What Is Global Privacy Control (GPC)?

Global Privacy Control (GPC) is a browser-level signal that automatically tells every website you visit that you opt out of the sale or sharing of your personal data and targeted advertising. It is sent as an HTTP header (Sec-GPC: 1) and a JavaScript property. In a growing number of U.S. states, it is a legally binding opt-out request businesses must honor.

When California regulators tested Healthline with the Global Privacy Control signal enabled, the site detected it and set 118 third-party advertising cookies anyway, along with 82 advertising pixels. The settlement, announced July 1, 2025, was $1.55 million, the largest CCPA fine to that date.

For privacy counsel, DPOs, and the people who own the tag stack: what the signal is, which laws give it teeth, and why detecting it is not the same as honoring it.

What is Global Privacy Control?

GPC is a preference you set once in a browser or extension that travels with every request your browser makes. It takes two forms sent together: an HTTP header, Sec-GPC: 1 (“1” is the only valid value; an absent header means no preference expressed) and a JavaScript property, navigator.globalPrivacyControl, readable by scripts on the page. Both carry one message: do not sell or share my personal information and do not use it for targeted advertising.

State statutes rarely say “GPC.” They require businesses to honor a “universal opt-out mechanism” (UOOM) or an “opt-out preference signal.” GPC is the signal that satisfies those definitions. When a law talks about UOOMs or preference signals, this is what it means in practice.

The signal was built by a coalition of privacy researchers and technologists (the Electronic Frontier Foundation, Mozilla, and Wesleyan University among them) with founding publishers that include the New York Times and the Washington Post, and it is maintained openly at globalprivacycontrol.org. The specification is a W3C Working Draft: first published November 21, 2024, current draft dated June 11, 2026. It has never been a W3C Recommendation. Its legal force comes from state privacy law, not from standards-track status.

A site can declare its support for the signal at a well-known address, /.well-known/gpc.json, so browsers can confirm the site knows the protocol.

What GPC is not:

• Not a cookie blocker. It does not stop cookies or tags from loading. It instructs the site what it may do with the data they touch.
• Not a deletion request. It asks the business to stop selling or sharing going forward, not to erase data it already holds.
• Not an opt-out of all data collection. First-party collection that runs the service continues. The signal targets sale, sharing, and cross-context behavioral advertising.

How is GPC different from Do Not Track, a consent banner, and the “Do Not Sell or Share” link?

GPC is the only mechanism of the four that is both automatic and legally binding. Do Not Track was automatic but voluntary. The industry ignored it. A consent banner and a “Do Not Sell or Share My Personal Information” link have legal weight, but each makes the user act separately on every site. GPC is the choice made once, arriving with the request itself.

GPC exists because DNT failed. The same idea, rebuilt with statutory backing. For a website operator, none of the other three mechanisms goes away: the banner and the link keep their duties. But the signal arrives before either is touched, and in mandate states it must be processed even when the link is sitting right there on the page.

Is honoring GPC legally required, and in which states?

Yes. In 12 states as of September 2026, honoring an opt-out preference signal like GPC is a legal requirement for covered businesses. Everywhere else it is voluntary, though that list has grown every year since 2024.

Re-check before relying on this table: state effective dates keep moving.

*Maryland is the footnote case: the signal is one of two alternative compliance methods (an opt-out link or the signal), and the requirement applies prospectively only from April 1, 2026.

California’s CCPA and its 2020 amendment, the California Privacy Rights Act (CPRA), set the pattern. The duty entered the regulations on August 14, 2020. The dedicated provision (11 CCR §7025) became operative March 29, 2023. The California AG’s GPC guidance has treated the signal as a binding opt-out ever since. For the underlying law and who it covers, see What is the CCPA?.

Which states don’t require it

Virginia’s VCDPA has no preference-signal provision at all, and the states built on its template (Utah, Iowa, Indiana) follow the same shape. If a state’s comprehensive privacy law is not in the table above, treat honoring as voluntary and re-verify before relying on that answer. Mandates have been added every year since Colorado’s took effect.

Does GPC apply outside the United States?

No law outside the U.S. currently requires honoring GPC. Despite occasional claims to the contrary, the GDPR does not mandate opt-out preference signals. The EU regulates these flows through opt-in consent instead. Advertising trackers generally need consent before they run, so a standing opt-out signal solves a problem European law frames from the other direction.

