Global Privacy Control (GPC): what it is and how to honor it
Global Privacy Control is a browser signal that tells a website “do not sell or share my personal information”. A growing number of US state privacy laws require or recognise universal opt-out signals such as GPC, and in many of those states a manual opt-out link alone is not enough.
This page explains what the signal is, where honoring it is required by law, which browsers send it, how to check your own, and what CookieHub does when a visitor arrives with it switched on.
What Global Privacy Control is
GPC is a single yes-or-no signal. When a visitor turns it on, their browser adds a Sec-GPC: 1 header to supported requests and sets navigator.globalPrivacyControl to true in JavaScript.
The preference itself is binary and means “do not sell or share my personal information”.
It carries nothing else. It does not say which law applies to the visitor, which vendors they object to, or whether they consent to analytics. It is not a consent string like the IAB TCF or GPP formats. It is a preference that the site must handle in accordance with applicable law.
GPC was developed by a group of browser makers, publishers and privacy organisations, building on Do Not Track.
The main difference is legal weight. Do Not Track never acquired comparable legal standing and was largely ignored by websites. GPC, by contrast, was designed to fit, among other things, the opt-out mechanisms of the California Consumer Privacy Act as amended by the CPRA, and it is now recognised by several US privacy laws.
Where honoring GPC is required by law
The legal force of GPC in the United States depends on each state’s laws.
Twelve states currently have GPC or universal opt-out provisions in their privacy laws:
Delaware
Maryland
Minnesota
Montana
Nebraska
New Hampshire
New Jersey
Oregon
Texas
The obligations are not identical.
Colorado formally recognises GPC as a valid universal opt-out mechanism, and New Jersey requires covered controllers to honor universal opt-out mechanisms.
Maryland works differently. A controller can satisfy certain opt-out obligations using either a conspicuous opt-out link or an opt-out preference signal.
More states are following. Louisiana’s law, effective January 1, 2027, includes browser- and device-based opt-out provisions with its own conditions, while Vermont’s Act 145 adds an opt-out preference signal requirement from 2028.
California has enforced GPC for several years. In 2022, Sephora reached a USD 1.2 million settlement with the California Attorney General in a case that involved, among other things, failing to process GPC signals.
Where the law requires it, honoring GPC means treating the signal itself as the visitor’s opt-out request. A “Do Not Sell or Share” link that the visitor has to find and click will generally not satisfy that requirement on its own.
What about the GDPR?
GPC does not replace consent required under the GDPR or ePrivacy rules.
European regulators have not formally recognised GPC as a universal substitute for cookie consent. Websites in the EU and UK therefore still need an appropriate opt-in mechanism before using non-essential tracking technologies.
GPC may nevertheless be relevant in some circumstances as an expression of a user’s objection or withdrawal of consent.
Which browsers send GPC
Support varies significantly between browsers:
Brave:
GPC is enabled by default on desktop and Android. On iOS, Brave exposes the JavaScript signal but does not currently send the HTTP header.
DuckDuckGo:
Its browsers and browser extension enable GPC by default.
Firefox:
Built in and available under Privacy & Security. It is enabled automatically in Private Browsing.
Chrome and Edge:
No native GPC support in current stable releases. Compatible extensions can add it, so most Chrome and Edge traffic will not carry the signal.
Safari:
No native GPC support in the current stable release.
How to check whether GPC is on in your browser
You can check whether your browser exposes or sends GPC in a few seconds:
Open the developer console:
On any page, open your browser’s developer tools, switch to the Console tab and type navigator.globalPrivacyControl. If it prints true, your browser exposes GPC. If it prints false or undefined, it does not.
Or visit globalprivacycontrol.org:
The GPC project’s own site detects the signal and tells you whether your browser is sending it.
Then turn it on, if you want it:
In Firefox, look under Privacy & Security for the option to tell websites not to sell or share your data. In Brave and DuckDuckGo it is already on. In Chrome or Edge, install a compatible extension. Safari does not currently offer native support.
To test your own website:
Turn GPC on, clear your cookies, and load your site as a visitor from California. You should not be required to make a second opt-out request, and your advertising and marketing setup should respect the opt-out. Depending on your setup, that can mean preventing relevant tags from firing or putting supported vendors into their applicable opt-out or restricted-processing mode.
What honoring GPC means for your website
The details vary by state, and California’s regulations are among the most specific.
When a visitor arrives with GPC on, your site should:
Treat it as an opt-out of sale and sharing:
For that visitor, processing that constitutes sale, sharing or targeted advertising under the applicable law must stop or operate in the relevant opt-out or restricted mode. Depending on your setup, that may mean blocking advertising cookies and pixels entirely or passing the opt-out state downstream so vendors restrict their processing.
Not require a second opt-out request:
The browser signal itself must be processed as the visitor’s request. You should not require them to click another “Do Not Sell or Share” button or provide additional information before honoring it.
Confirm that the signal was honored:
California’s regulations require covered businesses to display whether an opt-out preference signal has been processed as a valid request to opt out of sale or sharing.
