What is Global Privacy Control (GPC) and how to respect it

Global Privacy Control, or GPC, lets a visitor tell every website they visit, in a single browser setting, that they do not want their data sold or shared. Its legal effect depends on whether a law applies to the business and processing. California and Colorado are examples of regimes that recognize qualifying browser-based opt-out signals. This post explains what GPC is, how the signal is transmitted, what the law requires you to do with it, and how to detect it on your site.

What GPC is

GPC is a proposed W3C specification that sends a single preference from the browser to every site. The goal is a global, persistent opt-out for the sale or sharing of personal data, so a person does not have to object site by site. It is backed by a coalition of organizations and implemented in several major browsers and extensions.

How the signal is transmitted

GPC is sent in two parallel ways: as an HTTP header on every request, and as a JavaScript property readable in the browser.

GET / HTTP/2
Host: example.com
Sec-GPC: 1

// true when the visitor has enabled Global Privacy Control
const gpcEnabled = navigator.globalPrivacyControl === true; if (gpcEnabled) { // treat as an opt-out of sale/sharing
}

What the law requires

GPC is not just a technical signal. For a business subject to California requirements, a qualifying opt-out preference signal such as GPC may need to be treated as a valid request to opt out of the sale or sharing of a consumer's personal information. Colorado's privacy rules take the same approach for their opt-out of targeted advertising and sale. If you qualify as a business under these laws and you receive GPC, you are generally expected to honor it.

Detecting and honoring GPC

The reliable approach is to read GPC on the server from the Sec-GPC header, because that signal arrives on the very first request before any script runs. Reading it in JavaScript is fine for adjusting the banner UI, but it runs after page load, so it cannot block trackers that already fired.

• Read Sec-GPC on the server to set the default opt-out state immediately.
• Reflect the GPC state in the banner so the visitor sees it has been applied.
• Block or release trackers based on the opt-out, the same enforcement path as a manual choice.
• Record the GPC signal in the consent record so you can evidence it.

GPC turns a privacy preference into a machine-readable signal you can act on automatically. The technical detection is simple; the work is in enforcement and record-keeping. Treat it as a first-class consent input, honor it before trackers run, and you turn a regulatory obligation into a default your visitors can trust.

Materially reviewed July 11, 2026. Regulatory and implementation guidance is general information, not legal advice.