# Global Privacy Control: which states require it and how to honor it

> Global Privacy Control is a browser opt-out signal twelve US states make binding. How to detect Sec-GPC and navigator.globalPrivacyControl, and what to do.

Source: https://cookiequiet.com/guides/global-privacy-control
Published: 2026-10-21
Publisher: Cookiequiet

## Steps

1. **List what counts as sale or sharing** Identify every tag and data flow used for targeted advertising or shared with ad tech partners: pixels, remarketing, audience syncs.
2. **Detect the signal** Read navigator.globalPrivacyControl in the browser, and the Sec-GPC header on the server if you share data server-side.
3. **Apply the opt-out** When the signal is on, keep advertising tags off and stop passing data to partners for targeting, for that browser and the logged-in account.
4. **Show that it was honored** Display in the preferences panel or privacy page that the opt-out preference signal was processed.
5. **Record it** Log the opt-out with the date, the source (GPC) and the banner version, as you would a click on the Do Not Sell or Share link.
6. **Test with a GPC browser** Load the site in Brave or in Firefox with GPC enabled and confirm in the developer tools that no advertising request is sent.

Global Privacy Control (GPC) is a setting in the visitor's browser that tells every website "do not sell or share my personal information". In twelve US states, a business covered by the state privacy law must treat it as a valid opt-out request: California, Colorado, Connecticut, Texas, Oregon, Montana, Delaware, New Jersey, New Hampshire, Nebraska, Minnesota and Maryland. Sites detect it with the `Sec-GPC: 1` HTTP header or the `navigator.globalPrivacyControl` property in JavaScript, and honoring it means stopping the sale or sharing of that visitor's data, in practice switching off advertising tags, without asking them to click anything.

## What is Global Privacy Control?

GPC is a specification developed at the W3C. When the visitor turns it on, the browser sends the header `Sec-GPC: 1` with every request and exposes `navigator.globalPrivacyControl` as `true` to scripts. The signal says nothing else: no categories, no per-site exceptions. The GPC website lists Brave, DuckDuckGo's browser and Firefox among the browsers that support it (on by default in Brave and DuckDuckGo, a setting in Firefox), plus extensions such as Privacy Badger. Chrome, Safari and Edge do not offer it natively today.

That will change in California. The Opt Me Out Act (AB 566), signed on 8 October 2025, requires browsers operating in California to include a built-in opt-out preference signal setting from January 2027. Expect the share of visitors sending a signal to grow.

## Which states require you to honor it?

| State | Requires honoring a universal opt-out signal |
|---|---|
| California | Yes (CCPA regulations, section 7025) |
| Colorado | Yes, since 1 July 2024; GPC is the only mechanism on the Attorney General's recognized list |
| Connecticut | Yes, since 1 January 2025 |
| Texas, Montana, Delaware, New Jersey, New Hampshire, Nebraska, Minnesota, Maryland | Yes |
| Oregon | Yes, since 1 January 2026 |
| Virginia, Utah, Iowa, Tennessee, Indiana, Kentucky, Rhode Island | No |

The obligation applies to businesses that meet each law's thresholds; the [US state privacy laws page](/laws/us-state-privacy-laws) has them. Because the signal does not say where the visitor lives, and geolocation is approximate, most businesses honor it for every US visitor.

## What does honoring it mean?

The signal is an opt-out of the sale of personal data, of sharing for cross-context behavioral advertising (California's term), and of targeted advertising (the term in most other states). For a website, that usually means:

- advertising pixels and retargeting tags (Meta, Google Ads remarketing, TikTok, LinkedIn) do not fire, or fire in a restricted mode;
- data is not passed to ad tech partners for targeting;
- if the visitor is logged in, the opt-out is applied to their account, not only to the browser.

California's regulations, as updated from 1 January 2026, also require a business to display whether it has processed the signal as a valid opt-out request, for example with a short note in the preferences panel such as "Opt-out preference signal honored".

Analytics for your own site, with the provider acting as your processor, is generally neither a sale nor targeted advertising, so it can keep running. Google Analytics linked to Google Ads audiences is a different story.

## How do you detect GPC?

In the browser:

```js
if (navigator.globalPrivacyControl === true) {
  // treat as an opt-out of sale, sharing and targeted advertising
}
```

On the server, read the request header:

```text
Sec-GPC: 1
```

The browser property reflects the value sent when the page loaded. The specification also lets a site publish `/.well-known/gpc.json` with a `gpc` boolean and a `lastUpdate` date to declare that it honors the signal.