Pass the opt-out downstream:
Your advertising, analytics and other relevant vendors need to receive the appropriate signal. The IAB GPP string carries a GPC flag together with sale and sharing opt-out information for this purpose. Some vendors also act directly on the signal. Google, for example, applies restricted data processing when it receives GPC from visitors in several applicable US states.
Not require an account or extra steps:
Honoring GPC cannot depend on the visitor logging in, verifying their identity or filling in a form. It applies to the browsing session as it arrives.
Take earlier preferences into account:
If a visitor previously allowed sale or sharing on your site and later arrives with GPC enabled, California’s regulations allow you to notify them of the conflict and offer them the opportunity to consent specifically. The choice must remain theirs and must not result from a pre-ticked box or dark pattern.
Compliance Checker
Use our free compliance scanner to detect all active services on your website. Receive a detailed report outlining their types, purposes, and durations to support your privacy compliance efforts.
How CookieHub handles GPC
GPC support is built into the CookieHub widget and is always on. There is nothing to enable:
Detected automatically
The widget reads the GPC signal when the page loads, in every region. No configuration, extra script or per-region switch is required.
Treated as Do Not Sell or Share
A visitor sending GPC gets the same sale-and-sharing opt-out as someone who clicked your “Do Not Sell or Share My Personal Information” link. The opt-out is exposed to Google Tag Manager so your tags can respond to it. Where the region uses the IAB GPP or US Privacy frameworks, the opt-out and GPC flag are written into the strings your vendors read.
No standard opt-out banner for California
CookieHub processes the signal automatically without asking a California visitor to make another opt-out request. Instead of the standard banner, the privacy settings show that the signal was honored.
Other US states keep their configured banner
Visitors from other states continue to see the banner you have configured, with the GPC opt-out already applied.
Optionally switch off cookie categories
If you want GPC to do more than signal vendors, configure the preference center so that an opt-out also disables selected cookie categories such as Marketing or Analytics.
Honor GPC without building anything
Add the CookieHub script and the signal is handled automatically: the opt-out is applied, vendors are informed through the GPP string and Google Tag Manager, and California visitors see the confirmation required by the regulations.
One setup across the supported states. Free for small websites.
Frequently asked questions about Global Privacy Control
GPC stands for Global Privacy Control.
It is a browser setting that sends websites a signal meaning “do not sell or share my personal information”.
Businesses covered by US state privacy laws containing opt-out preference signal provisions generally need to process that signal in accordance with the applicable law, without requiring the visitor to find an additional opt-out link or fill in a form.
Both are signals sent by the browser, but their legal weight is very different.
Do Not Track never obtained comparable legal recognition and was largely ignored by websites.
GPC was designed to fit, among other things, the opt-out provisions of the CCPA/CPRA, and it is now recognised or required under the privacy laws of a growing number of US states.
For many businesses covered by these laws, yes.
Twelve states currently have GPC or universal opt-out provisions: California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon and Texas.
Louisiana follows in 2027 and Vermont in 2028.
The details differ. Most require or recognise processing universal opt-out signals, while Maryland also allows certain obligations to be met with a conspicuous opt-out link.
Each law has its own criteria for determining which businesses are covered.
Not as a substitute for consent.
European regulators have not formally recognised GPC as a replacement for cookie consent. In the EU and UK, you therefore still need an appropriate opt-in mechanism before using non-essential tracking technologies.
The W3C specification indicates that GPC may nevertheless be relevant under the GDPR as an expression of a user’s objection or withdrawal of consent. European regulators have not yet established a general legal effect for GPC in that context.
It depends on how the analytics data is used.
Analytics that involves sale, sharing, cross-context behavioural advertising, or a provider using the data for its own advertising purposes may be affected by GPC.
First-party measurement that does not involve those activities may fall outside the GPC opt-out, depending on the applicable state law and your vendor setup.
If you want a cleaner rule, you can also configure CookieHub to disable the Analytics category for visitors sending GPC.
You do not need to.
GPC detection is always on.
A visitor sending the signal is treated as if they had clicked the “Do Not Sell or Share” link. The opt-out is exposed to Google Tag Manager, and where the region uses IAB GPP or US Privacy, the relevant opt-out state is passed to supported vendors.
If you also want the signal to disable specific cookie categories, open the region’s preference center settings in the Dashboard and select the categories to switch off on opt-out.
Turn GPC on in your browser, clear your cookies for the site, and visit it as a California visitor, using a VPN if necessary.
You should not be required to make another opt-out request. The privacy settings should confirm that the signal was honored, and your advertising setup should respect the opt-out, either by preventing relevant tags from firing or by putting supported vendors into their applicable opt-out or restricted-processing mode.
If you use IAB GPP, check the string through the gpp API. The GPC flag and applicable sale and sharing opt-outs should be set.
California’s regulations require covered businesses to display whether they have processed an opt-out preference signal as a valid request to opt out of sale or sharing.
“Opt-out preference signal honored” tells the visitor that the site’s privacy mechanism has recognised and processed the preference sent by their browser.
CookieHub displays this automatically to California visitors in the privacy settings.
