What is Global Privacy Control, and do I have to honor it?

The short version

• GPC is a setting in some browsers and extensions. When it’s on, the browser tells each site “don’t sell or share my data.”
• California says covered businesses must honor it. Colorado has recognized it since July 1, 2024, and Connecticut since January 1, 2025.
• It only matters legally if a state law covers your business and your site sells or shares data, which can include ad pixels and retargeting.
• Honoring it means switching off sale and sharing for that visitor automatically, without making them click anything.
• It isn’t the same as the older Do Not Track signal. California only asks sites to disclose how they respond to Do Not Track.

This isn’t legal advice.

How does GPC work?

The GPC website describes it as a setting or extension that sends a signal to the sites you visit. Brave and DuckDuckGo turn it on by default, Firefox offers it in settings, and several privacy extensions add it to other browsers.

Technically, the W3C draft specification defines two ways a site can see it:

• an HTTP request header, Sec-GPC: 1, sent with each page request;
• a JavaScript value, navigator.globalPrivacyControl, that reads true when the setting is on.

GPC was first proposed in 2020 and became a work item of the W3C Privacy Working Group in November 2024, according to the GPC site.

Do I have to honor it?

Only if a state privacy law covers your business. Check which US state privacy laws apply first.

Other states with similar laws have their own rules on opt-out signals. Check each one you serve.

How do I set my site up to respect it?

1. Find out what “selling or sharing” your site does. Usually that means ad pixels, retargeting tags or data passed to ad networks. Analytics used only for your own reporting is a different question.
2. Pick a consent or privacy tool that reads GPC. Many consent platforms detect the signal and switch off the matching categories. Check the vendor’s documentation for “Global Privacy Control” support.
3. Make the opt-out automatic. A visitor with GPC on shouldn’t have to click “Do Not Sell or Share.” The signal is the request.
4. Test it. Turn on GPC in Firefox’s privacy settings, or use Brave, then visit your site in a fresh window and check that ad tags don’t load.
5. Say so in your privacy policy. Explain how your site responds to GPC. California’s privacy policy law also expects you to say how you respond to Do Not Track and similar signals, per the Attorney General’s guide.

If you also use Google Consent Mode, the opt-out should set the advertising consent types to denied for that visitor.

Why does it matter?

GPC turns a one-off opt-out into a standing one. A person who sets it once is opted out everywhere they browse. For a covered business in California, the Attorney General calls it “a valid consumer request,” so ignoring it means ignoring requests the law says you must act on.

What are the common mistakes?

• Treating it as optional “nice to have” when a state law covers you.
• Reading the signal but leaving the pixel running. The tag itself has to stop.
• Asking GPC users to confirm. The signal is enough.
• Confusing GPC with Do Not Track. California’s older privacy policy law only asks you to say how you respond to Do Not Track. GPC is the signal California says covered businesses must honor.
• Forgetting server-side tags. If data goes to ad platforms from your server, that needs to respect the opt-out too.

What if it isn’t working?

• Check that the browser is sending it. Some extensions only send it on certain sites. Try Firefox with the setting on.
• Check your consent tool’s settings. GPC support is often a switch you have to turn on.
• Look for hard-coded tags. A pixel pasted into the theme won’t listen to the consent tool. Move it into the tool or a tag manager.

How much does it cost, and how long does it take?

The signal itself is free. If your consent tool supports it, turning it on and testing takes under an hour. Moving hard-coded tags into a tag manager takes longer.

How does E-3 handle this?

As part of website care, we can find every ad tag on your site, move them under your consent tool, switch on GPC handling where the tool supports it, and test it with a GPC-enabled browser. You decide whether the change goes ahead. Whether you’re legally required to honor it is a question for your adviser.

Related questions

• Which US state privacy laws apply to a small business?
• What is Google Consent Mode v2?
• Do I need cookie consent on my website?
• How do I handle a data request?
• Back to the complete privacy and cookies guide

Sources

1. Global Privacy Control (globalprivacycontrol.org)
2. Global Privacy Control specification (W3C Privacy Working Group)
3. California Consumer Privacy Act (CCPA) (California Attorney General)
4. Universal opt-out and the Colorado Privacy Act (Colorado Attorney General)
5. The Connecticut Data Privacy Act (Connecticut Attorney General)
6. Attorney General issues guide on privacy policies and Do Not Track disclosures (California Attorney General)