What Is Global Privacy Control and Is Your Website Honoring It?

Some of your visitors have already told your website they do not want their data sold or shared. They did not click anything on your site to say it. Their browser said it for them, on every request, before your page finished loading.

That signal is called Global Privacy Control, and in California and several other US states, businesses are generally expected to treat it as a valid opt-out. Most websites never check for it. Their cookie banner has no idea it exists, and their ad pixels fire as normal.

This is not a theoretical gap. California's first public enforcement settlement under its privacy law centered, in part, on a retailer failing to honor exactly this signal.

What is Global Privacy Control?

Global Privacy Control, or GPC, is a browser setting that tells every website a person visits that they do not want their personal information sold or shared. It works automatically, without the visitor needing to find or click anything on your site.

The idea is simple. Rather than hunting for an opt-out link on every site they visit, a person turns on one setting in their browser. From then on the browser attaches the signal to their activity everywhere.

Technically, GPC shows up in two places:

• As an HTTP request header, Sec-GPC: 1, sent with requests to your server
• As a JavaScript property, navigator.globalPrivacyControl, which returns true in the browser when the signal is on

Your server can read the header. Your tag manager or consent platform can read the JavaScript property. Either is enough to know the visitor has opted out.

Which browsers send the Global Privacy Control signal?

Firefox, Brave and DuckDuckGo support GPC, and it can be added to other browsers such as Chrome through privacy extensions. Chrome and Safari do not send it by default.

Brave and DuckDuckGo have it switched on by default in most configurations. Firefox offers it as a setting in its privacy preferences. Extensions such as Privacy Badger and the DuckDuckGo browser extension add it to Chrome and other Chromium browsers.

That means the share of your traffic sending GPC is not trivial, and it skews toward exactly the privacy-conscious audience most likely to notice when it is ignored. You can measure it for your own site by capturing navigator.globalPrivacyControl as a custom dimension, or by logging the Sec-GPC header on your server.

Which laws require businesses to honor Global Privacy Control?

California is the clearest case. Its regulations under the CCPA, as amended by the CPRA, require covered businesses to treat opt-out preference signals such as GPC as a valid request to opt out of the sale or sharing of personal information. Colorado also requires honoring universal opt-out mechanisms, and other states are moving in the same direction.

In California, "sharing" has a specific meaning. It covers disclosing personal information for cross-context behavioral advertising, which is the targeting of ads based on activity across different sites and services. Standard advertising pixels from Meta, TikTok, LinkedIn and Google Ads remarketing commonly fall within that definition. So a visitor sending GPC is, in most cases, asking you to stop exactly the tracking those pixels do.

The Sephora settlement in 2022, California's first public CCPA enforcement action, resulted in a $1.2 million settlement. The Attorney General's allegations centered on the company failing to disclose that it sold personal information and failing to process opt-out requests sent via GPC. It was a clear signal that GPC is treated as a real opt-out, not a courtesy.

Colorado's privacy law requires controllers to honor universal opt-out mechanisms that meet the state's standards, and GPC has been recognized for that purpose. Other states with comprehensive privacy laws, including Connecticut, Texas, Oregon, Montana and Minnesota, include opt-out rights for targeted advertising, and several recognize universal opt-out signals, with varying effective dates and details.

Whether a given law applies to your business depends on thresholds, where your customers are, and what your tags actually do. Treat this as orientation, not a legal conclusion, and confirm your obligations with privacy counsel.

What does honoring Global Privacy Control look like in practice?

When a visitor sends GPC, treat them as having opted out of the sale and sharing of their personal information, and stop or restrict the advertising tags that would sell or share it.

For most marketing stacks, that means:

Suppress or restrict advertising pixels. Meta, TikTok, LinkedIn, Pinterest, Reddit and similar tags that support cross-context behavioral advertising should not fire normally for that visitor. Some platforms offer a limited processing mode for this purpose, such as Meta's Limited Data Use option, which may be an alternative to blocking entirely depending on your counsel's view.

Restrict Google's advertising data. Google offers restricted data processing, set with the restricted_data_processing parameter on Google tags. When it is enabled, Google limits how it uses the data, and it is not used for purposes such as building remarketing audiences. For a GPC visitor, turning this on is a common approach.

Keep what is not selling or sharing. GPC is an opt-out of sale and sharing, not a blanket request to stop all analytics. First-party analytics used only by you is generally treated differently from advertising disclosures, though how your analytics is configured and who receives the data matters. This is a question to settle with counsel, not assume.

Apply it to the visitor, not just the page. If the visitor is known, for example logged in, the opt-out generally needs to be linked to their account or profile, not just the current browser session.

Do not ask them to confirm. The point of GPC is that the visitor does not have to do anything else. A popup asking them to re-confirm their opt-out defeats that purpose.

Is Global Privacy Control the same as a cookie banner?

