Global Privacy Control (GPC) is a setting a visitor turns on in their browser to tell every website they visit not to sell or share their personal data. The browser sends it automatically, so the visitor does not have to find an opt-out link on each site. For a website owner, it works like a standing opt-out request, and in several US states you have to treat it as one.

GPC matters most if you run ad pixels or analytics tied to advertising, because those are the tools the signal targets. This guide explains how the signal works, where the law requires you to honor it, and how to check that your site does, as part of wider consent management across countries.

GPC is a specification, currently a W3C Working Draft, that defines how a browser tells a site about the visitor's privacy preference. It has two parts:

• An HTTP header called Sec-GPC, sent with every request, with the value 1 when the setting is on.
• A JavaScript property, navigator.globalPrivacyControl, which is true when the signal is on, so scripts on your page can read it.

Both come from the W3C specification at w3.org/TR/gpc. The visitor does not need to do anything on your site. Some browsers support it natively: globalprivacycontrol.org lists Firefox (as a setting), Brave and DuckDuckGo (on by default), plus extensions such as Privacy Badger.

That last point is why GPC is hard to ignore. A visitor on Brave or DuckDuckGo sends it without having chosen anything, so a site that does not read it misses opt-outs it was legally required to respect.

The answer depends on where your visitors live. Today the clearest obligations are in the US. Rules change often, so treat this as a starting point and confirm with your lawyer.

The California Attorney General says a global privacy control must be honored by covered businesses as a valid request to stop the sale or sharing of personal information. The California Attorney General's CCPA page also names GPC and says it is available in browsers like Firefox, DuckDuckGo and Brave, or as a browser extension.

The CCPA regulations back this up. Section 7025 says a business that sells or shares personal information must process an opt-out preference signal that meets the requirements as a valid opt-out request. The text does not name a specific signal, but the Attorney General's guidance does.

Enforcement has been real. In August 2022 the Attorney General announced a settlement with Sephora, with US$1.2 million in penalties. The settlement required Sephora to provide ways to opt out of the sale of personal information, including via the Global Privacy Control. For the wider California picture, see our guide to California's CCPA and cookies.

Colorado's Attorney General states that controllers must accept opt-out requests sent through universal opt-out mechanisms from July 1, 2024. Connecticut's Attorney General states that, starting January 1, 2025, controllers subject to the Connecticut Data Privacy Act must honor opt-out preference signals, and its page names Global Privacy Control as an example. Read more in our guides to Colorado's CPA and Connecticut's CTDPA.

Texas works differently. Its law lets a consumer name an authorized agent to opt out for them, using a technology that can include an internet browser setting or extension, or a global setting on a device. The business has to comply when it can verify the consumer and the agent's authority, and there are exceptions. So in Texas the signal is not a blanket GPC rule, and you should check your situation. Our guide to Texas's TDPSA has more.

We found no EU regulator guidance that requires websites to honor GPC. The GPC site itself says the signal supports rights under articles 7 and 21 of the GDPR, but that is the project's own claim.

The European Commission's Digital Omnibus proposal of 19 November 2025 would add a new article 88b to the GDPR on machine-readable signals of individual choices. It is a proposal, not law, and it does not name GPC. In Europe, the consent you collect in the banner remains the main control. Our guide to GDPR and cookies covers it.

See how AdOpt connects consent to your tags if you serve visitors in more than one of these places.

Honoring GPC means that, when the signal is on, your site stops selling or sharing that visitor's data. For most sites that means one thing: ad and cross-site tracking tags must not fire, or must run in a restricted mode, for that visitor.

A CMP does this for you when it reads the signal. For the curious, the idea looks like this:

// Illustration only: a CMP does this for you
if (navigator.globalPrivacyControl === true) {
  gtag('consent', 'update', {
    ad_storage: 'denied',
    ad_user_data: 'denied',
    ad_personalization: 'denied'
  });
}

This denies the Google consent types tied to advertising. Whether you also restrict analytics depends on how you use it and on the law that applies to the visitor. The same idea applies to the Meta pixel and any other ad tag. See passing the choice to Meta and GA4 cookie consent for the tool-specific steps.

