Global Privacy Control (GPC)
Also known as: GPC, Sec-GPC, universal opt-out mechanism, browser privacy signal
Global Privacy Control (GPC) is a setting in some browsers and extensions that automatically tells every website you visit that you don't want your personal data sold or shared.
While earlier 'Do Not Track' signals were widely ignored, GPC has legal teeth: California and several other states require businesses to treat it as a valid opt-out request.
Global Privacy Control (GPC), explained at three levels
At home
Instead of clicking 'Do Not Sell My Info' on every website, you can turn on Global Privacy Control once in your browser. It sends the same request automatically to every site you visit.
At work
If your business is covered by laws like California's CCPA, you must honour GPC signals as opt-out requests. That means detecting the signal and stopping the sale or sharing of that visitor's data.
At home
GPC works in browsers like Brave, DuckDuckGo, and Firefox (in its settings), and through some privacy extensions. It's most useful in US states with laws requiring businesses to honour it. Elsewhere, sites may respect it voluntarily, but they aren't always required to.
At work
Technically, GPC sends an HTTP header (Sec-GPC: 1) and exposes a JavaScript property that websites can read. Businesses should configure their consent management platform and tags to treat the signal as an opt-out of sale, sharing, and targeted advertising, and to link it to known users where possible.
At home
GPC is a 'universal opt-out mechanism,' a concept now written into several US state laws. In my view, it shifts the burden from you to businesses: rather than hunting for opt-out links, you state your preference once and the law makes companies listen.
At work
Implementation questions include applying GPC to logged-in accounts (some states require linking the signal to the user's profile), handling conflicts with prior consent, and passing signals to ad partners. Enforcement actions have focused on companies that ignored GPC or failed to stop sharing with ad tech vendors, so testing the full data flow, not just the banner, is essential.
Real-world examples
At home
Aisha, who lives in Los Angeles, turned on GPC in her browser. When she visited an online retailer, the site detected the signal and showed a message confirming her opt-out from data sharing, without her clicking anything.
At work
Marcus is a web developer at a Canadian e-commerce company with US customers. After his compliance team flagged GPC requirements, he updated the site to detect the signal and suppress advertising tags for visitors who sent it.
How it compares
| feature | Global Privacy Control (GPC) | Do Not Track (DNT) |
|---|---|---|
| Legal weight | Recognized as a valid opt-out in California, Colorado, and other states | No legal requirement to honour it |
| Launched | 2020 | Around 2009 to 2010 |
| What it signals | Opt out of sale or sharing of personal data | A general request not to be tracked |
| Adoption by sites | Growing, driven by law | Largely ignored and widely abandoned |
| Browser support | Brave, DuckDuckGo, Firefox, extensions | Some browsers removed it |
GPC succeeded where Do Not Track failed because laws made it binding.
For analysts
Honouring GPC is a low-cost, high-visibility compliance win. I'd test it end to end, confirming that the signal actually stops data reaching ad partners, because regulators have shown they check the plumbing, not just the policy.
History & origin
GPC was launched in October 2020 by a coalition of privacy researchers, publishers, and browser makers, partly in response to the failure of Do Not Track, which websites had been free to ignore. California's attorney general quickly recognized GPC as a valid opt-out under the CCPA, and the 2022 settlement with Sephora specifically cited the company's failure to honour it. Colorado named GPC as a recognized universal opt-out mechanism for its privacy law in 2024, and other states followed with similar requirements. Brave and DuckDuckGo support it natively, and Firefox added a built-in setting. In my opinion, GPC is the most practical privacy tool most people have never heard of.