What Is Global Privacy Control (GPC) and How to Honor It
Summary
Global Privacy Control (GPC) is a browser setting that tells every website a person visits “do not sell or share my personal data,” before they do anything on the page. Under a growing list of US state laws it counts as an opt-out. Nine states directly require businesses to honor it, and three more accept it through an authorized-agent rule.
GPC solves a practical problem the opt-out laws created: no one wants to click a “do not sell” link on every site they visit. GPC lets a person set the preference once, in their browser or an extension, and have it apply everywhere automatically.
The sections below explain how GPC works, which states legally require honoring it, and how to honor it on your site. The last section covers how to prove your site honors GPC.
How does GPC work?
Technically, GPC is a signal your visitor’s browser sends. It arrives two ways: as an HTTP header (Sec-GPC: 1) on the request, and as a JavaScript property, navigator.globalPrivacyControl, that your site can read. The signal is sent automatically, before the visitor interacts with your page or your consent banner, so it is present from the first request.
Because it arrives up front, GPC is not something a visitor negotiates with your banner. It is a standing instruction your site is expected to detect and follow.
Which states legally require honoring GPC?
Nine states directly require businesses to honor a browser opt-out signal such as GPC: California, Colorado, Connecticut, Delaware, Minnesota, Montana, New Hampshire, New Jersey and Oregon. Most statutes use the phrase “opt-out preference signal”, and Colorado recognizes GPC by name. Texas, Maryland and Nebraska let consumers opt out through a browser setting that acts as their authorized agent, with conditions (Nebraska, for example, allows verification). With the nine direct-duty states, that makes 12. California has required businesses that sell or share personal information to treat a signal like GPC as a valid opt-out under a CPPA regulation in force since March 2023, Colorado since July 2024, and the rest came into force from January 2025 to January 2026. The list is growing, so the practical assumption is that honoring GPC is a baseline obligation.
In these states, ignoring a GPC signal is treated the same as ignoring a manual opt-out. California added a further step in January 2026: businesses must give visitors a way to confirm their opt-out was processed, including one sent by GPC. For example, a site can show “Opt-Out Request Honored”.
How to honor GPC
Three steps.
- Detect the GPC signal on incoming requests, through the
Sec-GPCheader or thenavigator.globalPrivacyControlproperty. - Act on it by treating the visitor as opted out of sale and sharing, which in practice means suppressing the tags and data-sharing that count as a “sale” or “share,” such as advertising pixels.
- Confirm the opt-out where required. In California, since January 2026, give visitors a way to confirm their opt-out was processed, for example by showing “Opt-Out Request Honored”.
The step that fails silently is the second one. Detecting the signal is easy. Making sure the tags that should stop actually stop is the part that has to be verified.
How to prove your site honors GPC
DataTrue tests GPC by loading your site with a GPC-signalling browser extension enabled, then recording which tags fire. You can confirm that the tags that count as sale or sharing actually stop when the signal is present, on every page, rather than assuming the setting took effect. Because the signal comes from a real browser, it reaches your site exactly as a real visitor’s GPC setting would. The result is a timestamped record that your site honors GPC, which is the evidence a regulator asks for.
Questions
What is Global Privacy Control (GPC)?
GPC is a browser signal that automatically tells every website “do not sell or share my personal data.” It is sent as an HTTP header and a JavaScript property before the visitor interacts with the page. In states that require it, honoring GPC is legally equivalent to honoring a manual opt-out.
Is honoring GPC legally required?
Yes, in a growing number of states. Nine states directly require businesses to honor a browser opt-out signal such as GPC: California, Colorado, Connecticut, Delaware, Minnesota, Montana, New Hampshire, New Jersey and Oregon. Texas, Maryland and Nebraska accept it through a browser setting that acts as the consumer’s authorized agent, with conditions. That makes 12, and the list is growing.
What do I have to do to honor GPC?
Detect the signal, act on it by suppressing the tags and data-sharing that count as a sale or share, and, in California since January 2026, give visitors a way to confirm their opt-out was processed. The part that needs testing is whether the right tags actually stop.
How do I know my site is actually honoring GPC?
By testing it. Load the site with a GPC signal switched on and confirm that the tags that count as sale or sharing stop firing, on every page. DataTrue automates this and produces a record you can show a regulator.
See what your tags do in every consent state
DataTrue loads your real pages as a visitor who accepts, rejects, or sends an opt-out signal, and reads what each tag sends. A tag that ignores the visitor’s choice shows up in a test.
- Every page, with coverage scans
- Scheduled runs, with alerts when a result changes
- Full journeys, like checkout and signup, in each consent state
- What each tag sent, field by field
- PII detection with test personas
- iOS and Android app testing
- Pre-publish testing for GTM and Adobe Tags
- REST API, plus Slack and Jira alerts
The full platform, every feature, free for 30 days.
