Global Privacy Control (GPC) Explained: A Data-Driven Guide to the Universal Privacy Signal, How It Works Across Browsers, and Why Tens of Millions of Users Are Enabling It to Protect Their Data
On Wed, Aug 24, 2022, California Attorney General Rob Bonta announced a $1.2 million settlement with Sephora, a beauty retailer. The issue was not a data breach but non-compliance with the California Consumer Privacy Act. Sephora failed to disclose the…
On Wed, Aug 24, 2022, California Attorney General Rob Bonta announced a $1.2 million settlement with Sephora, a beauty retailer. The issue was not a data breach but non-compliance with the California Consumer Privacy Act. Sephora failed to disclose the sale of personal data and did not process opt-out requests through a browser-level privacy signal, known as Global Privacy Control (GPC). By Oct 2025, enforcement actions included a $1.3 million fine against Tractor Supply Co. and a $375,000 settlement with DoorDash. Tens of millions of users now utilize GPC through browsers and privacy extensions, with privacy regulators in several US states expecting businesses to honor universal opt-out signals like GPC.
GPC is not a privacy trend but a compliance requirement with legislative backing across multiple US state privacy laws. It has significant implications for how organizations collect, process, and transmit user data online.
Global Privacy Control is a technical specification that communicates user privacy preferences to websites via a single browser-level signal. Users enable GPC in their browser or through an extension, transmitting their preference automatically on every page load.
GPC operates through an HTTP header: Sec-GPC: 1 . This instructs the website's server that the user does not consent to the sale or sharing of personal data, obligating the website operator to treat the visit as an opt-out in jurisdictions that require honoring such signals.
The specification, developed by the World Wide Web Consortium (W3C), is designed for simplicity, reducing the opt-out process to a single binary signal that operates silently with every web request.
Enabling GPC initiates two actions on every page request. First, the browser appends the HTTP header Sec-GPC: 1 to outgoing requests. Second, a JavaScript property navigator.globalPrivacyControl returns true, allowing client-side scripts to detect the signal and adjust behavior accordingly.
Server-side applications can read the HTTP header, while client-side tag managers and consent management platforms can check the JavaScript property to modify tracking scripts. The signal communicates a universal preference: do not sell or share my data, with legal force dependent on jurisdictional laws.
Browser Support: The Current Landscape
GPC adoption varies across browsers and privacy tools. Some browsers offer GPC as a native feature, while others require extensions. The current state of browser support shows both progress and significant gaps.
Browser / Tool GPC Support Method Notes
Brave Browser Native (default ON) Built-in Enabled automatically for all users
Mozilla Firefox Via extension Privacy Badger / GPC add-on Not native; requires user action
DuckDuckGo Browser Native Built-in Sends GPC by default
Google Chrome Not natively supported Extension required ~64% browser market share; limited reach without extension
Apple Safari Not natively supported Extension required ~19.85% market share; significant gap in coverage
On Wed, Aug 24, 2022, California Attorney General Rob Bonta announced a $1.2 million settlement with Sephora, a beauty retailer.
Microsoft Edge Not natively supported Extension required Requires manual extension install
Organizations focusing compliance efforts only on current GPC users risk regulatory scrutiny as privacy regulators increasingly expect businesses to honor universal opt-out signals.
Legal Recognition Across Jurisdictions
GPC gains legal significance through recognition in state privacy laws requiring businesses to honor browser-level opt-out signals. California first recognized GPC, with several other states following.
Jurisdiction GPC Status Notes
California (CCPA/CPRA) Recognized & enforced AG recognized GPC as valid opt-out signal in 2021; enforcement cases followed
Colorado (CPA) Recognized Businesses must honor universal opt-out mechanisms from Jul 2024
Connecticut (CTDPA) Recognized Opt-out preference signal requirements effective from Jan 2025
Montana (MCDPA) Recognized Universal opt-out mechanism provisions included
Texas (TDPSA) Recognized Opt-out preference signal requirements from 2025
Delaware (DPDPA) Recognized Universal opt-out mechanism requirements effective 2025
Oregon (OCPA) Recognized Opt-out mechanism provisions included in privacy law
Organizations processing personal data from residents of these states must implement systems capable of detecting and responding to the GPC signal to avoid enforcement action.
GPC's enforcement history shows active regulatory monitoring and actions against non-compliant organizations.
Case Year Penalty Key Issue
Sephora 2022 $1.2 million Failed to process GPC signals; continued selling personal data
Tractor Supply Co. 2024 $1.3 million Did not honor GPC opt-out requests
DoorDash 2025 $375,000 Failed to respect GPC signal in data sharing practices
The enforcement actions illustrate a regulatory program aiming to ensure compliance. The financial penalties, while modest, signal regulatory intent and create compliance incentives.
Business Implications: What Organizations Should Know
Organizations collecting, processing, or sharing personal data must detect GPC signals using server-side header inspection or client-side JavaScript detection. Systems must suppress or modify tracking activities for users sending the GPC signal. Documentation of GPC processing systems is critical during regulatory inquiries.
Organizations relying on third-party data sharing or behavioral advertising face significant adjustments. As GPC adoption grows, the proportion of web traffic treated as opted-out will increase, impacting revenue models and data agreements.
Implementing GPC compliance requires actions across an organization's technology stack:
Server-side signal detection: Configure web servers to read the Sec-GPC: 1 header before page script execution. CMP integration: Ensure consent management infrastructure reads the GPC signal, translating it into appropriate consent states. Tag management review: Audit tags to verify they respect consent states set by GPC detection. Third-party vendor assessment: Evaluate data-sharing agreements to ensure compliance with opt-out requirements. Testing and validation: Implement automated testing to verify correct tracking suppression activation. Documentation and audit trails: Maintain records of GPC signal processing and system configurations.
The technical execution of GPC is straightforward with organizational commitment. Companies treating GPC implementation with regulatory rigor will avoid compliance failures.
For more on consent management frameworks and privacy compliance technology, see Marketing Compliance Technology: How Brands Are Navigating GDPR, Privacy Regulations and Brand Safety at Scale and Consent Management Platforms: GDPR, CCPA Compliance and the Technology of Consumer Choice .
Based on reporting by TechBullion.