Global Privacy Control

What is Global Privacy Control

Global Privacy Control (GPC) is a browser-level signal that tells websites the user wants to opt out of the sale or sharing of their personal information. It is expressed two ways:

• An HTTP request header: Sec-GPC: 1
• A JavaScript property: navigator.globalPrivacyControl === true

A site that receives the signal has to treat it as a valid opt-out request. It does not get to ask again, and it does not get to wait for the visitor to click anything.

Which US states require GPC

Twelve US states require businesses to recognize an opt-out preference signal such as GPC: California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon and Texas.

Two more are already scheduled. Louisiana requires recognition when its Data Privacy Act takes effect on January 1, 2027, and Vermont when the Data Privacy and Online Surveillance Act takes effect on January 1, 2028. Alabama's law takes effect on May 1, 2027 but does not require signal recognition until 2028, and Oklahoma's law, effective January 1, 2027, does not require it at all.

The US state privacy law tracker compares all of these laws side by side, including which require signal recognition and when each takes effect.

Outside the US, GPC is arguably binding under GDPR Article 21(5) for processing grounded in legitimate interest.

The practical answer for most sites is to honor GPC everywhere rather than sorting visitors by state first. ConsentStack does that by default. Geo-gating the signal costs more engineering than honoring it globally and gives everyone outside those twelve states a worse experience.

Browser support

That last row has an expiry date. California's AB 566, the Opt Me Out Act, was approved by the Governor on October 8, 2025 and becomes operative on January 1, 2027. It says a business "shall not develop or maintain a browser that does not include" a setting that lets the user send an opt-out preference signal. Once Chrome, Safari and Edge ship that setting, GPC stops being a privacy-enthusiast signal and starts arriving from ordinary visitors.

How ConsentStack detects GPC

ConsentStack reads GPC from both surfaces at every page load:

1. Edge detection at the config-delivery worker. The Sec-GPC: 1 header is read and included in the config response.
2. Client detection in the SDK. navigator.globalPrivacyControl is read at initialization.

The effective GPC state is the OR of both signals. This belt-and-suspenders approach catches proxies that strip the header and extensions that inject GPC after the config fetch.

What ConsentStack does when GPC is detected

Behavior branches on the visitor's jurisdiction.

Opt-out jurisdictions (CA, CO, CT, DE, MD, MN, MT, NE, NH, NJ, OR, TX, and other US states)

• The consent banner does not show.
• A small toast appears at the bottom of the page confirming the opt-out, with a link to manage preferences.
• All non-essential cookie categories are set to denied.
• Consent Mode v2, Meta LDU, TikTok Limited Data Use, Pinterest Limited Data Sharing, and equivalent downstream signals fire automatically.

Opt-in jurisdictions (EU GDPR, UK, EEA)

• The consent banner does show, as it always has in these jurisdictions. Non-essential categories are pre-denied by default, which is the normal opt-in behavior.
• If the visitor has previously saved an explicit consent choice on this site, that choice is preserved. GPC sets the default for first-time visitors but does not wipe a prior, explicit decision. This matches CCPA section 7025(c)(3), which lets a business obtain consent where the signal conflicts with a visitor's own site-specific setting, and the W3C GPC spec's stance that explicit user choices override the default signal.

All other jurisdictions

ConsentStack defaults to honoring GPC globally. This is configurable per site: in the dashboard under Config, then Settings, then Geo and compliance, the Global Privacy Control setting offers three modes. "Honor everywhere" is the default and our recommendation. "Only where legally required" limits automatic honoring to jurisdictions whose privacy law requires opt-out-signal recognition, tracked against our regulation catalog so new state laws are picked up as they take effect. "Off" disables automatic handling entirely; if you choose it, your team is responsible for honoring the signal another way, and the dashboard shows a warning to that effect. Changes take effect when you publish.

How to check if GPC is working on your site

Turn GPC on in your browser, open your site in a fresh session, and check three things in order: that your browser is sending the signal, that your site received it, and that trackers actually stopped firing. Most checks stop after the first two. That is how a site can pass a spot check and still be leaking data to advertising vendors.

1. Turn the signal on. Brave and the DuckDuckGo browser send GPC by default. In Firefox, go to Settings, then Privacy and Security, then turn on "Tell websites not to sell or share my data". Chrome, Edge, Safari and Opera need a privacy extension for now.

2. Confirm your browser is sending it. Open developer tools. In the Console, run navigator.globalPrivacyControl and expect true. Then open the Network tab, reload, click any request to your own domain, and look for Sec-GPC: 1 in the request headers. Some setups send one and not the other, which is exactly why ConsentStack reads both and takes either as a yes.

