Global Privacy Control checker

What it works out

Global Privacy Control, or GPC, is a browser setting that asks every site you visit not to sell or share your personal information. It travels two ways at once: as an HTTP header, Sec-GPC: 1, on every request, and as a property a script can read, navigator.globalPrivacyControl. It began at the W3C Privacy Community Group in April 2020 and became a work item of the W3C Privacy Working Group in November 2024, where it is still being standardised.

The checker reads that property in your own browser. Under the specification the property is true exactly when the browser sent the header with the page, so one reading answers both questions.

1. Open this page in the browser you want to test. The panel shows On, Off or Not built in.
2. Off, or not built in? Follow the line under the result, then reload the page.
3. Testing your own site? With the signal on, load it and check that ad and retargeting tags stay silent and that the site says the opt-out was honoured. The cookie banner checklist covers the rest of the banner.
4. Tick where your visitors live to list what each law asks, then copy or print the record and date it.

“Not built in” is the usual answer in Chrome, Edge and Safari, which have no native setting. That is changing in California: from 1 January 2027 a business may not develop or maintain a browser without a setting that sends an opt-out preference signal.

What a covered site must do

California’s regulations are the most detailed rulebook for the signal, so they make the working checklist. A business that sells or shares personal information and receives a qualifying signal must (CCPA regs § 7025):

1. Treat it as a valid request to opt out of sale and sharing for that browser or device and any profile tied to it, pseudonymous ones included. If it knows who the visitor is, the opt-out covers the person too. § 7025(c)(1)
2. Ask for nothing more. It may offer an optional form, say to reach offline sales, and use the answers only for the opt-out. § 7025(c)(2)
3. Let the signal beat a conflicting site setting. It may point out the conflict and ask for consent, but the opt-out stands until the person says otherwise. § 7025(c)(3)
4. Show the result on the site, for example “Opt-Out Request Honored”, and give the person a way to confirm it. § 7025(c)(6), § 7026(g)
5. Never read a later visit without the signal as opting back in. § 7025(c)(5)
6. Explain in the privacy policy how the signal is applied: to the device, the browser, the account, offline sales. § 7011(e)(3)(F)

The link, or a frictionless signal

Honouring the signal does not by itself retire the “Do Not Sell or Share” link. The regulation reads the statute’s choice narrowly: a business cannot pick between the links and the signal. Either it posts the links and still processes the signal, or it processes the signal frictionlessly and may leave the links off. Posting the links never excuses ignoring the signal. Frictionless means no fee, the same experience as everyone else, and no pop-up or banner in response to the signal; showing the opt-out status is allowed. It also needs a privacy policy line saying the business processes signals that way. § 7025(e)–(g)

Five cases from the regulation

The checker shows what a browser sent. What a business owes depends on what else it knows about the person. The regulation works through five cases:

Test both halves the way the cases do: once signed out, once signed in. The signed-in pass is the one that has to reach the account.

What enforcement looks like

The signal has already cost one retailer. On 24 August 2022 the California Attorney General settled with Sephora for $1.2 million, alleging among other things that it failed to process opt-outs sent by global privacy controls. The same day his office sent notices to other businesses over the same failure. The amounts and later cases are in CCPA penalties.

Reading the signal on your site

A site can read GPC in two places and gets the same answer from both. The server is the better one: it sees the header before a single tag is sent, while a script in the page runs after the page has started loading.

On the server

// Sec-GPC counts only when a value is exactly "1".
// Headers.get() joins repeated headers with ", ", so test each one.
function hasGpc(request) {
  const value = request.headers.get("sec-gpc");
  return value !== null && value.split(",").some((v) => v.trim() === "1");
}

// In the handler, before the page and its tags are built:
if (hasGpc(request)) {
  // 1. leave out tags that sell or share (ad, retargeting pixels)
  // 2. record the opt-out for this browser, and the account if signed in
  // 3. render the status line, e.g. "Opt-Out Request Honored"
}

// If the HTML changes with the signal, tell shared caches:
response.headers.append("Vary", "Sec-GPC");

The specification is strict about the value: a server must ignore a Sec-GPC header unless its value is exactly 1, and if a request carries several, any one set to 1 counts. A plain string comparison misses the second rule, because the Fetch standard joins repeated headers with a comma. And if the page you send back changes with the signal, name the header in Vary (RFC 9110, § 12.5.5) so a shared cache does not hand one visitor’s version to the next.

In the page

// true only when the browser sent Sec-GPC: 1 with this page load.
const gpc = navigator.globalPrivacyControl === true;

if (gpc) {
  // Run before any tag that sells or shares loads: gate those
  // tags on this flag in your tag manager or consent platform.
  document.documentElement.dataset.gpc = "1";
}

The property is a plain boolean, false when the browser supports GPC but it is off, and missing where the browser has no support at all, so compare it with true. A consent platform that detects the signal can do this gating for you; our consent platform comparison shows which ones say they detect the signal.

Optional: say you support it

{
  "gpc": true,
  "lastUpdate": "2026-10-22"
}

The spec lets a site publish this file. "gpc": true says the site means to abide by GPC requests at least as far as the law obliges it; lastUpdate dates that statement. It is a declaration, not compliance: no rule on this page is met by the file alone.

For automated tests, the spec adds a WebDriver command, Set Global Privacy Control, so a test browser can switch the signal on without anyone touching a setting.

Worked example

A privacy lead at a small online store wants to know which of the team’s browsers can test the store’s opt-out handling. Each person opens this page; the rows are what the checker shows for each setup.

Only the Firefox, Brave and DuckDuckGo machines can run the test as they are; the Firefox one needs the box ticked first. The Chrome machines need a GPC add-on before they send anything. With the store’s answers in the checker (sells through ad pixels, visitors in California, Colorado, Texas and New Jersey), all four places come back with a duty to honour the signal.

Jurisdiction notes

California. The regulation does not name GPC; it covers any signal in a commonly used format, such as an HTTP header or a JavaScript object, sent by a tool that tells people it opts them out. The Attorney General says GPC qualifies and must be honoured. The law itself is in what the CCPA is.

Colorado. Since 1 July 2024 businesses must honour a universal opt-out mechanism, and GPC is the only one the Department currently recognises. More in the Colorado Privacy Act guide.

Oregon and New Jersey. Both name GPC as an example of a signal businesses must honour: New Jersey from 15 July 2025, Oregon from 1 January 2026. See the Oregon guide.

Connecticut, Texas, Montana, Minnesota, Delaware and New Hampshire. Each requires honouring an opt-out preference signal, but the texts read do not name GPC. Maryland’s privacy act lists a signal only as an optional method beside an opt-out link, and counts recognising signals other states approve as compliance. Dates and thresholds are in the US state privacy laws overview.

Virginia, Iowa, Tennessee and Indiana. No signal duty in the texts read. Nebraska’s rule could not be read from an official source, and Utah, Kentucky and Rhode Island are not covered here. Not sure which laws reach you at all? Start with which privacy laws apply.

EU. The GDPR has no signal rule. The GPC specification says the GDPR potentially gives a right to limit sharing under Articles 7 and 21, so treat the signal as a request worth answering, and keep asking for cookie consent as before: GPC does not replace it.