. The Attorney General's April 2025 report states that as of 1 January 2025 businesses must recognise browser-based opt-out signals such as GPC.

Reported by trackers, so check the statute: other state laws have a similar rule. A tracker last verified on 16 September 2026 lists Montana, Nebraska, New Hampshire and Texas from 1 January 2025, Minnesota from 31 July 2025, New Jersey, Delaware and Oregon, and says Virginia and Utah have no such requirement. It calls Maryland ambiguous. Another tracker, dated October 2026, counts 12 states: California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon and Texas. The count differs by source, so the safe approach is to treat it as a requirement wherever a state law applies to you.

Coming: the California Opt Me Out Act (AB 566), signed on 8 October 2025, requires browser makers to build in an opt-out preference signal, effective 1 January 2027. That should make the signal far more common.

The duty applies only to a business that meets the state's thresholds and sells or shares personal information. In California, a business that neither sells nor shares data has nothing to opt out of.

#Has anyone been penalised for ignoring GPC?

Yes. Examples from regulators' own announcements:

Date	Regulator	Case	Outcome
24 August 2022	California Attorney General	Sephora	USD 1,200,000 settlement, including failure to process opt-outs through global privacy controls
9 September 2025	California privacy agency with the Attorneys General of California, Colorado and Connecticut	Joint sweep	Letters to businesses that may not be honouring GPC; no fines announced
30 September 2025	California privacy agency	Tractor Supply	USD 1,350,000 fine, which included not offering an effective opt-out, including through preference signals such as GPC

The California Attorney General's list of case examples also describes cases where a consumer-electronics business and multiple online retailers did not process GPC opt-outs. The Connecticut report adds that its office will focus on whether businesses comply with the signal rule.

#How should a website handle GPC?

California's regulations set the model, and it is workable for a small site:

Detect the signal. Read Sec-GPC: 1 on the server or navigator.globalPrivacyControl in the browser, before any advertising or sharing tag fires.
Stop selling and sharing for that browser. That means no sale, and no sharing for cross-context advertising, linked to that browser or device and any profile associated with it. If the person is logged in or otherwise known, apply it to the person as well.
Do it promptly. The privacy agency says to act as soon as feasible and within 15 business days.
Do not ask for more. You cannot require extra information to apply the opt-out. You may offer an optional way to provide it.
No fee, no degraded experience, no pop-up. A business that responds without friction does not need to show the opt-out links. It may display that the signal was honoured, such as a status message or a toggle.
Say so in your privacy policy. Describe how you process opt-out preference signals.
Do not treat silence as consent. If someone is known to you and later sends no signal, you cannot read that as opting back in.

If a person has an earlier business-specific setting that allows selling or sharing, the signal controls. You may tell them about the conflict and offer a chance to consent, but you must apply the signal unless they do.

#How can you test GPC in a browser?

You can check your own site in a few minutes.

Turn the signal on. In Firefox, open Settings, then Privacy & Security, scroll to Website Privacy Preferences and tick "Tell websites not to sell or share my data". Brave and DuckDuckGo send it by default, according to globalprivacycontrol.org.
Check the browser property. Open the developer console on any page and type navigator.globalPrivacyControl. It should return true.
Check the header. In the Network tab, reload the page, select the first document request and look for Sec-GPC: 1 in the request headers.
Watch what your site does. With the signal on, confirm that advertising and sharing tags do not fire and that your cookie settings show marketing off.
Test with the signal off to be sure the normal experience is unchanged.

#What this means for a small business

If you sell or share personal data, including through advertising or retargeting tags, and you serve people in California, Colorado, Connecticut or other states listed above, GPC is something you need to handle. If you do not sell or share data, the signal asks you for nothing, though honouring it is harmless. In Europe, you need consent for non-essential cookies anyway, as our cookie consent guide explains. For the legal differences between regimes, see GDPR vs CCPA/CPRA and our overview of privacy laws around the world.

Privacyboard's cookie banner honours the signal by default: it keeps the Marketing category off, leaves Google Consent Mode's advertising signals denied, shows a short confirmation, and notes in the consent log that the signal was present. A visitor can still turn Marketing on themselves. See Global Privacy Control in the banner for details. Whether a law applies to you is a legal question that a tool cannot settle.

#FAQ

#What does Sec-GPC: 1 mean?

It is an HTTP request header that a browser sends when the user has turned GPC on. The value must be exactly 1, and it tells the site the person does not want their data sold or shared.

#Is GPC the same as Do Not Track?

No. Do Not Track was a general preference that the W3C working group dropped in 2019 for lack of adoption. GPC is a narrower request about sale and sharing that several US laws treat as a valid opt-out.

#Do I have to show a pop-up when I receive a GPC signal?

No. California's regulations say a business that responds without friction must not show a notification or pop-up in response to the signal, though it may show a status message that the opt-out was applied.

#Does GPC apply in the EU?

Neither the GDPR nor the ePrivacy Directive mentions it. In the EU you need consent for non-essential cookies in any case, so visitors are asked first whether or not they send the signal.

#Which browsers send GPC?

According to globalprivacycontrol.org, Brave and DuckDuckGo send it by default and Firefox offers it as a setting. Extensions such as Privacy Badger add it to other browsers.

Then there is nothing to opt out of. California's regulation exempts a business that neither sells nor shares personal information, though you still need an accurate privacy policy.

#Sources

Privacyboard is a guidance tool, not legal advice. This article explains general rules in plain language and was accurate on the date above; laws and guidance change. For an unusual situation, ask a qualified professional. Spotted a mistake? Write to antoine@unmake.io.