Global Privacy Control: which states require it and how to honor it

Global Privacy Control (GPC) is a setting in the visitor's browser that tells every website "do not sell or share my personal information". In twelve US states, a business covered by the state privacy law must treat it as a valid opt-out request: California, Colorado, Connecticut, Texas, Oregon, Montana, Delaware, New Jersey, New Hampshire, Nebraska, Minnesota and Maryland. Sites detect it with the Sec-GPC: 1 HTTP header or the navigator.globalPrivacyControl property in JavaScript, and honoring it means stopping the sale or sharing of that visitor's data, in practice switching off advertising tags, without asking them to click anything.

What is Global Privacy Control?

GPC is a specification developed at the W3C. When the visitor turns it on, the browser sends the header Sec-GPC: 1 with every request and exposes navigator.globalPrivacyControl as true to scripts. The signal says nothing else: no categories, no per-site exceptions. The GPC website lists Brave, DuckDuckGo's browser and Firefox among the browsers that support it (on by default in Brave and DuckDuckGo, a setting in Firefox), plus extensions such as Privacy Badger. Chrome, Safari and Edge do not offer it natively today.

That will change in California. The Opt Me Out Act (AB 566), signed on 8 October 2025, requires browsers operating in California to include a built-in opt-out preference signal setting from January 2027. Expect the share of visitors sending a signal to grow.

Which states require you to honor it?

The obligation applies to businesses that meet each law's thresholds; the US state privacy laws page has them. Because the signal does not say where the visitor lives, and geolocation is approximate, most businesses honor it for every US visitor.

What does honoring it mean?

The signal is an opt-out of the sale of personal data, of sharing for cross-context behavioral advertising (California's term), and of targeted advertising (the term in most other states). For a website, that usually means:

• advertising pixels and retargeting tags (Meta, Google Ads remarketing, TikTok, LinkedIn) do not fire, or fire in a restricted mode;
• data is not passed to ad tech partners for targeting;
• if the visitor is logged in, the opt-out is applied to their account, not only to the browser.

California's regulations, as updated from 1 January 2026, also require a business to display whether it has processed the signal as a valid opt-out request, for example with a short note in the preferences panel such as "Opt-out preference signal honored".

Analytics for your own site, with the provider acting as your processor, is generally neither a sale nor targeted advertising, so it can keep running. Google Analytics linked to Google Ads audiences is a different story.

How do you detect GPC?

In the browser:

js
if (navigator.globalPrivacyControl === true) {
  // treat as an opt-out of sale, sharing and targeted advertising
}

On the server, read the request header:

text
Sec-GPC: 1

The browser property reflects the value sent when the page loaded. The specification also lets a site publish /.well-known/gpc.json with a gpc boolean and a lastUpdate date to declare that it honors the signal.

How does it work with a consent banner?

In the EU and UK, nothing advertising-related runs before an opt-in anyway, so GPC adds little there. The interplay matters in US states, where the banner is usually an opt-out notice with a "Do Not Sell or Share" link, as explained in the Do Not Sell link article. When GPC is on:

1. Record the opt-out as if the visitor had clicked the link.
2. Do not load the advertising category.
3. Do not show a prompt asking them to undo it on arrival.
4. Show in the preferences that the signal was honored.

If the visitor later opts in explicitly on your site, the CCPA regulations explain how to handle a conflict with an earlier setting; get advice before building that flow.

Has anyone been fined for ignoring it?

Yes. The California Attorney General's first CCPA settlement, with Sephora in August 2022 ($1.2 million), included failing to process opt-out requests sent through GPC. Tractor Supply's $1.35 million settlement with the California Privacy Protection Agency in September 2025 also concerned opt-out failures, and on 9 September 2025 California, Colorado and Connecticut announced a joint investigative sweep of businesses that do not process opt-out requests sent through GPC.

How do you test it?

Install a browser with GPC on (Brave, or Firefox with the setting enabled), open the site from a US location, and check in the developer tools that no advertising request leaves the browser and that the preferences show the opt-out. Then check the consent or opt-out log for the recorded request. Cookie banner requirements by country explains how the US setup sits next to the EU banner.

Using a consent tool

Cookiequiet honors GPC as an opt-out on every plan, including the free one: for visitors in US states with a privacy law, the opt-out notice mode records the signal as an opt-out, keeps the marketing category off, and writes the event to the consent log. Setup is one script tag before your other scripts, with geo-targeting included, about five minutes from sign-up to a live banner.