The EU did consider the mechanism. Article 88b, an apparatus for machine-readable opt-out signals, would have joined the GDPR under the Digital Omnibus proposal (COM(2025) 837, November 19, 2025). The Council’s compromise text of June 18, 2026 removed it entirely. Parliament has taken no position; nothing is law.

The practical default for international businesses is to honor GPC universally rather than geo-switching. One header and one rule for every visitor is simpler to build, simpler to evidence, and immune to the mis-geolocation errors of per-region logic.

What changed in 2026, and what changes on January 1, 2027?

Two dated changes matter. Since January 1, 2026, California requires businesses to visibly confirm they processed the signal. On January 1, 2027, the Opt Me Out Act requires browsers to ship the signal’s functionality, moving GPC from a privacy-tool niche into default browser plumbing.

California’s visible-confirmation requirement (2026)

The amended 11 CCR §7025(c)(6) (Board-adopted July 24, 2025, approved by the Office of Administrative Law September 23, 2025, effective January 1, 2026) changed one word with operational weight. A business must (previously may) display whether it has processed the consumer’s opt-out preference signal. The regulation’s example display text is “Opt-Out Request Honored.” A toggle or radio-button status display also satisfies the rule. A confirmation the user never sees does not.

The Opt Me Out Act (2027)

AB 566, the Opt Me Out Act (Chapter 465, Statutes of 2025, approved by the Governor October 8, 2025), adds Civil Code §1798.136 and becomes operative January 1, 2027. From that date, browsers must ship consumer-configurable opt-out-preference-signal functionality (Chrome and Safari included, not just the privacy browsers that carry the signal today).

Two scope points the final text settled: the mandate covers browsers only (the mobile-operating-system requirement was amended out of the chaptered law), and the CPPA may adopt implementing regulations. The statute itself contains no technical-specification mandate. Browser makers, in turn, are shielded from liability for how businesses downstream handle the signals their software sends (§1798.136(d)). 

Do not conflate this law with AB 3048, the similar 2024 bill the Governor vetoed on September 20, 2024. Only AB 566 is law.

What happens if your website ignores GPC?

There have been five enforcement actions so far, with fines from $1.1 million to $2.75 million, plus multi-year monitoring, certification, and reporting obligations that outlast the payment. The failures punished are specific and technical. The record shows regulators testing the same way your own QA team could.

The enforcement record

The statutory math underneath these settlements: civil penalties run $2,663 per violation and $7,988 per intentional violation, inflation-adjusted as of January 1, 2025 per the CPPA’s official adjustment (base amounts in Cal. Civ. Code §1798.155 and §1798.199.90, adjusted per §1798.199.95(d); the next adjustment lands January 1, 2027). Both the Healthline and Disney complaints prayed at exactly those figures: run per-violation rates across tens of thousands of opted-out consumers and the seven-figure totals explain themselves.

Regulators coordinate

This is no longer one state’s project. On September 9, 2025, the California AG, the CPPA, and the Colorado and Connecticut AGs announced a joint investigative sweep. Letters went to businesses that did not appear to be processing GPC opt-outs. No targets named, no fines, but a clear signal of where examinations are heading. The Consortium of Privacy Regulators, announced April 16, 2025 with the CPPA and the AGs of California, Colorado, Connecticut, Delaware, Indiana, New Jersey, and Oregon, has since grown: Minnesota and New Hampshire joined in October 2025. The sweep’s scope also runs past GPC to broken opt-out mechanisms generally. For the broader CCPA enforcement record, see What is the CCPA?.

How regulators test your site

From the outside. Regulators do not ask your consent platform what it saw. They visit with the signal switched on and record what your tags do next. The Healthline complaint reads like a crawl report: cookies placed, pixels fired, counts attached. If your own team has never run that test, the regulator’s version of it is not the first result you want to see.

How much of your traffic actually sends GPC?

No public dataset measures the share of web traffic carrying the signal. Treat any precise percentage you see quoted with suspicion. What can be measured is support, adoption, and failure rates, and all three say the volume is already material.

Which browsers and extensions send it

• On by default: Brave, DuckDuckGo, Tor Browser, and Mullvad Browser send the signal without any user setup.
• A built-in setting: Firefox ships GPC behind one toggle.
• The extension path: Privacy Badger and OptMeowt add the signal elsewhere, which is how it reaches Chrome, Edge, and Safari, none of which has native support today.

For consumers, enabling it is a one-time install or setting; what matters here is what your site does when the header arrives.

What does your website have to do to honor GPC?

