Guide · Browser signal

Global Privacy Control: when the browser says no for you

The GPC is an automatic notice that the browser sends to every site saying that the person does not want their data sold or shared. In several US states, ignoring this notice has already led to fines. Here is how to respond and how to test.

Check whether my site honors the GPC Read the guide

✓Based on the GPC specification and official state sources
✓A test anyone can do in the browser
✓Read-only scan, no changes to the site

3browsers with built-in GPC: Brave, DuckDuckGo and Firefox

$1.2MSephora settlement in California for ignoring the GPC, in 2022

2024year Colorado began requiring the GPC, from July 1

3states in the joint sweep of September 2025: California, Colorado and Connecticut

What it is

A privacy notice that travels with every visit

The Global Privacy Control, or GPC, is a browser setting. When the person turns this option on, the browser tells every site they visit that they do not want their personal data sold or shared.

The big difference from a cookie banner is that nobody has to click anything on your site. The refusal arrives ready-made, even before the page loads. The site only has to read the notice and obey it.

The GPC already comes in Brave and DuckDuckGo, where it is on by default, and in Firefox, where the person turns it on in settings. Extensions such as Privacy Badger, Disconnect and OptMeowt also send the signal in other browsers.

The proposal started in 2020, in a W3C group, the organization that creates web standards. In November 2024, it became an official work item of the W3C Privacy Working Group, where it is being standardized.

Checklist

What you need to meet

These obligations apply where the law requires GPC, such as California, Colorado and Connecticut, for companies within the thresholds of each law.

Treat the signal as a valid opt-out
In California, GPC is a valid opt-out request. In Colorado, since July 1, 2024, it counts as an opt-out of sale and targeted advertising. In Connecticut, the obligation has applied since January 1, 2025.
2
Read the signal before the tags
The browser signals it through the Sec-GPC header with value 1 and the navigator.globalPrivacyControl property. The official GPC guide asks for the script to be as early as possible on the page.
```
// Lê o GPC antes das tags e liga o RDP na GPT
if (navigator.globalPrivacyControl === true) {
  googletag.cmd.push(function () {
    googletag.pubads().setPrivacySettings({
      restrictDataProcessing: true
    });
  });
}
```
Do not ask for login or extra data
Colorado's rules prohibit requiring login to accept the signal and asking for more data than strictly necessary.
Explain GPC in the privacy policy
In Colorado, the policy must say how opt-outs by universal signal, such as GPC, are processed.
Example
We respect Global Privacy Control. If your browser sends this signal, we treat the visit as an opt-out of sale and targeted advertising.
Pass the opt-out to all partners
Google turns on RDP when the GPP string shows an opt-out, or when the tag asks for RDP. The same opt-out must reach header bidding and pixels.
Show the status of the choice
In California, the rules in force since 2026 require the site to show the visitor the status of their choice. In Colorado, showing that the signal was respected is allowed.
Example
Privacy panel: GPC signal received. Your opt-out was applied.

In practice

Right and wrong

WrongThe site only applies the opt-out if the visitor clicks again on a banner.
RightThe browser sends GPC and the site applies the opt-out right away, without asking for a click.
WrongPixels and ads fire before anyone reads the signal.
RightThe ad tags wait for the CMP to read GPC before loading.
WrongThe policy does not mention GPC or automatic browser signals.
RightThe policy says the site respects GPC and explains what happens to the visit.

Official tools

Certified CMPs and official links

GPC has no list of certified CMPs, and Google does not require a certified CMP in the US. Check that your CMP reads GPC and records the opt-out in the GPP string.

Definitions

The technical terms, made simple

These words appear in laws, in CMPs and in browser developer tools.

Sec-GPC header

The notice the browser sends to the server on every request. When the person has turned on the GPC, its value is exactly 1.

navigator.globalPrivacyControl

The same information made available to the page's scripts. It is true when the GPC is on and false when it is not.

gpc.json file

An optional file at the site's well-known address in which the owner declares that they honor the GPC, along with the date of the last update.

