Global Privacy Control (GPC)

What is Global Privacy Control (GPC)?

Global Privacy Control (GPC) is a browser setting that tells every website you visit not to sell or share your personal information. When it is on, the browser adds the HTTP header Sec-GPC: 1 to each request and sets navigator.globalPrivacyControl to true for scripts on the page. That is the GPC signal.

In California, Colorado, Connecticut and a growing list of US states, the law treats the GPC signal as a valid request to opt out of the sale or sharing of personal data and of targeted advertising. Websites covered by those laws must honor it automatically, without asking the visitor to click anything.

GPC is the best-known opt-out preference signal, the general term the California regulations use for this kind of browser-level opt-out.

Who created Global Privacy Control?

GPC was introduced at the World Wide Web Consortium (W3C) Privacy Community Group in April 2020 by a group of browsers, publishers, privacy researchers and advocates. In November 2024 it became an official work item of the W3C Privacy Working Group, where the specification is being standardized.

How does the GPC signal work?

The specification defines two ways for a website to read the signal, plus an optional file for the website to declare that it honors GPC:

• HTTP header: the browser sends Sec-GPC: 1 with requests. The header is only sent when GPC is on, and servers should treat any value other than 1 as not set.
• JavaScript property: navigator.globalPrivacyControl returns true when the header would be sent and false when it would not.
• Website declaration: a site can publish /.well-known/gpc.json to state that it intends to honor GPC.

GET /checkout HTTP/1.1
Host: www.example.com
Sec-GPC: 1

// Read the GPC signal in the browser
if (navigator.globalPrivacyControl === true) {
  // Treat the visitor as opted out of sale, sharing and targeted advertising
}

// /.well-known/gpc.json
// { "gpc": true, "lastUpdate": "2026-10-01" }

GPC is a signal, not a blocker. It does not stop tags by itself: the website, or its consent management platform, has to detect it and act on it.

Which browsers and extensions send GPC?

California's Opt Me Out Act (AB 566), signed in October 2025, requires browsers to offer a built-in opt-out preference signal setting from January 1, 2027, so GPC traffic is expected to grow.

How to enable Global Privacy Control

• Brave and DuckDuckGo: nothing to do, GPC is on by default.
• Firefox: open Settings, go to Privacy & Security, and tick the option that tells websites not to sell or share your data. In private windows it is already on.
• Other browsers: install an extension that sends GPC, such as Privacy Badger.

To check that it works, open the browser console on any page and type navigator.globalPrivacyControl. It returns true when the signal is on.

Which laws require websites to honor GPC?

Under the CCPA regulations, a business that sells or shares personal information must treat the GPC signal as a valid opt-out of sale and sharing for that browser or device and for any profile linked to it, including the consumer's account when the business knows who they are. Since the updated regulations took effect on January 1, 2026, the business must also show on its website whether it has processed the signal, for example with an "Opt-Out Request Honored" message. See all state laws in our US state privacy laws guide.

GPC enforcement: Sephora and Disney

• Sephora, August 2022: in the first CCPA settlement, the California Attorney General fined Sephora $1.2 million. One of the claims was that Sephora failed to honor opt-out requests sent through user-enabled global privacy controls. The same day, the Attorney General sent notices to other businesses that ignored GPC.
• Disney, February 2026: Disney agreed to pay $2.75 million, the largest CCPA settlement to date. When consumers sent a GPC signal, Disney applied the opt-out only to that device, even when they were logged into their Disney account, and kept selling or sharing their data from other devices and services. Read our analysis: Disney CCPA fine for Global Privacy Control.

GPC vs Do Not Track

Do Not Track (DNT) was an earlier browser header that asked websites not to track the user. No law required websites to honor it, so most ignored it, and browsers such as Safari and Firefox have since removed the setting.

GPC is narrower and has legal force. It asks for one thing, no sale or sharing of personal data, and US state laws turn that request into a binding opt-out. A website that ignores GPC in California or Colorado is not meeting the law.

GPC and the GDPR

The GDPR does not name GPC, and no EU regulator has made it a required signal. The GPC specification notes that, in the EU, it can express a general request to limit the sale or sharing of personal data, linked to the right to withdraw consent (Article 7) and the right to object (Article 21).

In practice the GDPR is an opt-in law: you still need consent before setting non-essential cookies, whether or not the visitor sends GPC. Treating a GPC signal as a refusal of advertising cookies for EU visitors is a cautious choice, but it does not replace the GDPR consent banner.

How should websites honor the GPC signal?

1. Detect the signal on the first page view, from the Sec-GPC header on the server or navigator.globalPrivacyControl in the browser.
2. Opt the visitor out of the sale and sharing of personal data and of targeted advertising, without a pop-up or extra step.
3. Apply it to the account: if the visitor is logged in, apply the opt-out to their profile across devices and services, as the Disney case showed.
4. Show the status: display that the opt-out preference signal was honored, as the CCPA regulations require from 2026.
5. Pass it to partners: set the opt-out and the GPC field in the IAB GPP US sections and the US Privacy string, so ad partners stop selling or sharing the data.
6. Test and keep records: check regularly that ad and analytics tags respect the signal.

How UniConsent honors Global Privacy Control

With UniConsent, you respect opt-outs and Global Privacy Control automatically, while your analytics keep working.

UniConsent honors Global Privacy Control automatically for visitors covered by your CCPA or US State Privacy settings. A GPC signal counts as an opt-out of the sale and sharing of personal information and of targeted advertising, without the visitor opening the banner. Other purposes are not affected.

The opt-out is passed to your partners in the IAB GPP US sections, including the GPC field, and in the US Privacy string, and is available as the GPC variable in the data layer for Google Tag Manager. On consent categories banners in the US, GPC turns off the targeting category. In mobile apps, the device's limit ad tracking setting is treated the same way as GPC.

Use a consent management platform like UniConsent to honor GPC, show opt-out choices and pass the signal to your partners from one tag.

Trusted by 5000+ of global publishers and marketers

• 
• 
• 
• 
• 
•