Safari Adds a Global Privacy Control Setting in the iOS 27.3 Beta

The iOS 27.3 beta adds a new Safari setting called "Use Global Privacy Control". When it is on, Safari asks every website the user visits not to sell or share their data. Global Privacy Control (GPC) has been available in Firefox and Brave for years, but Safari is the default browser on every iPhone, so this puts the signal within reach of far more of your visitors.

Safari Adds a Global Privacy Control Setting in the iOS 27.3 Beta

The New Safari Setting

The setting is under Settings › Apps › Safari › Advanced. Apple's description reads: "Safari can ask websites to not sell or share your data. This may cause some websites to not function properly or work at all."

Reports on the beta say the setting is off by default, so users have to turn it on themselves. The beta links to an Apple support page that is not published yet, and Apple has not announced the feature. Because this is a beta, the wording, the location and the default can still change before release.

The timing fits California law. The Opt Me Out Act (AB 566) requires companies that make web browsers to include a setting that sends an opt-out preference signal from January 1, 2027.

GPC Is an Opt-Out Signal, Not Consent

GPC is a signal the browser sends with each page request. It tells the website that the visitor does not want their personal information sold, or shared for advertising. A website can read it and act on it without asking the visitor anything.

It has legal force only where a law says so. In California and several other US states, a website must treat GPC as a valid opt-out of the sale and sharing of personal information. Elsewhere it is a request that a site can choose to honour.

Some of the coverage says this could end cookie pop-ups. For most websites it will not:

• In the EU and UK, cookies for advertising and analytics need the visitor's consent before they are set. GPC is an opt-out signal. It tells you a visitor said no, but it cannot give you a yes, so you still need a banner to ask.
• In the US, a visitor with GPC on is already opted out of sale and sharing. You do not need to ask them again, but you still need the opt-out link and a privacy notice for everyone else.

More Visitors Will Send GPC

Two days before the Safari report, California's privacy agency announced a $2.975 million fine against FedEx. One of the findings was that fedex.com was not configured to detect and honour opt-out preference signals. Disney paid $2.75 million earlier this year for related failures.

Until now, the number of visitors sending GPC has been small on most sites, because it required Firefox, Brave or a browser extension. A setting in Safari changes that. A site that ignores the signal today is ignoring a few visitors. After iOS 27.3 it could be ignoring many more, and each ignored signal is a potential violation.

Preparing Your Website

Detect the signal on every page load

Your site should check for GPC on every page, before any advertising tag runs.

Stop the tags, not only record the choice

For a visitor in a state that requires it, GPC means advertising tags that sell or share data must not load. Logging the signal while the Meta Pixel and Google Ads tags keep firing is what the FedEx order describes.

Decide what happens when GPC and the banner disagree

A visitor may have clicked "Accept" on your banner last month and turn on GPC in Safari next month. Under California's rules the signal is a valid opt-out, so it should apply. You may tell the visitor that the signal conflicts with their earlier choice and let them opt back in if they want to, but you cannot ignore the signal or keep asking.

Say how you handle GPC in your privacy policy

California requires the privacy policy to explain how opt-out preference signals are processed. FedEx was cited for leaving this out.

Test in Safari once the release is out

Turn the setting on and visit your site as a US visitor. If advertising tags still load, the signal is not being honoured. Repeat the test whenever you add a new tag.

GPC Support in UniConsent

UniConsent detects GPC in the visitor's browser, including Safari once the setting is released. For US visitors it applies the opt-out automatically, without them opening the notice, holds back advertising tags through the Tags Loader, and passes the opt-out to your ad partners through IAB GPP. For visitors in the EU and UK, the consent banner is still shown, because consent is still required there.

You turn this on in the dashboard under US State Privacy, without changing your website code.

Sign up and set up GPC handling on your website in a few minutes.

References

• Global Privacy Control specification