Do you still need a cookie banner if you honour GPC?

Yes, you still need a consent banner. Global Privacy Control (GPC) only tells your site that a visitor opts out of the sale or sharing of their data under US state laws. It never says yes to anything, so it cannot give the opt-in consent that the GDPR and the ePrivacy Directive require before non-essential cookies are set for visitors in the EU and the UK. Honour the signal and keep the banner: they answer different laws.

What Global Privacy Control actually does

Global Privacy Control (GPC) is a browser-level signal that tells websites a visitor does not want their personal data sold or shared. The browser sends a Sec-GPC: 1 HTTP header with every request, as defined in the GPC specification, and websites that detect it are expected to treat the visitor as having opted out of data sale or sharing.

GPC grew out of the failed Do Not Track (DNT) standard, but with one critical difference: GPC has legal backing. Under the California Consumer Privacy Act (CCPA), the California Attorney General states that a GPC signal must be honoured as a valid request to stop the sale or sharing of personal information. As of October 2026, 11 other US state laws also expect businesses to honour universal opt-out signals such as GPC.

The signal is narrow. It communicates one thing: "do not sell or share my data."

That narrow scope is exactly why GPC cannot replace a cookie consent banner. A banner manages consent for analytics tracking, advertising cookies, personalisation and every other category of non-essential cookie your site sets, and it records each choice. These are distinct legal obligations under different laws.

GDPR consent banners stay mandatory in the EU and the UK

The GDPR and the ePrivacy Directive require prior, informed, specific consent before placing non-essential cookies on a visitor's device. Article 5(3) of the ePrivacy Directive is explicit: storing or accessing information on a user's terminal equipment requires the user's consent, unless the cookie is strictly necessary for the service requested.

GPC does not meet this requirement. The GDPR works on an opt-in model, not an opt-out model. A visitor must actively agree to each category of non-essential cookie before it fires. GPC, by contrast, is a blanket opt-out signal: it says "no" but never says "yes" to specific processing.

The GDPR defines consent as freely given, specific, informed and unambiguous. A browser-level signal that applies identically to every website visited cannot meet the "specific" part. Each website processes data differently, sets different cookies and uses different third-party services.

Which US states require businesses to honour GPC

The legal picture is different in the United States. US state privacy laws mostly follow an opt-out model for data sales and targeted advertising, and GPC fits that model.

As of October 2026, these state laws require businesses to honour GPC or another universal opt-out signal:

Nebraska's law, in force since 1 January 2025, adds a 12th, conditional rule. The dates for each state, with the laws that do not require the signal, are in the comparison of US state privacy laws.

In these states, if your website sells personal data or uses it for targeted advertising, you must detect the Sec-GPC: 1 header and stop those activities for that visitor. California has already enforced the rule: Sephora paid $1.2 million in August 2022 for failing to process opt-outs sent through GPC, and in July 2025 Healthline Media agreed to pay $1.55 million, then the largest CCPA settlement, in a case that also covered GPC requests. The California Attorney General's list of enforcement actions now shows General Motors' $12.75 million settlement of May 2026 as the largest.

California's Opt Me Out Act (AB 566), signed in October 2025, goes further. From January 2027, browsers must offer an opt-out preference signal setting, which should raise the share of visitors who send one.

How GPC and cookie banners work together

GPC and cookie consent banners are not rivals. They address different legal requirements and work at different layers of your site.

A cookie banner handles opt-in consent under the GDPR and the ePrivacy Directive. It presents cookie categories, collects granular choices, stores consent records and controls which scripts fire. GPC handles opt-out signals under US state privacy laws. It tells your site that a visitor does not want data sold or shared for cross-context behavioural advertising.

Your consent management platform should detect the GPC signal and stop data sale and sharing for that visitor, without making them use the banner's opt-out controls. The banner still appears, still collects consent for analytics and functional cookies, and still offers the granular choices European law requires.

Practical scenario: a European visitor

A visitor from Germany arrives with GPC turned on in Firefox. Your site must still show an opt-in banner and wait for consent before setting any non-essential cookies. The GPC signal does not change this, because German law follows the GDPR opt-in model.

Practical scenario: a California visitor

A visitor from Los Angeles arrives with GPC turned on. Your site detects the Sec-GPC: 1 header and stops data sale and sharing. If your site also uses a consent banner with a "Do Not Sell or Share" toggle, the banner should show that GPC has already handled this preference. The visitor may still see the banner if you use a consent model for all visitors, but the data-sale opt-out is already processed.

The EU's proposed browser signals are not law yet

The European Commission's Digital Omnibus proposal of November 2025 includes a provision (Article 88b) on machine-readable signals from browsers. If adopted in that form, browsers could pass on a visitor's choices, including opt-ins, which would reduce the need for cookie banners on sites where the browser has already done so.

As of October 2026, the proposal is still in the European Parliament's committees: the lead committee's draft report was tabled on 22 June 2026 and no vote has taken place. Until a law changes the rules, a cookie banner is the way to collect opt-in consent from European visitors.

How to detect the GPC signal

The browser sends the signal in two places:

• An HTTP header: Sec-GPC: 1
• A JavaScript property: navigator.globalPrivacyControl set to true

Your server-side code or CMP should check for either signal. If one is present, stop any processing that counts as selling or sharing personal data under the applicable state law. That includes firing marketing pixels such as the Meta Pixel (which sets _fbp), passing data to advertising partners and setting cookies used for cross-context behavioural advertising.

Kukie.io reads the JavaScript property. With Respect Global Privacy Control turned on in the Banner Editor's Behaviour tab, a visitor whose browser sends GPC starts with every non-essential category blocked. The banner still appears, so the visitor can accept categories if they want to, and nothing is saved until they make a choice.

Common misconceptions about GPC

Several misunderstandings circulate about what GPC does and does not do.

"GPC replaces cookie banners." It does not. GPC handles one specific right, the right to opt out of data sale and sharing. Cookie banners manage consent across several categories and several laws. Removing your banner because you honour GPC leaves European and UK visitors without the opt-in choice that the GDPR, the ePrivacy Directive and the UK GDPR expect.

"GPC only matters in California." As of October 2026, 12 US state laws expect businesses to honour universal opt-out signals, counting Nebraska's conditional rule. On 9 September 2025 the California Privacy Protection Agency and the Attorneys General of California, Colorado and Connecticut announced a joint investigative sweep of businesses that may not be honouring GPC.

"Most visitors use GPC, so analytics data will disappear." GPC adoption is still modest. Brave and DuckDuckGo turn it on by default and Firefox offers it as a setting, while the GPC project lists no built-in setting in Chrome or Safari. Adoption is likely to grow when the Opt Me Out Act's browser rule applies in January 2027. Even then, GPC's legal effect is an opt-out of sale and sharing, so analytics a visitor has consented to separately can keep running unless your site chooses to treat GPC as a wider rejection.

Short answers on GPC and cookie banners

Set one banner rule for Europe and another for GPC states

If your site gets visitors from both Europe and US opt-out states, the banner has to behave differently for each. Kukie.io's region rules let you set opt-in for the EU and the UK and an opt-out model for US states, and the banner can treat GPC as a rejection wherever it applies.

Start free