Consent & Cookies
What is Global Privacy Control (GPC)?
Global Privacy Control (GPC) is a browser signal that automatically tells every website a user visits that they opt out of the sale and sharing of their personal information — a signal businesses are legally required to honor under the CCPA/CPRA in California and under a growing set of state privacy laws.
GPC exists to fix the scale problem with opt-out rights: a consumer cannot realistically click 'Do Not Sell or Share' on every site they visit. Instead, the user enables GPC once — in browsers like Firefox and Brave that support it natively, or via extensions — and the browser sends the preference with every request, as an HTTP header (Sec-GPC: 1) and a JavaScript property (navigator.globalPrivacyControl).
The legal force is what distinguishes GPC from its failed predecessor, Do Not Track. California regulations require businesses to treat GPC as a valid opt-out of sale and sharing, and the state's first public CCPA enforcement action — the $1.2 million Sephora settlement in August 2022 — turned specifically on failing to process GPC signals while third-party trackers on the site amounted to a 'sale' of data. Colorado likewise mandates honoring universal opt-out mechanisms and lists GPC as an approved signal, and several other state laws include similar requirements.
Honoring GPC is an engineering task, not a policy statement. The site must detect the header or JavaScript property on arrival and immediately suppress the data flows that constitute selling or sharing — advertising pixels, audience syncs, server-side event forwarding to ad platforms — for that visitor, without requiring any click. If the visitor is a known customer, the opt-out should also propagate to their profile so downstream syncs respect it.
GPC does not replace the Do Not Sell or Share link (both are required in California), and it is not an EU consent mechanism — it expresses a US-style opt-out, not ePrivacy opt-in.
Why it matters for eCommerce
A meaningful slice of privacy-conscious shoppers now browse with GPC enabled, and testing for GPC handling is a standard step in both regulator sweeps and plaintiff-firm scans. For a store, honoring it means the shopper's session sends no data to ad platforms — pixels and Conversions API alike. If your stack has no code path that reads Sec-GPC, you are not compliant in California.
Frequently asked questions
- Is honoring GPC legally required?
- In California, yes — CCPA/CPRA regulations require treating GPC as a valid opt-out of sale and sharing, and the Sephora settlement enforced exactly that. Colorado requires honoring approved universal opt-out mechanisms including GPC, and other state laws have followed the pattern.
- How is GPC different from Do Not Track?
- Technically they are similar signals; legally they are different worlds. DNT never acquired binding force and was widely ignored. GPC is written into state regulations as a mandatory opt-out, with real enforcement behind it.
- How do I test whether my site honors GPC?
- Visit with a GPC-enabled browser (or set the signal via an extension) and observe network traffic: advertising pixels, audience syncs, and sharing-related requests should be suppressed automatically. A compliance scanner can run this check for you.
Related terms
Wondering how this applies to your own site? Get a free compliance scan — see every tracker that fires before consent, graded against CIPA, GDPR, CCPA/CPRA, and MHMD.
Test your site's GPC handling