Global Privacy Control (GPC) is a browser setting that tells every website you visit not to sell or share your personal data. You switch it on once, and it speaks for you everywhere. No pop-ups, no per-site opt-out forms, no cookie-banner marathon. And unlike the privacy signals that came before it, this one has teeth: in a growing list of US states, businesses are legally required to obey it.
Here is everything worth knowing about GPC in 2026: what it is, how it works, which browsers send it, how to turn it on in thirty seconds, and where the law forces websites to honor it.
GPC in 60 seconds
- What it is: one browser setting that broadcasts “do not sell or share my data” to every site, automatically.
- Is it binding? Yes in 12 US states (California, Colorado, Connecticut and more). Not yet in the EU, where consent banners are still required.
- How to enable it: on by default in Brave and DuckDuckGo; a single checkbox in Firefox; an extension in Chrome and Edge.
- New in 2026: California now requires businesses that sell or share data to show visitors that their signal was honored, not just process it silently.
What is Global Privacy Control?
Global Privacy Control (GPC) is a browser-level privacy signal that automatically tells every website you visit not to sell or share your personal data. The browser attaches it to every request as an HTTP header (Sec-GPC: 1), and in 12 US states businesses are legally required to honor it. One setting covers the entire web, instead of opting out site by site.
The idea was introduced at the W3C Privacy Community Group in April 2020 and launched publicly on October 7, 2020, backed by an unusually broad coalition: the Electronic Frontier Foundation, DuckDuckGo, Brave, Mozilla, Consumer Reports, Disconnect, Abine, and major publishers including The New York Times, The Washington Post and the Financial Times. It was spearheaded by Ashkan Soltani, who would later become the first Executive Director of California’s privacy regulator, and Sebastian Zimmeck of Wesleyan University.
Where does the standard stand today? As of mid-2026, GPC is a Working Draft published by the W3C Privacy Working Group on the Recommendation track. In plain terms, it is an official, actively developed web standard-in-progress, not yet a finished W3C Recommendation. That technical status matters less than the legal status, which is where GPC gets its real power (more on that below).
How GPC works under the hood
There is nothing mysterious about the mechanism. When you enable GPC, your browser does two things:
- It adds an HTTP header,
Sec-GPC: 1, to the requests it sends. When GPC is off, the header is simply absent. - It exposes a read-only property,
navigator.globalPrivacyControl, that JavaScript on the page can read astrue.
A website (or the consent tool it uses) detects the signal either server-side by reading the header, or client-side in a couple of lines:
if (navigator.globalPrivacyControl) {
// Treat this visitor as having opted out of sale/sharing
}A site can also publicly declare that it honors GPC by publishing a small file at /.well-known/gpc.json.
One point is essential and often misunderstood: GPC is a signal, not a blocker. Your browser announces your preference, but it is the receiving website that must act on it. GPC does not, by itself, stop a single tracker from loading. It works only when the site, or its cookie-consent tool, chooses (or is legally required) to honor it.
GPC vs Do Not Track: why this one sticks
If this sounds familiar, it should. A decade ago the web tried almost exactly the same thing and failed. That failure is the best way to understand why GPC is different.
| Do Not Track (DNT) | Global Privacy Control (GPC) | |
|---|---|---|
| Introduced | 2009 (HTTP header proposal) | April 2020 (W3C Privacy CG) |
| First browsers | Firefox, January 2011 | Brave, DuckDuckGo and others, October 2020 |
| Standardization | W3C Tracking Protection group, closed in January 2019 with no standard | W3C Working Draft on the Recommendation track |
| Legal force | None, ever | Binding in 12 US states |
| Where it ended up | Removed from Safari in 2019; Firefox deleted the checkbox in early 2025 | Enforced with fines; browsers legally required to ship it in California from 2027 |
Do Not Track was a polite request. A US law (CalOPPA) only ever required sites to disclose how they responded to it, which meant “we ignore it” was a perfectly legal answer. So sites ignored it. Browsers eventually gave up: Apple removed DNT from Safari in 2019, calling it an expired standard that had become a fingerprinting vector, and Firefox removed the DNT checkbox entirely in early 2025, pointing users to GPC instead.
GPC learned the lesson. It was purpose-built to map onto an existing legal right, the right to opt out of the sale or sharing of personal data under US state law. The GPC project’s own explanation is blunt: Do Not Track requests did not clearly convey users’ intent to opt out of the sale of their data, and GPC was designed to fix exactly that.