The signal is one way to opt out, not the only one. California expects a clearly visible link, usually titled "Do Not Sell or Share My Personal Information", for visitors who do not use GPC. Keep both, and make sure they trigger the same result in your tags.

Browsers send GPC from anywhere, including from countries where the law does not require you to honor it. You can honor it for everyone, which is the simplest setup, or only where required. Honoring it for everyone is easier to explain and test. Decide with your lawyer, and write the decision down in the decision log we describe in our consent management guide.

The banner and GPC do different jobs, and a good setup uses both. The banner is a conversation: you ask, the visitor answers, and you record the answer. GPC is a standing instruction that arrives before the visitor sees anything.

The Sec-GPC header travels with the browser's requests, so your server can see it on the very first page load. A script can read navigator.globalPrivacyControl as soon as it runs. That order matters: the earlier your CMP reads the signal, the less likely an ad tag fires before the opt-out is applied.

The signal is a single value: 1. It does not identify the visitor and it carries no reasons or details. That is a feature. You can apply it without collecting anything new, and you do not need to ask the visitor to confirm. What you do with it, and for which tags, is the part you have to decide and write down.

A written rule keeps the setup alive when people change roles. A starting point you can adapt with your lawyer:

"When a visitor's browser sends Global Privacy Control, we treat it as an opt-out of sale and sharing of personal information for that visitor. Ad and cross-site tracking tags do not run, or run in their restricted mode, from the first page. We test this after every change to our tags and record the result."

Add who owns the test, how often it runs and where the evidence lives. Three lines, kept current, are better than a long document nobody opens.

Other states have similar rules. We list only the ones we could confirm in an official source, so check the laws that cover your visitors before you rely on this table.

Reading the signal is simple. Applying it everywhere is where sites slip:

• Checking GPC only after the first page has loaded, when ad tags have already fired.
• Honoring it for the banner but not for tags loaded outside the tag manager.
• Checking the signal once, on the first page, and not on later page views.
• Forgetting server-side events, which keep sending data the browser tag no longer sends.
• Not telling anyone what it does, so the next person to edit the setup removes it.

A short owner and a short test, repeated every time someone adds a tool, prevent most of these. If you manage several markets, the decision log in our consent management guide is a good place to record it.

You do not need special tools, only a browser that sends the signal. Follow these steps:

1. Turn on GPC in a browser that supports it, such as Firefox (in settings) or Brave.
2. Open your site in a clean window, without clicking anything in the banner.
3. Open the browser's developer tools and check the network tab for requests to ad platforms such as Google Ads and Meta.
4. Check the console: navigator.globalPrivacyControl should return true.
5. Compare with a browser that does not send GPC. Requests should differ.
6. Save a screenshot and the date as evidence.

If ad requests still fire with GPC on, the signal is not wired to your tags. Start with any tags loaded outside your tag manager, which are the usual cause. Sorting your tags by purpose helps you find them.

When you evaluate a CMP, ask whether it reads browser signals such as GPC and whether it passes the result to your tags. Our guide on how to choose a CMP lists the questions worth asking. Compare AdOpt's plans and check how consent reaches your tags.

• California's DSAR privacy portal
• How a cookie banner works

In California, yes: the Attorney General says covered businesses must honor it as a valid request to stop sale or sharing. Colorado and Connecticut require honoring opt-out signals, and Texas has an authorized-agent rule with exceptions. We found no EU regulator guidance requiring it. Always confirm which laws cover your visitors.

There are two ways. On the server, look for the Sec-GPC request header with the value 1. In the browser, a script can read navigator.globalPrivacyControl, which is true when the signal is on. A CMP that supports GPC reads one of these for you and applies the opt-out to your tags.

No. GPC is an opt-out of sale or sharing. It does not ask you to turn off cookies that keep your site working, such as a login session or a shopping cart. It targets advertising and cross-context tracking. Which analytics tools are affected depends on how they are configured and on the rules that apply.

Not necessarily. The clear obligations today are in US states, and we found no EU regulator guidance that requires it. Many sites honor it for every visitor because that is simpler to run and to explain. If you choose that route, record the decision and test it regularly.