Five duties, plus one rule about how you carry them out: detect the signal, act on it, confirm you acted, keep evidence, and disclose your handling, all without adding friction for the user.

1. Detect: read the signal on every request.
2. Act: treat it as a Do-Not-Sell/Share request and stop the flows it covers, including downstream.
3. Confirm: display the honored status to the user.
4. Keep evidence: record that signals were received and honored.
5. Disclose: your privacy policy reflects how you handle the signal.

And the frictionless rule: no demanding additional information, no identity verification, no fee, no degraded experience, and no pop-up in response to the signal (§7025(c)(2), (f)).

Detect

The header arrives before any banner logic runs, so detection has to happen on every request, on every page, not just on pages where your consent tool loads. One wrinkle the law handles for you: anyone can set the signal, including by spoofing it, and the regulations treat it as the user’s preference regardless. You honor what arrives; you do not adjudicate who sent it.

Act: what must actually stop

Acting means treating the signal as a Do-Not-Sell/Share request: sale and sharing, with cross-context behavioral advertising named explicitly. First-party processing that runs your service continues. The stop is not total. The hard part is propagation: the opt-out has to reach the downstream tags and vendors the data was flowing to. An opt-out honored at the consent layer while an ad tag keeps firing is precisely the pattern in the enforcement record above. What happens to the data after it reaches your own backend, server-to-server flows, is beyond the scope of client-side signal handling.

Confirm

Since January 1, 2026, California requires showing the user the signal was processed: an “Opt-Out Request Honored”-style status display or equivalent toggle (legal details with the dated changes above). Operationally, your detection and your action both need a visible output.

Evidence

Keep dated records that signals arrived and were honored: what was received, what changed, when. Regulators test from the outside. Your logs are the internal half of that story. The disclosure duty rounds it out: your privacy policy should state how the business handles opt-out preference signals, so the public description matches the observed behavior.

The request-handling operations and vendor-contract mechanics underlying these duties are outlined in our CCPA compliance guide.

What about logged-in users, conflicts, and the edge cases?

The signal follows the browser, not the account. Where it collides with other settings, California’s regulations say which preference wins.

Logged-in users and cross-device effectuation

GPC travels with the browser that sends it. That is exactly where Disney failed: its opt-outs were effectuated per device only, even for users who were logged in, so an account holder’s choice never followed them. A logged-in user is a known consumer, and the duty applies to the consumer, not the device. One more protection runs the other direction: if the signal was previously sent and then stops arriving, that absence is not consent to opt the user back in (§7025(c)(5)).

When GPC conflicts with account settings or incentive programs

The signal can conflict with a user’s account-level privacy settings or with their participation in a financial-incentive program (a loyalty discount conditioned on data use, for example). Sections 7025(c)(3) and (c)(4) resolve which preference controls in each case, and both now carry display-status obligations so the user can see the outcome. Separately, §7026(k) bars a business from asking an opted-out consumer to consent again for at least 12 months. No quiet re-prompting between visits.

The implementation-level edge cases (single-page-app staleness, mid-session signal flips, how to treat an absent header) are owned by our planned GPC implementation guide.

Your CMP detected the signal. Did anything actually stop?

Less than the dashboard suggests, in most cases. A consent management platform (CMP) can report that it saw the signal; it cannot report what your tags did next. Detection is a console event. Honoring is network behavior, and only one of those is what the law punishes.

The enforcement record has shifted toward exactly this gap: Healthline had three opt-out mechanisms configured, and all three failed while advertising cookies kept firing. 

The only evidence that settles the question is observing actual network behavior with the signal on versus off: sending GPC yourself and recording which requests still leave the browser. 

The full test methodology is in our guide, “Does your website actually honor GPC?”

This is the layer MELURNA’s Consent & Preference Assurance monitors: it compares observed data movement after accept, reject, no action, and GPC signals, flags where a recipient’s behavior doesn’t change across those states, and keeps the check true continuously as websites, tags, and vendor relationships change. The honoring still happens in your own stack. This is how you know it did. Scoring spans 30+ compliance frameworks, with vendor risk prioritization and findings routed into GRC, audit, and reporting workflows with remediation verification. 

Test a customer journey →

FAQ

DISCLAIMER: This guide is for general informational purposes only and does not constitute legal advice. While we strive for accuracy, we make no warranties about the completeness or reliability of this information and are not liable for any errors, omissions, or actions taken based on its contents. Consult a licensed attorney for guidance specific to your business.