Global Privacy Control,
honoured and provable.

Global Privacy Control is a simple signal that a person's browser sends to every website they visit, meaning: do not sell or share my personal information. It was launched in 2020 by a group of browser makers, publishers and privacy researchers, and in November 2024 it became a work item of the W3C Privacy Working Group, where it is being standardised. Unlike its predecessor, Do Not Track, it has legal force: several US privacy laws require businesses to treat it as an opt-out.

• HTTP header. With GPC on, the browser adds Sec-GPC: 1 to every request.
• JavaScript. Scripts can read navigator.globalPrivacyControl, which is true when the header would be sent.
• Site declaration. A site can publish /.well-known/gpc.json with {"gpc": true, "lastUpdate": "2026-10-06"} to state that it honours the signal.

Brave and DuckDuckGo send GPC by default, Firefox offers it as a setting, and extensions such as Privacy Badger add it to other browsers. From 1 January 2027, California requires every browser maker to offer a setting that sends an opt-out preference signal (Civil Code 1798.136), so the number of visitors sending it will rise.

California's regulations (11 CCR 7025) set the most detailed rules, and they are a safe standard everywhere:

• Treat it as an opt-out of sale and sharing for that browser or device and any profile linked to it, including pseudonymous ones, and for the consumer if you know who they are.
• Ask for nothing more. You cannot require a login, form or extra click to make it effective.
• It wins over a stored setting. If the signal conflicts with an earlier choice to allow sale, you process the opt-out, though you may ask the person whether they want to make an exception.
• Silence is not consent. If a known consumer stops sending the signal, that does not opt them back in.
• Show it. Since 1 January 2026 you must display whether you processed the signal, for example "Opt-Out Request Honored".

GPC does not require you to block essential cookies or first-party analytics that is not a sale or share. It is an opt-out from selling, sharing and targeted advertising, not an EU-style opt-in banner.

1. Read the signal early, on the server from the Sec-GPC header and in the browser from navigator.globalPrivacyControl, before any advertising tag loads.
2. Gate every advertising tag on it: pixels, retargeting, ad SDKs and anything your tag manager fires. Set Google Consent Mode's advertising signals to denied for those visitors.
3. Cover server-side flows, such as conversion APIs and data exports to ad platforms, which a browser-only fix misses.
4. Record the opt-out with a timestamp and the fact that GPC triggered it, so you can prove it later.
5. Link it to the account when a person logs in, and apply the opt-out to offline sharing you can tie to them.
6. Display the status and update your privacy policy to say you honour GPC.
7. Tell your vendors. Pass the opt-out to processors and partners that receive the data.

Yes. California's first public CCPA settlement, in 2022, turned partly on a retailer's failure to process GPC. On 9 September 2025 the Attorneys General of California, Colorado and Connecticut announced a joint investigative sweep, contacting businesses that appeared not to be honouring the signal. The pattern is clear: regulators can test GPC from their own browsers, so it is one of the easiest violations to find.

The consent platform reads the Sec-GPC header on the server before the banner renders. For US visitors, a browser sending GPC is recorded as an opt-out of advertising without any click, and the entry in the tamper-evident consent ledger notes that GPC was the reason. Scripts that would load advertising are blocked, Google Consent Mode v2 receives the denied state, and withdrawals are relayed to processors' webhooks with each delivery logged. See the consent product. Server-side flows you run outside the banner still need your own check.