Glossary Term

Global Privacy Control

glossary global privacy control featured

Global Privacy Control (GPC) is a browser setting that automatically tells every site a user visits not to sell or share their personal information. GPC stands for Global Privacy Control. It replaces the per-site opt-out click with a single signal sent on every request, and twelve US states now treat that signal as a legally valid opt-out request.

How the GPC Signal Works

GPC is one bit the browser sends, plus a file the site publishes back. A browser with the setting enabled attaches an HTTP request header to every outbound request:

Sec-GPC: 1

The same preference is exposed to JavaScript as a boolean:

if (navigator.globalPrivacyControl) {
  // treat this visitor as opted out of sale and sharing
}

Sites declare their own support at a well-known URL, /.well-known/gpc.json, served as application/json:

{
  "gpc": true,
  "lastUpdate": "2026-09-21"
}

The lastUpdate value uses RFC 3339 format. GPC became an official work item of the W3C Privacy Working Group in November 2024 and is still being standardized.

Which Browsers Send GPC

Support is native in privacy-focused browsers and absent from the two largest. DuckDuckGo sends the signal by default. Brave supports it, and Firefox offers it as a setting rather than a default.

Chrome and Safari do not send GPC natively. Users there need an extension such as Privacy Badger from the EFF, Disconnect, or OptMeowt. That gap is why GPC traffic stays a minority of visitors on most sites.

California changed that trajectory. Governor Gavin Newsom signed AB 566, the California Opt Me Out Act, on 8 October 2025. From 1 January 2027 it requires browsers operating in California to include a built-in, easy-to-find opt-out preference signal. A similar 2024 bill, AB 3048, was vetoed.

Is GPC Legally Binding?

Yes, in twelve US states as of 1 January 2026: California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, and Texas. Colorado was first to require recognition of a universal opt-out mechanism, from 1 July 2024. Connecticut followed on 1 January 2025 and Maryland on 1 October 2025.

Enforcement is active and coordinated. On 9 September 2025 the California Privacy Protection Agency and the attorneys general of California, Colorado, and Connecticut announced a joint investigative sweep of businesses ignoring the signal. Recent penalties show what regulators look for:

  • Disney, $2.75 million. Announced by California Attorney General Rob Bonta on 11 February 2026, the largest CCPA settlement in California history. Opt-outs failed to propagate across streaming services and devices.
  • Tractor Supply, $1.35 million. The CPPA’s largest fine when issued in September 2025. The site did not recognize opt-out preference signals until July 2024.
  • Todd Snyder, $345,178. A misconfigured consent tool left the opt-out broken for roughly 40 days and ignored GPC entirely.

GPC vs Do Not Track

GPC succeeds where Do Not Track failed because the law changed, not because the technology did.

Do Not Track Global Privacy Control
Header DNT: 1 Sec-GPC: 1
Status Abandoned. W3C working group closed 17 January 2019 W3C Privacy Working Group item since November 2024
Legal weight None. Compliance was voluntary Binding opt-out in 12 US states
Scope “Tracking”, never defined Sale, sharing, and targeted advertising

The W3C Tracking Protection Working Group spent eight years without agreeing what “tracking” meant, and the ad industry ignored the header. Mozilla removed DNT from Firefox 135 in February 2025 and pointed users to GPC instead. GPC sends nearly the same one-bit request, but with statutory consequences attached.

How to Honor GPC

  1. Read the signal server side. Check the Sec-GPC request header, or read navigator.globalPrivacyControl in the browser.
  2. Treat it as an opt-out on arrival. No banner interaction is required, and you cannot ask the user to confirm or re-consent.
  3. Suppress sale and sharing. In practice this means not firing ad-tech tags that pass identifiers to third parties.
  4. Propagate the opt-out. The Disney settlement turned on choices that stopped at one service and one device. Apply it account-wide for logged-in users, and pass it to downstream partners.
  5. Publish /.well-known/gpc.json to declare that you honor the signal.
  6. Log the signal and the action taken, so you can show what a given visitor was opted out of and when.

Most sites do this through a consent management platform rather than custom code, because the tag-blocking layer already lives there.

Aggregate campaign measurement usually continues unaffected. Counting how many clicks a channel produced is not a sale or share of personal information, so channel-level reporting such as link analytics keeps working while identity-based ad targeting stops for that visitor.

What GPC Does Not Do

Three misreadings cause most of the trouble:

  • It is not GDPR consent. GDPR and the ePrivacy Directive require prior opt-in before non-essential cookies load. An opt-out signal cannot supply the affirmative action those laws demand, and GPC is not an established mechanism for exercising rights in the EU. Cookie consent rules still apply there in full.
  • It does not stop all tracking. The state laws cover sale, sharing, and targeted advertising. First-party analytics not shared with ad partners generally sits outside the signal.
  • It does not replace the opt-out link. California still requires a “Do Not Sell or Share My Personal Information” link on sites that honor GPC.

Frequently Asked Questions

How do I turn on Global Privacy Control?

It depends on the browser. DuckDuckGo enables GPC by default, so nothing needs doing. Firefox users enable it under Settings, Privacy & Security, by ticking the option to tell websites not to sell or share data. Brave includes it in its Shields settings. On Chrome or Safari, install an extension such as Privacy Badger or OptMeowt instead.

How do I check whether a visitor sent the GPC signal?

Inspect the request headers for Sec-GPC: 1, or open the browser console and evaluate navigator.globalPrivacyControl. It returns true when the browser would send the header and false when it would not. To confirm a site advertises support, request its /.well-known/gpc.json file directly.

Does GPC apply outside the United States?

Not as a binding obligation. GPC’s legal force comes from US state privacy laws, so it carries no equivalent weight under GDPR, the UK GDPR, or Canada’s PIPEDA. Honoring it globally is still reasonable practice, and some regulators treat a clear signal as evidence of an objection to processing.

Does GPC affect Google Analytics?

Not directly. GPC is not one of the four Google Consent Mode signals, and Google tags do not read the header on their own. If you want GPC to restrict Google tags, your consent platform has to detect the signal and set the corresponding consent states, most often ad_storage and ad_user_data, to denied.

To confirm your tagged links still resolve correctly once consent and opt-out tooling sits in front of them, run them through linkutm’s UTM checker.

Back to Glossary