Global Privacy Control (GPC): what the signal is and how your app can honor it

Updated Oct 27, 2026 · Pewterkit Guides

Global Privacy Control (GPC) is a browser setting that tells every site a visitor opens "do not sell or share my data". It arrives as the HTTP header Sec-GPC: 1 and as navigator.globalPrivacyControl === true in JavaScript. California's privacy regulator says covered businesses must honor opt-out preference signals such as GPC (the regulations apply this to businesses that sell or share personal information), so the practical step for an app with ad pixels is: when the signal is on, treat the visitor as opted out and keep those pixels off.

Who sends GPC

The GPC project lists Brave and DuckDuckGo's browser (on by default), Firefox (available in settings) and extensions including Privacy Badger and Disconnect. A GPC visitor has made a choice once, in the browser, and expects every site to respect it.

What the law says about it

  • The California Privacy Protection Agency's FAQ: "Businesses must honor opt-out preference signals ('OOPS') that meet certain requirements", with Global Privacy Control given as the example.
  • The CCPA regulations (11 CCR section 7025) say a business that sells or shares personal information "shall process any opt-out preference signal" that meets the requirements as a valid request to opt out of sale or sharing "for that browser or device".
  • The same section notes a signal may be "an HTTP header field or JavaScript object", which is exactly how GPC is delivered.
  • The GPC project also describes the signal as intended to communicate a "Do Not Sell or Share" request under the CCPA "and similar state laws".

Pair GPC with a visible link too: see the "Do Not Sell or Share" link.

How to detect it

The GPC specification defines both forms. A browser with GPC on "MUST generate a Sec-GPC header field with a field-value that is exactly" 1, and navigator.globalPrivacyControl is a read-only boolean that is true when that header would be sent.

In the browser, before you load ad pixels:

const gpc = navigator.globalPrivacyControl === true;

if (!gpc && userHasNotOptedOut()) {
  loadAdPixels(); // Meta, TikTok, Google Ads...
}

On a server or edge function:

// Only the exact value "1" counts, per the spec.
const gpc = request.headers.get("Sec-GPC") === "1";

Test this on a preview deployment before relying on it.

If a consent management platform loads your trackers, check its settings for a GPC or "opt-out preference signal" option and switch it on. That way the tool blocks the pixels for GPC visitors and records the choice for you.

Tell browsers you support it (optional)

The spec lets a site publish /.well-known/gpc.json:

{
  "gpc": true,
  "lastUpdate": "2026-10-27"
}

"gpc": true states that your site intends to honor GPC requests. Publish it only once your app actually does.

Show the visitor it worked

The CCPA regulations in effect from January 1, 2026 say a business "must display whether it has processed the consumer's opt-out preference signal" on its website, for example "Opt-Out Request Honored" when a GPC visitor arrives, or a switch shown as opted out. A short line on your privacy choices page does this.

These are plain-English starting points you can adapt; for anything specific to your business, a lawyer's quick review is worth it.

What Pewterkit Check looks for

A free check reads your homepage's public HTML and scripts. When it finds ad pixels, it looks for signs of GPC handling: globalPrivacyControl or Sec-GPC in your code, or a consent tool known to support GPC, in which case it tells you to switch GPC on in that tool.

FAQ

What does "GPC signal detected" mean on a website?

It means the site noticed your browser sent Global Privacy Control. Sites that honor it treat you as opted out of the sale or sharing of your data.

Do I need to honor GPC if I don't use ad pixels?

GPC is about selling or sharing personal information. If your app sends nothing to ad platforms or data brokers, there is little for the signal to switch off, though a short statement in your privacy policy helps visitors understand that.

Is GPC the same as Do Not Track?

They are different signals. California's CCPA rules treat opt-out preference signals such as GPC as valid opt-out requests for covered businesses, while CalOPPA asks your privacy policy to say how you respond to Do Not Track. See privacy policy for an app in the US.

Which header should my server check?

Sec-GPC. The spec says servers must ignore it unless its value is exactly 1.

Sources

  1. Global Privacy Control specification (W3C Privacy Working Group draft) — read 27 Oct 2026: Sec-GPC header, navigator.globalPrivacyControl, /.well-known/gpc.json
  2. Global Privacy Control — read 27 Oct 2026: browsers and extensions, intent under CCPA and similar laws
  3. California Privacy Protection Agency: FAQ — read 27 Oct 2026: businesses must honor opt-out preference signals
  4. CCPA Regulations, effective January 1, 2026 (California Privacy Protection Agency, PDF) — read 27 Oct 2026: section 7025 (processing the signal, HTTP header or JavaScript object, displaying that it was processed)

How this page was made: drafted with AI from the sources listed, reviewed by Pewterkit. Docs checked Oct 27, 2026. Spotted something out of date? Tell us.

Related guides