The one-line version: Do Not Track asked politely. GPC files a legal request.
Which browsers support GPC?
Support is uneven, and it is the fastest-changing part of this whole topic. Here is where things stand as of mid-2026 (worth re-checking, since this moves).
| Browser | GPC support | On by default? | Where to find it |
|---|---|---|---|
| Brave | Native | Yes (desktop and Android) | Shields settings |
| DuckDuckGo (browser, apps, extension) | Native | Yes | Enabled automatically |
| Firefox | Native (desktop since v120) | Private windows only; opt-in for normal browsing | Settings, Privacy and Security |
| Mullvad Browser | Native (since v14.0) | Yes | Enabled automatically |
| Chrome | None | Extension required | Install Privacy Badger or OptMeowt |
| Edge | None | Extension required | Install Privacy Badger or OptMeowt |
| Safari | None | No native support, and no mainstream GPC extension either | Not currently available |
The two big gaps are Chrome and Safari. Chrome has no native support, but browser extensions such as Privacy Badger (from the EFF) or OptMeowt fill the gap.
Can you get GPC in Safari or on iPhone?
Not natively. Safari has no built-in GPC setting and no mainstream extension that adds one. On iPhone, the practical route is the DuckDuckGo browser app, which sends GPC by default.
That may not last. In October 2025 California enacted the “Opt Me Out Act” (AB 566), which requires browsers operating in California to include a built-in opt-out preference signal setting by January 1, 2027. In other words, the browsers that skipped GPC will soon have to add it. Neither Google nor Apple has announced an implementation yet, but the deadline is set.
How to enable GPC (step by step)
To enable GPC: in Firefox, check “Tell websites not to sell or share my data” under Privacy and Security; in Brave, DuckDuckGo and Mullvad it is already on by default; in Chrome or Edge, install a GPC extension such as Privacy Badger. The per-browser detail:
- Firefox: open Settings, go to Privacy and Security, and check “Tell websites not to sell or share my data.” Note that Firefox sends GPC automatically in private windows, but you have to tick this box to send it in normal browsing.
- Brave: nothing to do. GPC is on by default.
- DuckDuckGo (browser or mobile app): nothing to do. It is on by default.
- Mullvad Browser: on by default since version 14.0.
- Chrome or Edge: install a GPC-capable extension such as Privacy Badger or OptMeowt, and the signal will be sent automatically.
- Safari: there is no good option today. Use another browser for privacy-sensitive browsing, or wait for the 2027 requirement to take effect.
Want to confirm it works? Visit globalprivacycontrol.org in your browser. The page detects your signal and tells you whether it is being sent.
Where GPC is legally binding
This is where GPC stops being a nice idea and starts being a compliance obligation. The picture is very different on each side of the Atlantic.
United States: 12 states and counting
California is the anchor. Its Attorney General has held since July 2021 that GPC must be treated as a valid opt-out request. The regulation is explicit: a business that sells or shares personal information must process an opt-out preference signal that meets the regulation’s requirements as a valid request to opt out (11 CCR § 7025(b)). And it must be honored without friction, with no requirement to log in or verify identity first.
What happens if you ignore GPC?
This is not theoretical. Failing to honor opt-out signals has become the through-line of the largest privacy fines in US history, and the pace picked up sharply in 2026:
| When | Who | Regulator | Amount | The opt-out failure |
|---|---|---|---|---|
| Aug 2022 | Sephora | California Attorney General | $1.2M | Did not process GPC opt-out signals at all (the first public CCPA enforcement action) |
| Jul 2025 | Healthline | California Attorney General | $1.55M | Kept sharing visitor data for targeted advertising even after users opted out via GPC |
| Sep 2025 | Tractor Supply | California Privacy Protection Agency | $1.35M | Lacked effective opt-out mechanisms, including browser-based GPC signals (the largest fine in the CPPA’s history) |
| Sep 2025 | Enforcement sweep | CPPA plus the Attorneys General of California, Colorado and Connecticut | Letters, not fines | Coordinated investigation of businesses ignoring opt-out preference signals |
| Feb 2026 | Disney and ABC | California Attorney General | $2.75M | Did not treat opt-out preference signals as valid opt-out requests, and scattered the opt-out across devices and apps (the largest CCPA settlement to date) |
| Mar 2026 | PlayOn Sports | California Privacy Protection Agency | $1.1M | Failed to recognize opt-out preference signals, and its consent banner made using the ticketing platform conditional on accepting trackers |
| Mar 2026 | Ford | California Privacy Protection Agency | $375,703 | Required consumers to verify their email before processing an opt-out, and was ordered to audit its tracking technologies and fix its handling of opt-out preference signals |
The pattern is consistent: the regulator turns on GPC in a browser, visits the site, and watches what the trackers do. Detection is not hypothetical, it is the test.
