Global Privacy Control: The Browser Signal California Requires You to Honor
Updated 2026-08-05 · 3 enforcement actions cited · 5 official sources
Global Privacy Control (GPC) is a one-bit signal a browser or extension sends with every request, saying: this person opts out of the sale and sharing of their personal information. Under California regulations it is not a courtesy — a business that sells or shares personal information must treat a GPC signal as a valid opt-out request, automatically, with no further user action.
TL;DR
- GPC travels two ways: the HTTP header `Sec-GPC: 1` on every request, and the JavaScript property `navigator.globalPrivacyControl === true`.
- California's CCPA regulations (11 CCR § 7025) make honoring an opt-out preference signal mandatory for businesses that sell or share personal information.
- Firefox, Brave, DuckDuckGo, and the Privacy Badger / DuckDuckGo extensions send GPC by default or with one toggle. Chrome and Safari require an extension.
- Honoring GPC means actually stopping the sale/share — not just displaying a banner that says you did.
See whether your own site honors GPC. $99, runs in a real California browser.
What the signal actually is
GPC is deliberately simple. When a user enables it, their browser adds the HTTP request header `Sec-GPC: 1` to every outbound request, and exposes the boolean `navigator.globalPrivacyControl` as `true` to JavaScript running on the page. That is the whole specification. There is no payload, no identity, no per-site configuration.
The simplicity is the point. The signal is legally meaningful precisely because it is unambiguous: a business receiving `Sec-GPC: 1` cannot claim it did not know the visitor was opting out. Both transports carry identical meaning, and a compliant implementation should read either one — the header is available server-side before your page renders, and the JavaScript property is available to your consent management platform.
Because the signal is sent on every request, it applies to the visitor's entire session and to every subsequent visit while the setting stays on. There is no expiry and no need for the user to re-assert it.
Who sends GPC today
Firefox ships GPC as a built-in setting (Settings → Privacy & Security → 'Tell websites not to sell or share my data'). Brave and DuckDuckGo's browser send it by default. Chrome and Safari do not implement it natively, but extensions including DuckDuckGo Privacy Essentials, Privacy Badger (EFF), and OptMeowt inject the header for millions of users.
Estimates of GPC-enabled traffic vary by audience, but privacy-conscious segments routinely show low single-digit to low double-digit percentages of sessions carrying the signal. For a consumer site with meaningful California traffic, that is thousands of legally binding opt-out requests per month arriving silently in your access logs.
What California requires when you receive one
Section 7025 of the CCPA regulations requires a business that sells or shares personal information to process an opt-out preference signal as a valid request to opt out of sale/sharing for that browser or device — and, if known, for the consumer associated with it. The business may not require the consumer to provide additional information, may not display a pop-up asking them to confirm, and may not treat the signal as merely a preference to be weighed against a previously accepted cookie banner.
Critically, § 7025 also says the business must not charge a fee, degrade the service, or otherwise penalize the consumer for sending the signal. A site that responds to GPC by hiding content or breaking functionality is creating a separate problem for itself.
The regulations do permit you to notify the consumer that their signal was honored, and doing so is good practice — it is also the clearest evidence of compliance an auditor or regulator can see.
Not sure where your site stands? Find out in a few minutes.
Honoring the signal is a data-flow change, not a UI change
The single most common failure we see in audits is a site that displays a message reading 'Your privacy preferences have been applied' while continuing to fire advertising and analytics tags that constitute a sale or share under the CCPA's broad definition. The CCPA defines 'sharing' to include disclosing personal information to a third party for cross-context behavioral advertising, whether or not money changes hands — which is exactly what a Meta or TikTok advertising pixel does.
A correct implementation reads the signal before any third-party tag loads, suppresses the tags that constitute a sale or share, and — where you use server-side conversion APIs — sets the corresponding restricted-data-processing or consent-mode flags on the outbound call.
How to check whether your own site honors it
The test regulators and plaintiffs' firms run is straightforward: load the site from a California IP with GPC on, then compare against a load with GPC off. Record every outbound network request, every cookie set, and the state of any privacy preference UI. A compliant site shows a visible difference — advertising tags absent, opt-out cookies (such as the IAB `usprivacy` string or a GPP consent string) set to the opted-out value, and often an acknowledgement message.
That is precisely the test got gpc? automates: a real browser in California, GPC on, screenshots and full network capture, then an analysis of whether the signal was actually honored.
Key enforcement actions
California AG — Sephora settlement
Cal. Att'y Gen., Aug. 2022, $1.2MThe first public CCPA enforcement settlement. Among the allegations: Sephora failed to process opt-out requests submitted via Global Privacy Control. The settlement made explicit that GPC is a legally binding opt-out signal, not an optional courtesy.
Read the official source ↗CPPA — Honda decision
Cal. Privacy Protection Agency, Mar. 2025, $632,500The CPPA's Enforcement Division found that American Honda Motor Co. required excessive information to process opt-out requests and used a cookie-management interface that made opting out harder than opting in — a dark-pattern finding directly relevant to how GPC-adjacent preference UIs are built.
Read the official source ↗CPPA — Todd Snyder decision
Cal. Privacy Protection Agency, May 2025, $345,178The agency found the retailer's opt-out mechanism was misconfigured and non-functional for a 40-day period, and that it required consumers to verify identity for opt-out requests. A reminder that a broken opt-out path is treated the same as no opt-out path.
Read the official source ↗FAQ
Is GPC the same thing as Do Not Track?
No. Do Not Track was a non-binding request that no law required anyone to honor, which is why it failed. GPC is backed by an enforceable legal obligation in California and several other states, and California's regulations spell out exactly what honoring it means.
Do I have to honor GPC if I don't sell data?
The obligation attaches to businesses that sell or share personal information. 'Share' is defined broadly to include disclosure for cross-context behavioral advertising. If you run advertising pixels that build audiences off your visitors, you are very likely in scope even if no money changes hands.
Can I ask the user to confirm before applying the signal?
No. Section 7025 prohibits requiring additional steps or information to process an opt-out preference signal. A confirmation pop-up is an additional step.
What if a user previously clicked 'Accept All' and now sends GPC?
The later signal controls. The regulations treat the opt-out preference signal as a valid request; you may inform the user of the conflict and give them the option to consent again, but the default state must be opted out.
Official sources
- Global Privacy Control specification ↗— GPC Working Group
- CCPA Regulations § 7025 (opt-out preference signals) ↗— California Privacy Protection Agency
- California Consumer Privacy Act (CCPA) overview ↗— California Attorney General
- Cal. Civ. Code § 1798.135 (opt-out methods) ↗— California Legislative Information
- US state privacy legislation tracker ↗— IAPP
Related reading
This guide is general information about California privacy law and the Global Privacy Control signal, not legal advice. Enforcement actions are summarized from official regulator publications; verify before relying on them. Consult qualified counsel for your specific situation.