Global Privacy Control: The Browser Signal That Could Save Your Privacy (or Get You Sued)

What Is a Global Privacy Control Signal?

A Global Privacy Control (GPC) signal is a browser-based setting that tells websites you want to opt out of the sale or sharing of your personal information. Think of it as a digital 'Do Not Sell' button that travels with you across the web. Unlike cookie banners that ask for consent on every site, GPC works silently in the background, sending a universal opt-out request to every site you visit.

Under the California Consumer Privacy Act (CCPA) as amended by the CPRA, businesses must treat GPC signals as a valid request to opt out of the sale or sharing of personal information. That means if a user has GPC enabled, you are legally required to honor that signal—just as if they had clicked your 'Do Not Sell My Personal Information' link.

Do I Have to Respect GPC Signals?

Short answer: Yes, if you are subject to CCPA/CPRA. The California Attorney General has made it clear that ignoring GPC signals is a violation of the law. In fact, the AG’s office has already sent warning letters to companies that failed to honor these signals. So unless you enjoy being the star of a regulatory enforcement action, you need to implement GPC compliance.

But here’s the kicker: GPC is not just a California thing. Other states like Colorado, Connecticut, and Virginia have similar opt-out signal requirements in their privacy laws. And the trend is growing. So even if you think you’re safe because you’re not in California, you might still be on the hook.

How to Implement GPC Compliance

First, you need to detect the GPC signal. This is done via JavaScript that checks the navigator.globalPrivacyControl property. If it returns true, you must treat that user as having opted out of all sales and sharing. You should also check the Sec-GPC HTTP header on server-side requests.

Second, you need to actually stop the sale or sharing of that user’s data. That means updating your data flows, your consent management platform (CMP), and your data processing agreements with third parties. It’s not enough to just detect the signal; you have to operationalize the opt-out.

Third, you need to document your compliance. Keep logs of when GPC signals were received and how you responded. If the AG comes knocking, you’ll want to show you took it seriously.

Common Pitfalls (and How to Avoid Them)

One big mistake is assuming GPC only applies to 'sales' in the traditional sense. Under CPRA, 'sharing' for cross-context behavioral advertising is also covered. So if you use third-party analytics or ad networks, you’re likely sharing data and need to honor GPC.

Another pitfall is treating GPC as a one-time check. Users can enable or disable GPC at any time, and you need to respond in real time. Also, don’t forget that GPC applies to all users, not just California residents. If you can’t determine location, it’s safer to assume the signal is valid.

Finally, don’t rely solely on your CMP vendor to handle GPC. Many CMPs still don’t fully support it. You need to test your implementation end-to-end.

Featured Snippet Bait

Global Privacy Control (GPC) is a browser signal that automatically communicates your opt-out preference to every website you visit. Under CCPA/CPRA, businesses must treat GPC as a valid opt-out request and stop selling or sharing personal data for that user.

FAQ