Global Privacy Control (GPC)
Also known as: GPC, Sec-GPC, universal opt-out mechanism, browser privacy signal
Global Privacy Control (GPC) is a setting in some browsers and extensions that automatically tells every website you visit that you don't want your personal data sold or shared.
While earlier 'Do Not Track' signals were widely ignored, GPC has legal teeth: California and several other states require businesses to treat it as a valid opt-out request.
Global Privacy Control (GPC), explained at three levels
At home
Think of Global Privacy Control as a 'no solicitors' sign on your front door that every website can see. Instead of clicking 'Do Not Sell or Share' on each site, you switch GPC on once in your browser, and it sends that request automatically to every site you visit. In several US states, businesses are legally required to obey the sign.
At work
Global Privacy Control is a technical signal, sent by a browser or extension, that tells a website the visitor opts out of the sale or sharing of their personal data. California, Colorado, and several other states treat it as a valid opt-out request. Businesses care because covered sites must detect the signal and act on it automatically, without the visitor clicking anything.
At home
GPC works through settings in browsers like Brave and DuckDuckGo, where it is on by default, and Firefox, where you can switch it on, plus privacy extensions for other browsers. Once it's on, every page request carries the signal. Its legal force depends on where you live: it binds businesses in US states that require universal opt-outs, while elsewhere sites may honour it voluntarily.
At work
Technically, GPC has two parts. The browser adds an HTTP header, 'Sec-GPC: 1', to each request, and exposes a JavaScript property, navigator.globalPrivacyControl, that page scripts can read. A business's server or consent management platform checks for either, then treats the visitor as opted out of sale, sharing, and targeted advertising by suppressing ad tags and flagging the session. Where the visitor is logged in, many laws expect the opt-out to apply to the account too.
At home
GPC is the leading example of a 'universal opt-out mechanism,' a concept written into several US state laws. Instead of each site designing its own opt-out link, the law makes a browser-level signal binding. California has gone further, passing a law that requires browsers to offer an opt-out preference signal setting from 2027. In my view, this shifts the burden from you to businesses: you state your preference once and the law makes companies listen.
At work
Implementation questions include tying GPC to logged-in accounts, resolving conflicts with earlier consent, and passing the opt-out to ad partners through frameworks like IAB Tech Lab's Global Privacy Platform. Enforcement has focused on companies that ignored the signal or kept sharing data with ad tech vendors, starting with California's Sephora settlement in 2022. Testing the full data flow, not just the banner, shows whether the signal actually stops data from leaving.
Real-world examples
At home
Aisha, who lives in Los Angeles, turned on GPC in her browser. When she visited an online retailer, the site detected the signal and showed a message confirming her opt-out from data sharing, without her clicking anything.
At work
Marcus is a web developer at a Canadian e-commerce company with US customers. After his compliance team flagged GPC requirements, he updated the site to detect the signal and suppress advertising tags for visitors who sent it.
How it compares
| feature | Global Privacy Control (GPC) | Do Not Track (DNT) |
|---|---|---|
| Legal weight | Recognized as a valid opt-out in California, Colorado, and other states | No legal requirement to honour it |
| Launched | 2020 | Around 2009 to 2010 |
| What it signals | Opt out of sale or sharing of personal data | A general request not to be tracked |
| Adoption by sites | Growing, driven by law | Largely ignored and widely abandoned |
| Browser support | Brave, DuckDuckGo, Firefox, extensions | Some browsers removed it |
GPC succeeded where Do Not Track failed because laws made it binding.
For analysts
Honouring GPC is a low-cost, high-visibility compliance win. I'd test it end to end, confirming that the signal actually stops data reaching ad partners, because regulators have shown they check the plumbing, not just the policy.
History & origin
GPC was launched in October 2020 by a coalition of privacy researchers, publishers, and browser makers, partly in response to the failure of Do Not Track, which websites had been free to ignore. California's attorney general quickly recognized GPC as a valid opt-out under the CCPA, and the 2022 settlement with Sephora specifically cited the company's failure to honour it. Colorado named GPC as a recognized universal opt-out mechanism for its privacy law in 2024, and other states followed with similar requirements. Brave and DuckDuckGo support it natively, and Firefox added a built-in setting. In October 2025, California passed a law requiring browsers to offer an opt-out preference signal setting from 2027. In my opinion, GPC is the most practical privacy tool most people have never heard of.