Sale and sharing

In California, sharing means using data for behavioral advertising across different sites. Programmatic ads usually fall here.

Targeted advertising

A term used by laws such as those of Colorado and Connecticut for ads chosen based on what the person does on other sites.

Universal opt-out signal

A generic name that laws use for automatic notices like the GPC. Each state says which signals it accepts.

Who it applies to

Where honoring the GPC is already an obligation

The laws apply to companies that meet each state's criteria, such as the volume of residents' data. Check with your legal team whether your site meets those criteria.

California

The attorney general says the GPC must be accepted by covered businesses as a valid request to stop selling or sharing data.

Colorado

Since July 1, 2024, covered businesses must honor the GPC. Today, it is the only universal signal the state accepts.

Connecticut

Since January 1, 2025, browser signals count as an opt-out of data sales and targeted advertising.

Oregon

Since January 1, 2026, residents can use a universal opt-out signal sent by the browser or an extension.

Other states

Other US state laws also deal with universal opt-out signals, with their own dates. The list changes often.

Outside the US

In Brazil and in Europe, the GPC does not replace the banner or consent. Even so, honoring the signal shows care for the visitor.

Visitor rights

What changes for the visitor who turns on the GPC

Under the law, the GPC is the same as the person clicking the Do Not Sell or Share My Personal Information link. The difference is that they do not have to find that link on every site.

After receiving the opt-out, the site can no longer sell or share that person's data, unless they authorize it again. In California, the official guidance is to honor opt-out requests as soon as possible, and no later than 15 business days.

In Connecticut, the signal applies even when it conflicts with the person's earlier choice or with a loyalty program. The site can point out the conflict and ask for confirmation, but it cannot simply ignore the signal.

The GPC does not ask the site to stop working or to hide ads. Ads keep appearing. They just cannot use that person's data for sale, sharing or targeted advertising.

Site obligations

How the site should respond to the GPC

Detect the signal earlyThe CMP or a script at the top of the page reads the signal before any ad or marketing tag loads.
Apply the opt-out right awayMark the visitor as opted out of sale, sharing and targeted advertising, without asking for a click or a form.
Pass the opt-out to partnersUpdate the GPP string, with the opt-out and the GPC field of the national section, so that Google and the other partners receive the same notice.
Show that the signal was honoredA sentence such as We received your privacy signal in the preferences panel helps the visitor and serves as a record for the site.
Test in a browser with GPCTurn on the GPC in Firefox or use Brave, open the site and check in the console and in the network requests that the opt-out was applied.

Reading the signal in the browser and an optional declaration file

// Lê o GPC antes das tags de anúncio
if (navigator.globalPrivacyControl === true) {
  // trate como recusa de venda, compartilhamento
  // e publicidade direcionada
  // a CMP deve refletir isso na GPP string
}

// Opcional: /.well-known/gpc.json
{ "gpc": true, "lastUpdate": "2026-11-02" }

AdSense and Ad Manager

How the GPC opt-out reaches Google ads

The GPC talks to your site, not directly to each ad partner. That is why the safest path is for the CMP to turn the signal into an opt-out recorded in the GPP string.

Ad Manager reads the US national section and the sections for California, Colorado, Connecticut, Florida and Virginia. When the string shows an opt-out of sale, sharing or targeted advertising, Google turns on restricted data processing.

With that, the ad is still shown, but without personalization based on that visitor's data. Revenue per visit usually drops a little, but the site stops running the risk of ignoring a valid opt-out.

Watch out for header bidding and extra networks. If only Google's tag receives the opt-out, other buyers in the auction keep using the data as if the visitor had never opted out.

Timeline

From experiment to enforcement

In a few years, the GPC went from a technical proposal to a target of joint enforcement among states.