California is no longer alone. As of January 1, 2026, twelve states require businesses to honor universal opt-out signals like GPC: California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon and Texas. Colorado went further, formally approving GPC as the first (and so far only) recognized universal opt-out mechanism. Not every state law includes this duty (several Virginia-style laws do not), which is exactly why it pays to know which states apply to your audience.
Europe: not binding, yet
In the EU today, GPC has no formal legal force. No European regulator recognizes it as binding, and the reason is structural: the GDPR is built on opt-in consent (you must get permission before loading non-essential trackers), while GPC is an opt-out signal. The two do not line up. That leads to the single most important takeaway for European sites: GPC does not replace your cookie consent banner. GPC’s own FAQ says the signal on its own does not create legally binding obligations.
Will GPC replace cookie banners in Europe?
Not today, and the timeline just got murkier. The GDPR requires opt-in consent before non-essential trackers load, so an EU website still needs a cookie banner even for visitors who send GPC. The Digital Omnibus proposal (November 2025) would change that by making browser-level signals binding, but member states could not agree: a Council compromise text in June 2026 proposed deleting the provision outright, then failed to win a qualified majority and was pulled. The Council still has no agreed position. Plan on keeping your banner.
There is a live debate and a live proposal, though. The GDPR already anticipates automated objections in Article 21(5). And in November 2025 the European Commission proposed the “Digital Omnibus,” which would move cookie-consent rules into the GDPR and, through a new Article 88b, require controllers to respect machine-readable browser-level signals, with GPC as the obvious leading candidate (the proposal itself is signal-agnostic, and the exact technical standard would be settled later). The EDPB and EDPS, in their joint opinion of February 2026, welcomed the idea.
Then it stalled. In June 2026 the Council presidency circulated a compromise text that deleted Article 88b outright, after heavy lobbying from the advertising industry, with Germany, France and Poland among the member states backing its removal. That text did not survive either: it was pulled from the ambassadors’ approval process in late June for lack of a qualified majority, and the file moved to the incoming Irish presidency with the Council still holding no agreed position. The European Parliament has not positioned itself yet, and its committee vote is the next thing to watch. So the honest status is not “browser signals are coming to Europe” and not “they are dead”, but “member states could not even agree on a mandate to negotiate them”.
If you want the deeper contrast between the two regimes, we cover it in CCPA vs GDPR: key differences for website owners.
Does Europe have its own version of GPC?
Not a binding one, but the building blocks exist. ADPC (Advanced Data Protection Control), a specification from noyb and Vienna University of Economics and Business, extends the GPC idea to GDPR-style granular consent, refusal and objection. It remains voluntary, and no browser ships it by default. Germany has gone furthest: its EinwV regulation, in force since April 2025, lets the federal data protection authority officially recognize consent management services, and the first one was recognized in October 2025. Honoring it stays optional for websites, which is the system’s acknowledged weakness. Case law is inching the same way: a Berlin court held in 2023 that a browser’s Do Not Track signal can express a valid automated objection under Article 21(5) GDPR (LG Berlin, 16 O 420/19, not yet final). If Article 88b survives the Council and the Parliament, Europe will finally pick its official signal. If it does not, these scattered national efforts are what Europe has.
What your website must do about GPC
If you run a website, here is the practical checklist.
- Detect the signal: read the
Sec-GPCheader server-side, ornavigator.globalPrivacyControlin the browser. - Honor it where required: in the 12 US states above, treat it as a valid opt-out of the sale or sharing of personal data (and of targeted advertising), immediately and without asking the visitor to log in.
- Let it override earlier consent: if the visitor previously agreed to tracking on your site, the signal wins. California’s rules are explicit that the opt-out preference signal takes precedence over a site-specific permission given earlier (§ 7025(c)(3)).
