# Global Privacy Control (GPC): what it is and how to honor it

> What the Global Privacy Control signal is, where honoring it is legally required, and how to detect it with navigator.globalPrivacyControl and Sec-GPC.

Source: https://www.cookiesh.eu/blog/global-privacy-control  
Published: 2026-06-18

## Key takeaways

- Global Privacy Control is a browser signal telling websites that a person wants to opt out of the sale or sharing of their personal data.
- California's CCPA regulations require businesses that sell or share personal information to treat GPC as a valid opt-out request.
- Browsers send GPC as a Sec-GPC: 1 request header and expose it to scripts as navigator.globalPrivacyControl.
- Honoring GPC means actually stopping data flows such as ad and retargeting pixels for that browser, not just recording the signal.
- In the EU and UK, GPC does not replace the need for opt-in consent to non-essential cookies.

Global Privacy Control (GPC) is a browser setting that sends websites a simple signal: do not sell or share my personal data. Browsers transmit it as the `Sec-GPC: 1` HTTP header and expose it in JavaScript as `navigator.globalPrivacyControl`. California requires covered businesses to treat it as a valid opt-out, so honoring it means detecting the signal and stopping the relevant data flows.

## What is Global Privacy Control?

GPC is a technical specification that lets people state a privacy preference once, in their browser, instead of on every site they visit. It was developed by a coalition of privacy researchers, browser makers and publishers, and the specification is published at globalprivacycontrol.org.

When the setting is on, the browser adds a header to its HTTP requests and sets a JavaScript property that pages can read. Some browsers, such as Brave and Firefox, offer it natively, while others rely on extensions. The signal is either present or absent and carries no other information about the user.

Unlike the older Do Not Track header, which had no legal requirement behind it, GPC is backed by law in several US states. That is why it deserves engineering time.

## Is honoring GPC legally required?

In California, yes. The CCPA regulations require businesses that sell or share personal information to treat opt-out preference signals such as GPC as valid requests to opt out, and California regulators have brought enforcement actions against businesses that ignored them.

Several other US states with comprehensive privacy laws require businesses to honor universal opt-out mechanisms for targeted advertising and data sales, and some regulators have formally recognized GPC as one. Requirements and effective dates differ by state, so check each law that applies to you. For the California background, see [CCPA and CPRA: what US privacy law means for cookies](/blog/ccpa-cpra-cookies).

In the EU and UK, GPC's legal status is less settled. A missing GPC signal is never consent, so you still need opt-in consent for non-essential cookies. GDPR does contemplate people objecting by automated means, though, so treating GPC as a meaningful preference is a sensible, privacy-friendly default.

## How do I detect the GPC signal?

Check `navigator.globalPrivacyControl` in the browser and the `Sec-GPC` header on the server. Use both: the client check governs tags that load in the page, and the server check covers server-rendered decisions and server-side tagging.

In the browser, the property is `true` when the user has enabled GPC. In browsers without support it is `undefined`, so compare strictly:

```js
// Run before any marketing tags load
const gpcEnabled = navigator.globalPrivacyControl === true;

if (gpcEnabled) {
  // Treat as an opt-out of sale and sharing for this browser:
  // skip ad, retargeting and social pixels, and store the opt-out.
}
```

On the server, the browser sends `Sec-GPC: 1` with each request when GPC is on. In a Node.js app using Express:

```js
app.use((req, res, next) => {
  // Header names are case-insensitive; "1" is the only defined value
  req.gpcOptOut = req.get('Sec-GPC') === '1';
  // If responses differ by GPC and are cached, vary the cache on the header
  res.vary('Sec-GPC');
  next();
});
```

You can also publish a `/.well-known/gpc.json` file to declare that your site honors the signal, as described in the GPC specification:

```json
{
  "gpc": true,
  "lastUpdate": "2026-06-18"
}
```

## What does honoring GPC actually involve?

Honoring GPC means changing what your site does, not just reading a flag. Treat the signal as a complete opt-out of sale and sharing for that browser.

1. **Detect early.** Check the signal before any tag that sells or shares data can fire.
2. **Stop the data flows.** Suppress third-party ad, retargeting and social pixels, and update downstream controls, such as setting the advertising-related signals in [Google Consent Mode](/blog/google-consent-mode-v2-guide) to denied.
3. **Extend it to known users.** If the visitor is logged in or otherwise known to you, apply the opt-out to their account as well.
4. **Do not add friction.** Do not demand extra steps or information to confirm the opt-out. If an earlier opt-in on your site conflicts with the signal, you may explain the conflict and let the user confirm their choice.
5. **Show the result.** A short message such as "Opt-out request honored" helps users see that the signal worked.
6. **Keep records.** Log that a GPC opt-out was received and applied, alongside your other [proof of consent records](/blog/proof-of-consent-records).

For the mechanics of holding tags back, see [how to block third-party scripts until consent](/blog/block-scripts-until-consent). The same blocking layer can enforce a GPC opt-out.

## How does GPC compare with other privacy signals?

GPC is narrower than a consent banner but carries more legal weight than older browser signals. This table shows where it fits.

| Signal | What it communicates | Legal weight |
| --- | --- | --- |
| Global Privacy Control | Do not sell or share my data | Binding opt-out under California law and some other US state laws |
| Do Not Track | Do not track me | No legal requirement to honor it; now deprecated |
| Cookie banner choice | Granular consent per purpose | Needed for valid opt-in consent in the EU and UK |

## Bottom line

GPC turns a privacy preference into a machine-readable signal, and in California and a growing number of other states, ignoring it is a compliance failure. Detect it on both client and server, stop the data flows it covers, log what you did and keep your EU consent flow separate. Tools like Cookiesh include GPC support, so the signal is handled alongside the rest of your consent setup.

*This article is general information, not legal advice. For decisions about your specific situation, consult a qualified privacy professional.*

## FAQ

### Does GPC replace a cookie banner?

No. GPC carries one message, an opt-out of sale and sharing, so you still need a way to collect EU-style consent and offer other choices. It does mean California visitors with GPC enabled should not have to opt out again by hand.

### Which browsers support GPC?

Support varies and changes over time. Some browsers, such as Brave and Firefox, offer GPC natively, and others support it through privacy extensions. The Global Privacy Control website keeps a current list.

### What if a GPC user previously opted in to sale or sharing on my site?

California's regulations let a business tell the consumer about the conflict and offer them the chance to keep their earlier choice. Until they confirm, process the GPC signal as an opt-out.

### Should I honor GPC for visitors outside California?

Several other US states require businesses to honor universal opt-out signals, and applying GPC everywhere is often simpler than geo-targeting it. Elsewhere it is a reasonable, user-friendly default even where no law requires it.

## Sources

- [Global Privacy Control](https://globalprivacycontrol.org/)
- [California Consumer Privacy Act (CCPA), California Attorney General](https://oag.ca.gov/privacy/ccpa)
- [California Privacy Protection Agency](https://cppa.ca.gov/)