2020
Proposal at the W3C
The GPC starts in a W3C privacy community group.
August 24, 2022
Sephora case
California's attorney general announces a $1.2 million settlement. One of the allegations is failing to process opt-outs sent through the GPC.
July 1, 2024
Colorado requires the GPC
Businesses covered by Colorado's law start honoring the GPC as an opt-out of sale and targeted advertising.
November 2024
Official W3C item
The GPC begins to be standardized by the W3C Privacy Working Group.
January 1, 2025
Connecticut requires browser signals
Signals such as the GPC now count as an opt-out of sale and targeted advertising.
September 9, 2025
Joint sweep
California, Colorado and Connecticut send letters to companies that appear not to honor the GPC.
January 1, 2026
Oregon adopts the universal signal
Oregon residents can now use a universal opt-out signal through the browser.

Enforcement

Who enforces it and what has already happened

Enforcement is by each state's attorney general and, in California, also by the state privacy agency. They can investigate, require fixes and apply the penalties set out in each law.

The first big case was Sephora, in 2022. California's attorney general said the company did not process opt-outs sent through the GPC and did not fix the problem within the period the law allowed at the time. The settlement was $1.2 million.

In September 2025, California, Colorado and Connecticut ran a joint sweep and sent letters to companies that did not appear to honor the GPC, asking for an immediate fix.

The test the authorities run is simple: turn on the GPC in the browser and see whether the site keeps sending data to ad partners. Anyone can repeat this test.

Common errors

What makes a site ignore the GPC without noticing

In most cases, the site owner thinks everything is fine because the banner appears.

CMP not reading the GPC

The option exists in the CMP, but it is turned off. The signal arrives and nobody reads it.

Tags before the CMP

Pixels and ads load before the CMP reads the signal. The first data has already gone out by the time the opt-out is applied.

Opt-out only in the CMP cookie

The CMP records the opt-out but does not update the GPP string. Partners never find out.

Requiring a click to confirm

The site shows a notice asking the person to confirm the opt-out before applying it. The signal already is the opt-out.

Header bidding left out

The opt-out reaches Google but not the other buyers in the auction.

Only for California

The signal is honored for one state and ignored in the others where it is also required.

In practice

What is and is not allowed with the GPC

Everyday examples for sites with visitors from the United States.

Allowed

Keep showing ads, without personalization using the person's data
Show in the preferences panel that the signal was received
Point out a conflict with an earlier choice and ask for confirmation
Publish the gpc.json file declaring that the site honors the signal
Apply the same opt-out to all auction partners

Not allowed

Ignore the signal because the visitor did not click the banner
Require a login, email or form to accept the opt-out
Load marketing pixels before reading the signal
Block the content for people who use the GPC
Undo the opt-out on the next visit without new authorization

In ConsentMode

What the audit checks about the GPC

Opens the site twice, with and without the GPC signal, as a US visitor.
Compares the tags and ad requests that fire on each visit.
Reads the GPP string and checks that the opt-out and the GPC field appear when the signal is on.
Checks whether the gpc.json file exists and whether the preferences panel shows the signal.
Delivers screenshots of each visit and the fix to make in the CMP or the tags.

Run an audit See everything that is checked

Frequently asked questions

Does the GPC replace the cookie banner?

No. The banner is still needed where the law requires notice or consent. The GPC is an automatic opt-out that the site must honor, with or without a banner.

My site is Brazilian. Do I need to worry?

If you have visitors from the US and your business meets the criteria in the state laws, yes. For your audience in Brazil, the LGPD does not mention the GPC, but honoring the signal does not hurt your ads.

Does honoring the GPC remove the ads from the page?

No. The ads stay. They just cannot use that visitor's data for sale, sharing or targeted advertising.

How do I turn on the GPC to test?

In Firefox, turn the option on in the privacy settings. In Brave and DuckDuckGo, the signal is already on. Then type navigator.globalPrivacyControl in the console: the result should be true.

Is the gpc.json file mandatory?

No. It is an optional declaration provided for in the specification. What counts for the law is that the site actually applies the opt-out.

Does Google read the GPC on its own?

Do not count on it. The safe path is for the CMP to turn the signal into an opt-out in the GPP string, which Ad Manager reads and uses to restrict data processing.

Library

Official sources

This guide was written from these official pages. Read them directly at the source:

See what your site does when the browser says no

The audit visits the site with and without the GPC and shows the difference, without changing anything.

Start the audit