- Apply it to the person, not just the browser: if you know who the visitor is (they are logged in, or you can otherwise identify them), the opt-out must extend to their account and profile, not only to that browser session.
- Show that you honored it: this is new. Since January 1, 2026, California requires businesses that sell or share personal information to display whether they have processed a consumer’s opt-out preference signal. The regulator even suggests a label along the lines of “Opt-Out Request Preference Signal Honored.” Processing the signal silently is no longer enough.
- Declare your support (optional): publish a
/.well-known/gpc.jsonfile stating that you honor GPC. - In the EU: you have no obligation to act on GPC today, but treating it as a refusal is the privacy-maximizing, GDPR-compatible reading. Never treat GPC as consent to anything.
That fifth point (proving you honored the signal) is not a formality. When California settled with Disney in February 2026, part of the deal was that Disney must give consumers a way to confirm their opt-out request had been processed. Combined with the tri-state enforcement sweep, “we detect it but show nothing” is now a live compliance gap. It is one of several changes that landed in 2026, which we unpack in CCPA 2026: seven new changes for your website. And if you run Google tags, your consent signals need to reach them correctly too, which is what Google Consent Mode v2 is for.
How the WebLegal cookie banner handles GPC
This is the part I care about most, because it is why we built our free cookie banner the way we did.
Our banner honors GPC natively. When a visitor arrives with the signal on, it applies their refusal before a single tracker loads, and it does so without showing them a banner at all. Someone who has already told their browser “do not sell or share my data” should not be greeted by a consent pop-up asking the same question. The trackers stay blocked, and a floating button lets the visitor reopen their choices if they ever want to change them.
And to meet that new California duty, the banner now shows GPC visitors a short, dismissable notice confirming their signal was honored, translated into all 30 of the languages we support. It is the “show that you processed the signal” requirement, handled for you. Site owners who prefer not to display it can switch it off with a single attribute (data-gpc-notice="off").
It is free, there is no signup, and it installs with a single line of JavaScript. If you want the technical detail on what it blocks and how, see our guide to the free GDPR-compliant cookie banner, or read up on the 37+ trackers a cookie banner must block before consent.
Frequently asked questions
Is GPC legally required in the EU? No. The GDPR is based on opt-in consent, so a compliant cookie consent banner is still required in the EU, and GPC does not replace it. The Digital Omnibus proposal could change this in the future, but it is not law today.
Does GPC block cookies or trackers? No. GPC is a signal, not a blocker. Whether anything is actually blocked depends on the website, or its consent tool, choosing to honor the signal. On its own, GPC stops nothing.
Does GPC make cookie banners redundant? Not in general. In the US it automates the opt-out for signal-sending visitors, but in the EU consent is opt-in, so a banner is still needed. Think of GPC and a consent banner as complementary, not interchangeable.
Does GPC turn off Google Analytics or Google Ads? Not by itself. GPC only announces the visitor’s choice. Your consent tool has to read the signal and pass the refusal to Google Consent Mode, which then restricts how Google Analytics and Google Ads process that visitor’s data. If your setup never translates the signal, Google tags carry on as if nothing happened, which is exactly the failure regulators fined Healthline and Tractor Supply for.
What is a universal opt-out mechanism (UOOM)? It is the legal term several state laws use for signals like GPC: a browser-level mechanism that communicates an opt-out for every site at once. Colorado formally approved GPC as the first recognized universal opt-out mechanism, and most of the twelve US states with this duty use the same concept in their statutes.
How do I know a site honored my GPC signal?
Since January 2026, California businesses that sell or share personal information must display that they processed it, so look for a notice confirming your signal was honored. Some sites also publish a /.well-known/gpc.json file declaring their support.
Is GPC on by default? In Brave, DuckDuckGo and Mullvad, yes. In Firefox it is on in private windows and opt-in for normal browsing. Chrome, Edge and Safari have no native support, so you need an extension (or, for Safari, no current option).
Check where you stand
Two quick checks, one per hat.
As a web user: turn GPC on with the steps above, then open globalprivacycontrol.org, which detects your signal and tells you whether it is being sent. Thirty seconds, and it covers every site you will ever visit.
As a site owner: if your audience includes the twelve states above, GPC handling is now inspected and fined, so find out where you stand. Scan your website for free to see how your cookie and legal-page setup looks from the outside, then add the free cookie banner, which honors GPC (California notice included) in one line of JavaScript.
