Global Privacy Control (GPC) is a browser setting that tells every website a visitor opens: do not sell or share my personal data. The browser sends it as an HTTP header, Sec-GPC: 1, and exposes it to scripts as navigator.globalPrivacyControl. In California and a growing list of US states, a business covered by the privacy law must treat that signal as a valid opt-out request.
As of October 2026, GPC is built into Brave, DuckDuckGo and Firefox, a dozen states require businesses to honour opt-out signals like it, and California's Opt Me Out Act will make every browser offer one from January 2027.
A machine-readable opt-out with legal backing
Unlike its predecessor Do Not Track (DNT), GPC has legal force. The California Attorney General's CCPA guidance says a user-enabled global privacy control "must be honored by covered businesses as a valid consumer request" to stop selling or sharing their data under the CCPA. The Attorney General's 2022 settlement with Sephora, USD 1.2 million, included the company's failure to process opt-outs sent through GPC.
Technically, the specification is short. When the setting is on, the browser adds Sec-GPC: 1 to every request and sets navigator.globalPrivacyControl to true. A site can read either and change what it does with the visitor's data.
GPC was proposed in the W3C Privacy Community Group in 2020, and according to the Global Privacy Control project, it became an official work item of the W3C Privacy Working Group in November 2024. It is still being standardised.
How GPC differs from Do Not Track
Do Not Track launched in 2009 with a similar aim but no law behind it. Websites were free to ignore it, and most did. The W3C closed its work on the DNT specification in 2019.
GPC ties the signal to existing law instead of goodwill. Under California's rules, it is a request to opt out of the sale and sharing of personal information, and Colorado, Connecticut and other states treat qualifying signals the same way.
The header differs too. DNT used DNT: 1, which some browsers still send but which carries no legal weight. GPC uses Sec-GPC: 1. The Sec- prefix marks a header that page scripts cannot set or change, so a site cannot fake the signal on a visitor's behalf.
Which browsers send GPC
Support depends on the browser. Some send it by default, some need a setting switched on, and the most used browsers need an extension.
| Browser | GPC support | Default state |
|---|---|---|
| Brave | Built in | On by default |
| DuckDuckGo | Built in | On by default |
| Firefox | Built in (since version 120) | Off by default, turned on in privacy settings |
| Google Chrome | Extension only | Not built in |
| Microsoft Edge | Extension only | Not built in |
| Safari | Extension only | Not built in |
Privacy-focused browsers lead. Brave and DuckDuckGo send GPC to every site, so their users opt out of data sales automatically. Firefox added a native setting in version 120.
Chrome, Edge and Safari had no built-in GPC setting as of October 2026, and the GPC project's list of implementations names none of them. Their users can install an extension that sends the signal, such as the EFF's Privacy Badger or OptMeowt.
California's browser rule starts in January 2027
That gap has a deadline. On 8 October 2025, California Governor Gavin Newsom signed AB 566, the Opt Me Out Act. From January 2027, browsers must give users in California a setting that sends an opt-out preference signal such as GPC.
Chrome, Edge and Safari will need a built-in setting for Californian users. Limiting a browser feature to one state is awkward, so a wider rollout is possible, but none of the three had announced its plan in a source opened for this update.
For websites, the effect is volume. Once the most used browsers offer the setting, many more visitors will arrive with the signal switched on, and every site covered by an opt-out law will need to act on it.
US states that require businesses to honour GPC
As of October 2026, the following states require businesses covered by their privacy laws to honour universal opt-out signals, and GPC is the signal they most often name. The comparison of US state privacy laws covers the rest of each law.
| State | Law | Opt-out signals required since |
|---|---|---|
| California | CCPA, as amended by the CPRA | August 2020 (regulations), with GPC confirmed by the Attorney General in July 2021 |
| Colorado | CPA | 1 July 2024 |
| Connecticut | CTDPA | 1 January 2025 |
| Texas | TDPSA | 1 January 2025 |
| Montana | MCDPA | 1 January 2025 |
| New Hampshire | NHPA | 1 January 2025 |
| New Jersey | NJDPA | 15 July 2025 |
| Minnesota | MCDPA | 31 July 2025 |
| Maryland | MODPA | 1 October 2025 |
| Oregon | OCPA | 1 January 2026 |
| Delaware | DPDPA | 1 January 2026 |
Oregon's date comes from the Oregon Department of Justice: "As of January 1, 2026, businesses have to honor opt-out signals that meet certain technical requirements." Nebraska's law also refers to opt-out signals, but summaries disagree on how far it requires them, so read its text before relying on either view.
