Global Privacy Control: What the Signal Is and Which Businesses Must Honor It

The project's own site describes GPC as 'a proposed specification designed to allow Internet users to notify businesses of their privacy preferences'. The Colorado Attorney General describes it as a signal sent by a web browser that tells businesses whether a person wants their personal information to be shared or sold.

The idea is to remove repetition. Without a signal, a person who wants to opt out has to find and use a link on each site. With it, the choice is made once in the browser and sent everywhere. California's regulation states the purpose in those terms: a consumer can opt out with all businesses they interact with online 'without having to make individualized requests with each business'.

California law uses the term opt-out preference signal. Colorado uses universal opt-out mechanism. Both regulators name GPC as an example that qualifies.

The W3C Working Draft dated 24 September 2026 defines the header field as Sec-GPC with the single value 1. A browser sends it when the preference is on and leaves it out otherwise. Servers are told to ignore any value other than 1. The draft says the field has no extension mechanism, which is deliberate. There is one meaning and one value.

Scripts can read the same preference through the property navigator.globalPrivacyControl, which is true when the header would be sent. That matters because most advertising tags are loaded by scripts in the page. A consent tool or tag manager can read the property and decide which tags to load.

The draft also describes an optional file at /.well-known/gpc.json where a site can state whether it intends to honor the signal. The draft is clear that the file is only the site's statement. It does not confirm that a given visitor's signal was honored.

The draft is published by the W3C Privacy Working Group on the Recommendation track. Its own status section says it is a draft that may change and that the W3C does not endorse it at this stage. On legal effect the draft says only that the signal may carry legal weight depending on the person's location and the applicable law.

The GPC project lists Brave and the DuckDuckGo Privacy Browser as sending the signal by default, and Firefox as offering it in settings. It also lists extensions including Privacy Badger from the Electronic Frontier Foundation, Disconnect and OptMeowt. The project's home page claims more than 150 million people use it. That is the project's own figure.

The Colorado Attorney General notes that the setting is per browser. A person with several devices or browsers has to turn it on in each one.

The share of visitors sending the signal is likely to rise in California. Governor Newsom signed the California Opt Me Out Act, AB 566, on 8 October 2025. The California Privacy Protection Agency says the law requires browsers to offer an easy-to-use opt-out preference signal and that it takes effect in January 2027. The agency sponsored the bill.

The table lists only states where an official page was opened and read. It is not a complete list. The California Privacy Protection Agency wrote in October 2025 that California is 'one of a dozen states that require businesses to honor requests made using' opt-out preference signals. The agency did not list them in that announcement. The research notes behind this article record that vendor lists of the states conflict with each other and were not checked against statutes, so no longer list is given here.

Each law has its own thresholds for which businesses are covered. A small site may fall outside all of them. The signal is binding only on a business that is within the law and that sells personal data or uses it for targeted advertising as that law defines those terms.

Connecticut adds a condition worth reading. Its Attorney General says the signal must come from a platform or mechanism that lets the controller accurately determine whether the consumer is a Connecticut resident.

Section 7025 of the California regulations sets the scope. On receiving the signal, a business 'shall treat the opt-out preference signal as a valid request to opt-out of sale/sharing' for that browser or device and any consumer profile associated with it, including pseudonymous profiles. If the consumer is known, the business shall also treat it as a request for the consumer.

The regulation gives worked examples. In one, a shopper is logged in when the signal arrives. The business must apply the opt-out to her account and to any offline sale or sharing, as well as to the browser. In another, the same person later logs in from a device without the signal. The business may not read the missing signal as consent to opt back in.

The business cannot ask for more than the signal. It may offer the option to provide more information, such as logging in, but if the person does not respond it must still process the opt-out for the browser or device. If the signal conflicts with a setting in which the person earlier allowed sale or sharing, the signal controls. The business may tell the person about the conflict and ask for consent. The privacy agency's overview adds that a known consumer may be asked to opt back in only once every 12 months.

The text quoted here is the version of section 7025 published by Cornell's Legal Information Institute, which shows a 2023 register date. The agency has since amended its regulations, so check the agency's current text before relying on a subsection.

The pattern in these announcements is a signal that reached the site and changed nothing, or changed too little. In the Disney matter the Attorney General said GPC opt-outs were limited to the device used, even when the person was logged in.

On 9 September 2025 the California Privacy Protection Agency and the Attorneys General of California, Colorado and Connecticut announced an investigative sweep. The announcement says the coalition was contacting businesses that may not be processing opt-out requests submitted through GPC and asking them to comply.

The California regulation frames the signal as a request to opt out of sale and sharing. The privacy agency's overview defines sharing as making personal information available to a third party for cross-context behavioral advertising. A site's own first-party measurement is a different question from whether data goes to an advertising platform.

The W3C draft makes the same point about scope. It says the signal is not intended to trigger deletion rights or to limit a first party's use of data within the same context.

The signal also does not travel between devices by itself. It is a browser setting. The link between devices exists only where the business knows who the person is, which is why the logged-in case gets so much attention.

Whether a given tag counts as selling or sharing depends on what the vendor does with the data and what the contract says. That is a legal question about each vendor, and this article does not answer it for any particular setup.

California's regulations say methods for submitting privacy requests should be tested to make sure they work. The regulator cases show what the test needs to cover. The steps below follow from those cases and from the wording of section 7025.

Repeat the test after any change to tags, the consent tool or the site template. A tag pasted directly into page code will not obey a setting in the tag manager.

• Load key pages with the signal off and record every third-party advertising and analytics request.
• Turn the signal on, clear site data, reload the same pages and record the requests again.
• Check pages reached after the first one, including checkout, account and thank-you pages.
• Sign in with the signal on, then sign in on a second device without it, and confirm the opt-out followed the account.
• Confirm the opt-out does not depend on the visitor clicking anything in a banner.
• Read the privacy policy and confirm it describes how opt-out signals are processed.
• Save the date, pages, browser and results of each test.