No. A cookie banner collects a choice on your site. GPC arrives from the browser before any banner loads, and it has to be honored whether or not the visitor ever interacts with the banner.

This is where most setups fail. A typical US configuration is opt-out: tracking runs by default, and a visitor can turn it off through the banner or a "Do Not Sell or Share" link. The banner is built to listen for clicks. It is not built to check the browser.

So a visitor arrives with GPC on, never touches the banner, and every ad pixel fires because, as far as the banner knows, no one has opted out. The visitor made their choice in the most explicit way the law recognizes, and the site ignored it.

GPC also interacts with opt-in regions differently. In the EU and UK, the GDPR and ePrivacy rules generally require opt-in consent before non-essential cookies, so tracking should already be off until the visitor accepts. GPC matters most where your default is opt-out.

The two need to agree. If a GPC visitor later opens your banner, it should already show them as opted out of sale and sharing.

How do I test whether my website honors Global Privacy Control?

Visit your site with GPC turned on, open DevTools, and check whether advertising requests still go out and whether Google's requests carry restricted data processing.

Turn GPC on. Use Brave, Firefox with the GPC setting enabled, or Chrome with a privacy extension that sends the signal. If you want to test California behavior specifically and you are outside the US, use a VPN set to California, because many consent platforms apply GPC only in certain regions.

Confirm the signal is being sent. In the DevTools Console, type navigator.globalPrivacyControl. It should return true. In the Network tab, click your page's document request and check for Sec-GPC: 1 in the request headers.

Watch the ad requests. With Preserve log ticked in the Network tab, load a few pages without touching the banner. Filter for facebook.com/tr, px.ads.linkedin.com, analytics.tiktok.com and other ad platforms. If they fire normally, GPC is being ignored.

Check Google Ads requests. Filter for googleadservices, doubleclick or google.com/ccm and look for the restricted data processing parameter, often shown as rdp=1. Its absence on a GPC visit suggests Google is not being told to restrict.

Check the banner state. Open your preference center. It should reflect the opt-out without you having clicked anything.

Brave's built-in ad blocking can hide requests that would otherwise fire, so if Brave shows a clean result, confirm it in Firefox or Chrome with an extension.

How do consent platforms handle Global Privacy Control?

Most major consent platforms can detect GPC and apply an opt-out automatically, but it is often a setting that has to be enabled, and it is usually tied to specific regions.

In practice this means three things to check. First, whether GPC support is switched on at all. Second, which regions it applies to, since a platform may honor GPC for California but not for Colorado or other states. Third, what it actually does when triggered: which consent categories it turns off, and whether that reaches every tag or only those the platform directly controls.

That last point catches many sites. The platform may flip its own "sale and sharing" category to off, but if your Meta tag in GTM is not linked to that category, or the pixel is hardcoded outside the tag manager, nothing changes. The platform is honoring GPC in its dashboard while the tags ignore it. Only a network-level test reveals the difference, which is why an audit or scan of real requests is more reliable than reading the platform settings.

FAQ

What is Global Privacy Control?

Global Privacy Control is a browser signal telling websites the visitor does not want their personal information sold or shared. It is sent as the Sec-GPC: 1 request header and exposed in JavaScript as navigator.globalPrivacyControl. Firefox, Brave and DuckDuckGo support it, and extensions add it to Chrome. The visitor sets it once, and it applies to every site they visit.

Is honoring Global Privacy Control legally required?

In California, regulations under the CCPA as amended by the CPRA require covered businesses to treat opt-out preference signals such as GPC as a valid opt-out of sale and sharing. Colorado also requires honoring universal opt-out mechanisms, and other states are following. Whether it applies to you depends on thresholds and where your customers are, so confirm with privacy counsel.

Does Global Privacy Control mean I have to turn off Google Analytics?

Not necessarily. GPC is an opt-out of the sale and sharing of personal information, and first-party analytics used only by you is generally treated differently from advertising disclosures. Advertising tags, including Google Ads remarketing, are the main concern. How your analytics is configured and who receives the data matters, so confirm the treatment of analytics with privacy counsel.

How do I check if my site respects Global Privacy Control?

Visit with GPC enabled in Firefox, Brave or an extension, and confirm navigator.globalPrivacyControl returns true in the Console. Without touching the banner, load several pages and watch the Network tab for Meta, TikTok, LinkedIn and Google Ads requests. If ad pixels fire normally, or Google requests lack restricted data processing, the signal is likely being ignored.

Does my cookie banner handle Global Privacy Control automatically?

Sometimes, but rarely by default. Many consent platforms support GPC as a setting that must be switched on, often limited to specific regions such as California. Even when enabled, the platform only controls tags linked to its categories. Hardcoded pixels and tags in GTM without consent conditions can keep firing, so test real network requests rather than trusting the dashboard.