Global Privacy Control

The GPC specification defines two parts for implementing GPC in clients, and one part when implementing for servers.

The first part of a client implementation is a HTTP header with the form:

Sec-GPC: 1

The character '1' is the only allowed value for the header. There is deliberately no mechanism for extensibility; the creators of the standard have stated that they will create new headers if extension becomes necessary.

The second part of a client implementation is setting the navigator.globalPrivacyControl property to the value true.

Websites can optionally host a JSON-formatted file known as the GPC support resource at the well-known URI .well-known/gpc.json to indicate how they respond to the GPC signal. This file has up to two relevant members (all other members should be ignored): a gpc boolean member where true means that the server intends on complying with GPC requests, and false means it does not, and a lastUpdate member. By default, a website's support is unknown.

GPC has been implemented by Mozilla Firefox, Brave, and DuckDuckGo Private Browser. GPC was briefly implemented in prerelease versions of Safari as an optional setting, but remains unsupported. Enabling GPC has never been supported by Google Chrome or Microsoft Edge, despite Chrome still allowing users to enable the Do Not Track header. However, there are third-party extensions available for Chrome that enable sending the GPC header during HTTP requests, including the EFF's Privacy Badger extension and the DuckDuckGo Privacy Essentials add-on amongst others.

Starting January 1, 2027 the CCPA will require businesses that develop or maintain a browser to include functionality configurable by a consumer that enables the browser to send an opt-out preference signal. effectively requiring GPC in all browsers available to California residents. Many websites including the New York Times and Washington Post have started to recognize and respect GPC signals. As of May 2, 2026 close to 400,000 websites declare support for GPC via a file on their servers at URL: /.well-known/gpc.json.

As of March 2026, GPC has legal authority in five states:

• In Colorado, GPC was the first Universal Opt-Out Mechanism (UOOM) to be recognized as meeting the standards of the Colorado Privacy Act (CPA).
• GPC signals achieved legal status in Connecticut on January 1, 2025, when the Connecticut Data Privacy Act (CDPA) took effect.
• New Jersey started requiring businesses to respect universal opt-out mechanisms such as GPC under the New Jersey Data Privacy Law (NJDPL) which went into effect on July 15, 2025.
• In California, unlike the Do Not Track header, GPC is a valid do-not-sell-my-personal-information signal according to the California Consumer Privacy Act (CCPA), which stipulates that websites are legally required to respect a signal sent by users who want to opt-out of having their personal data sold. In July 2021, the California Attorney General clarified that under law, the Global Privacy Control signal must be honored.
• As of January 1, 2026, under the Oregon Consumer Privacy Act (CPA) businesses have to honor opt-out signals that meet certain technical requirements, such as GPC.

• On August 24, 2022, the California Attorney General announced Sephora paid a $1.2 million settlement for allegedly failing to process opt-out requests via a user-enabled global privacy control signal.
• Later on July 1, 2025, the California Attorney General announced the largest CCPA settlement to date of $1.55 million against Healthline.com for failing to allow consumers to opt out of targeted advertising and for sharing data with third parties without CCPA-mandated privacy protections.
• On September 9, 2025, the Connecticut, California, and Colorado Attorneys General announced a joint investigative privacy sweep that involved sending letters to businesses that do not appear to be processing consumer requests to opt out of the sale of their personal information submitted via GPC as required by law and requested that those businesses come into immediate compliance.
• On February 11, 2026, the California Attorney General announced a $2.75 Million settlement with Disney resolving allegations that the company violated the CCPA by failing to fully effectuate consumers' opt-out requests across all devices and streaming services associated with consumers' Disney accounts clarifying that GPC applies to all devices of a consumer's account.
• On March 5, 2026, the California Privacy Protection Agency Board issued a decision requiring Ford Motor Company to pay a $375,703 fine for creating unnecessary friction in the opt-out process under the CCPA and required Ford to conduct an audit of the tracking technologies on its website and ensure compliance with opt-out preference signals, including GPC.