GPC
Global Privacy Control (GPC) is a browser setting that sends a Sec-GPC: 1 header and a JavaScript flag to every website, telling it that the visitor refuses the sale or sharing of their personal data, which several US state laws require businesses to honor as a valid opt-out.GPC was published in 2020 by a group of browser makers, publishers and privacy organizations as a successor to Do Not Track, with a legal basis built in. The specification is simple: a browser or extension adds the header Sec-GPC: 1 to requests and exposes navigator.globalPrivacyControl to scripts. Brave and DuckDuckGo send it by default, Firefox has a setting for it, and extensions such as Privacy Badger add it to other browsers.
The legal force comes from US state law. California's CCPA regulations (section 7025) require businesses to treat an opt-out preference signal as a valid request to opt out of the sale and sharing of personal information, and since 1 January 2026 to display that the signal was processed; Sephora (2022) and Tractor Supply (2025) were penalized partly for ignoring it. Colorado lists GPC as its only recognized universal opt-out mechanism, Connecticut has required recognition since 1 January 2025, Oregon since 1 January 2026, and Texas, Montana, Delaware, New Jersey, New Hampshire, Nebraska, Minnesota and Maryland have the same rule. In the EU it has no formal status.
A compliant site reads the signal on the server or in the browser, treats it as an opt-out of marketing cookies and sharing for the browser (and for the account if the visitor is logged in), and records it. Cookiequiet honors GPC as an opt-out automatically. See US state privacy laws.