Enforcement has followed. On 9 September 2025, the California Privacy Protection Agency and the Attorneys General of California, Colorado and Connecticut announced a joint sweep of businesses that do not honour GPC.
GPC does not replace a consent banner
A common misunderstanding is that supporting GPC removes the need for a cookie banner. It does not, and GPC and cookie banners do different jobs.
GPC is an opt-out signal built for US state privacy laws. It says the visitor does not want their data sold or shared. The GDPR and the ePrivacy Directive work the other way round: non-essential cookies need opt-in consent before they are set. A visitor from the EU who sends GPC still has to be asked, and analytics or marketing cookies stay off until they agree.
The two fit together. A consent management platform can read the signal and apply the opt-out for US visitors, while still asking for opt-in consent from visitors covered by the GDPR.
Detecting and responding to GPC
There are two ways to detect the signal. On the server, check for the Sec-GPC: 1 request header. In the browser, read navigator.globalPrivacyControl.
When the signal is present, stop any processing that counts as selling or sharing personal data under the law that applies. In practice that usually means blocking advertising pixels and their cookies, such as Meta's _fbp and Google Ads' _gcl_au, and real-time bidding scripts.
Strictly necessary cookies such as PHPSESSID or a cart session are not affected: GPC is about selling and sharing, not every cookie. The guide to honouring GPC signals has the technical walkthrough.
Check whether a browser sends GPC
To test your own setup, switch GPC on in Firefox (or use Brave or DuckDuckGo), open your site and run this in the developer tools console:
navigator.globalPrivacyControlIt returns true when the signal is on. To check the header, open the Network panel, select the page request and look for Sec-GPC: 1 under the request headers. Then check what your site did: the advertising cookies above should not be set, and an opt-out should be recorded.
What ignoring GPC can cost
The CCPA allows fines of up to USD 2,663 per violation and USD 7,988 per intentional violation, the amounts the California Privacy Protection Agency adjusted on 1 January 2025. Each visitor whose signal was ignored can count as a separate violation. CCPA penalties and enforcement are covered in more detail separately.
The Sephora settlement in 2022 was the first public case. Since then, the CPPA fined PlayOn Sports USD 1.1 million in March 2026, in part for ignoring opt-out preference signals, and the joint sweep shows regulators testing sites with the signal switched on.
Trust matters too. Visitors who switch GPC on did it on purpose, and they notice targeted advertising that should not have reached them.
Short answers about GPC
Does GPC replace cookie consent banners?
No. GPC is a US opt-out signal for selling and sharing data. The GDPR and ePrivacy rules still require opt-in consent before non-essential cookies are set, so you need a banner for visitors from Europe and GPC handling for visitors from the US.
Is GPC legally binding in every US state?
No. As of October 2026, about a dozen states require businesses to honour universal opt-out signals such as GPC. Other states may add the requirement as their laws are amended.
How do I check whether my website detects GPC?
Turn GPC on in Firefox or use Brave, then run navigator.globalPrivacyControl in the browser console and look for the Sec-GPC: 1 request header in the Network panel. Then check that your site set no advertising cookies.
Does GPC apply to first-party analytics cookies?
GPC is about selling and sharing personal data, not every cookie. First-party analytics that share nothing with third parties are generally unaffected, but check whether your analytics vendor receives data in a way the law treats as sharing.
Will Chrome add built-in GPC support?
California's Opt Me Out Act requires browsers to offer an opt-out preference signal setting to Californian users from January 2027, so Chrome will need one. As of October 2026, Chrome has no built-in GPC setting.
Can I ask visitors to override their GPC setting?
Under California's rules you must treat the signal as an opt-out. You cannot make visitors switch GPC off, but you may offer them a way to opt back in, as long as the default respects the signal.
Respect GPC on the regions that need it
Kukie.io can treat a GPC signal as an opt-out wherever a region uses the opt-out, notice-only or hidden model, so advertising tags stay blocked for that visitor, while visitors from the EU and UK still get the full opt-in choice. It records the signal once as the visitor's opt-out and shows "Opt-Out Request Honored" in the Do Not Sell or Share dialog. It works alongside the region rules you set for other privacy laws.