## How does it work with a consent banner?

In the EU and UK, nothing advertising-related runs before an opt-in anyway, so GPC adds little there. The interplay matters in US states, where the banner is usually an opt-out notice with a "Do Not Sell or Share" link, as explained in [the Do Not Sell link article](/blog/do-not-sell-link-ccpa). When GPC is on:

1. Record the opt-out as if the visitor had clicked the link.
2. Do not load the advertising category.
3. Do not show a prompt asking them to undo it on arrival.
4. Show in the preferences that the signal was honored.

If the visitor later opts in explicitly on your site, the [CCPA](/laws/ccpa-cpra) regulations explain how to handle a conflict with an earlier setting; get advice before building that flow.

## Has anyone been fined for ignoring it?

Yes. The California Attorney General's first CCPA settlement, with Sephora in August 2022 ($1.2 million), included failing to process opt-out requests sent through GPC. Tractor Supply's $1.35 million settlement with the California Privacy Protection Agency in September 2025 also concerned opt-out failures, and on 9 September 2025 California, Colorado and Connecticut announced a joint investigative sweep of businesses that do not process opt-out requests sent through GPC.

## How do you test it?

Install a browser with GPC on (Brave, or Firefox with the setting enabled), open the site from a US location, and check in the developer tools that no advertising request leaves the browser and that the preferences show the opt-out. Then check the consent or opt-out log for the recorded request. [Cookie banner requirements by country](/guides/cookie-banner-requirements-by-country) explains how the US setup sits next to the EU banner.

## Using a consent tool

Cookiequiet honors GPC as an opt-out on every plan, including the free one: for visitors in US states with a privacy law, the opt-out notice mode records the signal as an opt-out, keeps the marketing category off, and writes the event to the consent log. Setup is one script tag before your other scripts, with geo-targeting included, about five minutes from sign-up to a live banner.

## Questions

### Do I have to honor GPC outside the twelve states?

Not under a state law, but because the signal does not reveal where the visitor lives and location detection is approximate, most businesses honor it for every US visitor. It is simpler and avoids errors near state borders and with VPNs.

### Does GPC replace the Do Not Sell or Share link?

No. The link must still be there for visitors who do not use a GPC browser. GPC is an additional way to opt out that you must respect automatically in the states that require it.

### Should GPC turn off analytics too?

Not necessarily. GPC is an opt-out of sale, sharing and targeted advertising. Analytics used only for your own site, with the provider acting as your processor, is usually neither, but analytics linked to advertising audiences is.

### Which browsers send GPC?

Brave and DuckDuckGo's browser send it by default, Firefox offers it as a setting, and extensions such as Privacy Badger add it to other browsers. California's Opt Me Out Act will require browsers operating in California to offer such a setting from January 2027.

## Sources

- [W3C, Global Privacy Control (GPC) specification](https://w3c.github.io/gpc/)
- [Global Privacy Control, official site (supporting browsers and extensions)](https://globalprivacycontrol.org/)
- [Colorado Attorney General, Universal Opt-Out and the Colorado Privacy Act](https://coag.gov/opt-out/)
- [Connecticut Attorney General, The Connecticut Data Privacy Act](https://portal.ct.gov/ag/sections/privacy/the-connecticut-data-privacy-act)
- [Oregon Department of Justice, Oregon Consumer Privacy Act](https://www.doj.state.or.us/consumer-protection/id-theft-data-breaches/privacy/)
- [CPPA, CCPA updates and new regulations, effective 1 January 2026](https://cppa.ca.gov/regulations/ccpa_updates.html)
- [CPPA, Governor signs AB 566, the California Opt Me Out Act (8 October 2025)](https://cppa.ca.gov/announcements/2025/20251008_2.html)
- [California Attorney General, Settlement with Sephora, $1.2 million (24 August 2022)](https://oag.ca.gov/node/556528)
- [CPPA, Tractor Supply to pay $1.35 million over CCPA violations (30 September 2025)](https://cppa.ca.gov/announcements/2025/20250930.html)
- [Connecticut Attorney General, Connecticut, California and Colorado announce joint investigative privacy sweep (September 2025)](https://portal.ct.gov/ag/press-releases/2025-press-releases/connecticut-california-and-colorado-announce-joint-investigative-privacy-sweep)