What is Global Privacy Control (GPC)? How the opt-out signal works

What is Global Privacy Control?

Global Privacy Control (GPC) is an opt-out that a browser sends on the user's behalf. On every request, the browser, extension or mobile app announces that this person opts out of the sale and sharing of their personal information. There's no popup and nothing to click on your site. It's a standing instruction that goes everywhere the visitor goes, so there's no one-time form to submit.

The part that matters most is legal. Under California's regulations, a GPC signal is treated as a valid consumer opt-out request for businesses in scope. You can't ask the user to confirm it in a banner, and you can't weigh it against a cookie choice they made last month. It counts as a request as soon as it arrives.

Teams used to European rules often get confused here. GDPR and ePrivacy run on prior opt-in, so nothing non-essential fires until someone agrees, and under EDPB and regulator guidance, refusing has to be as easy as agreeing. CCPA and CPRA run the other way. They're opt-out laws, and they ask for notice at collection, a working Do Not Sell or Share My Personal Information mechanism, and mandatory honoring of GPC. They aren't consent-banner laws. None of this is legal advice, and your counsel should confirm your own scope.

How does GPC reach a website?

GPC reaches a website in two ways, and you should handle both. The browser sends a request header, Sec-GPC: 1, with every HTTP request it makes to you. In the page, the same preference is available to JavaScript as navigator.globalPrivacyControl, which reads true. Treat either one as authoritative. A visitor arriving with the header set has already opted out before your first byte of HTML renders.

Here is the header as it arrives on a request, and the same check made in the page:

GET / HTTP/1.1
Host: example.com
Sec-GPC: 1

if (navigator.globalPrivacyControl === true) {
  // Opted out of sale and sharing:
  // hold ad and analytics tags.
}

It helps to know who sends it. GPC is on by default in some privacy-focused browsers, it's an available setting in others, and a range of browser extensions add it. Chrome doesn't send it out of the box. So the share of traffic carrying the signal looks small in most analytics dashboards, and that's why the handling gets skipped until someone checks.

Watch the timing. Most tag setups read consent state after the page loads, then fire. If your GPC check happens after analytics and advertising tags have already initialized, you've shared data belonging to someone who opted out before they arrived. To honor the signal and do more than log it, detect the header on the server or run a synchronous check before any tag boots.

What does “Your Global Privacy Control opt-out signal has been honored” mean?

It means the site detected the GPC signal your browser sent and applied it as a request to opt out of the sale and sharing of your personal information. There's nothing to click and nothing to confirm. The opt-out already applies, and the message is the site telling you so.

Many sites show it because of California. Since January 1, 2026, the state's regulations require a business to give consumers a way to confirm the status of an opt-out request, including one sent as an opt-out preference signal like GPC, and the regulator's own example is a site displaying “Opt-Out Request Honored” (11 CCR 7025(c)(6)).

The message doesn't mean the site will stop working, because cookies the site needs to run still load. And if you never switched GPC on yourself, your browser or an extension probably did. The next section covers which ones send it and how to turn it off.

How do you turn GPC off?

You turn GPC off in whatever is sending it. It's a setting in your browser or extension, so no site can switch it off for you, and switching it off stops the opt-out for every site you visit.

• In Firefox, go to Settings and, under Privacy & Security, clear the box labeled Tell websites not to sell or share my data. Firefox also sends GPC by default in private browsing windows.
• Brave sends GPC by default. Its switch is a browser flag, so open brave://flags, find brave-global-privacy-control-enabled, and set it to Disabled.
• DuckDuckGo ships its browser and extensions with the GPC setting already on. DuckDuckGo itself stops sending the signal to a list of sites where it breaks them.
• Privacy Badger sends GPC by default. In its options, clear Send websites the “Global Privacy Control” and “Do Not Track” signals, which stops both. Disabling Privacy Badger on a single site stops both signals there too.

Chrome doesn't send GPC on its own. If a Chrome window is sending it, an extension is the source.

Which states require honoring GPC?

Twelve, as of 2026. At least nineteen states have comprehensive privacy laws in force, and twelve of them require businesses to honor universal opt-out mechanisms like GPC. California was first and is still the one you hear about most, but the obligation now spans Colorado, Connecticut, Texas, Oregon, Montana and others. Indiana, Kentucky and Rhode Island are among the newest comprehensive laws, and the map changes every year.

The rules aren't identical. Some states apply the opt-out to sale and targeted advertising, and some extend it to profiling. Maryland went further than the rest and bans the sale of sensitive data outright, regardless of any signal or consent. Applicability thresholds differ too, so a business covered in one state may fall out of scope in another. Confirm your own exposure with counsel, since this post isn't legal advice.

In practice, geography alone won't solve this. A visitor's state determines which law applies, but the signal arrives wherever they are, and treating it as a global instruction is easier than maintaining a dozen conditional carve-outs that drift out of date. Honoring GPC everywhere costs close to nothing in engineering time, and a wrong geo-fence can cost a lot more.

Enforcement has followed a single pattern

US privacy enforcement has been narrower than people expect. Regulators haven't gone after companies for not having a cookie banner. They've gone after companies whose opt-out didn't work, and a broken GPC response is easy to prove, because an investigator can load your site with the signal switched on and watch the trackers fire anyway.

Sephora paid $1.2 million in 2022 for, among other things, failing to process GPC signals. Honda paid $632,500 in 2025 over opt-out flows that asked more of users than the law allows. Healthline paid $1.55 million in 2025 after continuing to share data with advertising partners following opt-outs, and Todd Snyder paid $345,178 in 2025 for a misconfigured banner.

None of those cases turned on the wording of a privacy policy. They turned on a mechanism that was broken, asymmetric or ignored, and you can spot each of those failures in about thirty seconds of network inspection. GPC is among the cheapest items on that list to get right, and among the most conspicuous when it's wrong.

What a site owner must wire up

Start by detecting the signal in both places, the Sec-GPC header on the request and navigator.globalPrivacyControl in the page, and treat either as an opt-out for sale and sharing. Then make sure that detection runs before your tags do. After that, keep a record of which visit it was, which signal arrived, the timestamp, and what your site did in response.

Your interface should show the opt-out too. If GPC is on, your banner shouldn't offer a fresh choice as though nothing happened, and your Do Not Sell or Share My Personal Information page should show the opt-out already applied. If you serve EEA or UK visitors through Google advertising or measurement, Consent Mode v2 has been required since March 2024, and its four signals (ad_storage, analytics_storage, ad_user_data and ad_personalization) need to move in step.

UserGuard is built to detect GPC on every tier, with geo-targeting alongside it. Neither one is paywalled, including on the $10 per site plan, because if you have to upgrade to get a compliance feature, you won't have it on the day it matters. Consent events are designed to be tied to the site, banner version, region and timestamp, and exported as CSV. UserGuard is newly launched. It isn't a Google-certified CMP and it isn't IAB TCF validated, and TCF is on the roadmap but hasn't shipped.

• Detect Sec-GPC: 1 and navigator.globalPrivacyControl, and honor either one
• Suppress ad and analytics tags before they initialize
• Log the signal, timestamp, and resulting state, and be able to export it

Go deeper: GPC handling, on every tier · what each plan includes