3. Confirm your site received it. Reload the page. In a US opt-out state you should see the confirmation toast instead of the cookie banner. In the EU or UK you should still see the banner, with every non-essential category switched off before you touch anything. Opening the preferences panel should show those categories off, not on.

4. Confirm trackers actually stopped. This is the step that decides whether you are compliant. With GPC on, reload and do not click anything on the banner. In the Network tab, look for requests to your analytics and advertising vendors. There should be none. If Google Analytics, Meta Pixel or an ad tag fires before you interact with the page, the signal was received and then ignored somewhere downstream. The free cookie checker runs this same test for you and lists every tracker that fires before consent.

5. Check what your site publishes. Load https://yoursite.com/.well-known/gpc.json in a browser. It should return { "gpc": true, ... }. Automated compliance scanners look for that file, and its absence is a common reason a site that honors GPC correctly still gets marked down.

6. Keep the receipt. Every consent event ConsentStack records carries two audit fields: gpc_detected, which shows whether the signal was present on that event, and signal_source, which shows whether the decision came from an honored GPC signal or from a banner click. Both are included in the JSON consent-log export, so if a regulator asks whether a specific visitor's signal was honored, you can answer with that visitor's own records rather than a re-test.

When a passing site looks like it is failing

Three things produce a false alarm:

• You tested in a session that already had a saved consent choice. An explicit decision the visitor made on your site outranks the signal, by design and by regulation. Test in a private window, or clear site data first.
• Your extension injects GPC after the page starts loading. The header will be missing on the first request even though the JavaScript property is set. ConsentStack still catches this because it reads both surfaces.
• You tested from a jurisdiction your configuration does not treat as opt-out. The banner showing in the EU with everything pre-denied is correct behavior, not a failure.

The 2026 confirmation requirement

Since January 1, 2026, quietly honoring the signal is no longer enough in California. Amended CCPA regulations changed section 7025(c)(6) from "a business may display" to "a business must display" whether it has processed the visitor's opt-out preference signal, and section 7026(g) changed the same way for opt-out requests generally. The regulations give the example of showing "Opt-Out Preference Signal Honored" on the page and reflecting the opted-out state through a toggle in the visitor's privacy settings. The amendment also swapped "or" for "and" between those two, so both are expected rather than either.

ConsentStack ships both halves with no configuration:

• The toast reads "We have honored your browser's Global Privacy Control signal and opted you out of the sale or sharing of your personal information." It is announced to screen readers as a status message rather than an alert.
• The preferences panel, reachable from that toast, shows every non-essential category switched off. Bulk Accept and Reject buttons are hidden in this state, so the panel reflects a decision that has already been made instead of inviting the visitor to make it again.

This is worth checking on whatever CMP you use. A banner that simply stops firing tags on a GPC visit satisfies the old rule and not the current one.

What publishers need to do

Nothing. GPC handling is fully automatic once ConsentStack is installed.

Three optional steps improve your compliance posture:

1. Publish /.well-known/gpc.json on your site

Automated compliance scanners look for this file at the root of your domain. Add a static file at https://yoursite.com/.well-known/gpc.json:

{ "gpc": true, "lastUpdate": "2026-01-01" }

2. Show visitors their signal status

The SDK exposes the effective GPC status so you can reflect it in your own UI, for example on your privacy policy page:

const gpc = window.consentstack.getGpcStatus()
// { detected: boolean, honored: boolean } or null before init

React sites get the same via useConsent().gpc. Three states fall out of it: no signal (detected is false), signal honored (honored is true, show "Opt-Out Preference Signal Honored"), and signal detected but overridden by the visitor's own explicit choice (detected true, honored false). See the JavaScript API reference for details.

3. Update your privacy policy

Add a paragraph like this to your privacy policy:

This website honors Global Privacy Control (GPC) signals. When we detect a GPC signal from your browser, we treat it as a valid opt-out of the sale or sharing of your personal information under applicable US state privacy laws, and as an objection to processing based on legitimate interest under the GDPR. We will not sell or share your personal information for the purposes GPC covers while your browser continues to send the signal. You may revisit this choice at any time through our preferences center.

Microsoft Clarity users: one additional step

If you use Microsoft Clarity alongside ConsentStack, configure your Clarity project dashboard with "cookies off by default." ConsentStack will call clarity("consentv2", true) only when the user grants consent. This matches Microsoft's recommended integration pattern and ensures Clarity does not fire cookie-based tracking pre-consent.

FAQ

Does my banner still show if the visitor has GPC enabled

In EU and other opt-in jurisdictions, yes. The banner is still required to collect affirmative consent for consent-based processing. Non-essential categories are pre-denied.

In US opt-out jurisdictions, no. A toast appears instead, and all non-essential tracking is denied.

What if a visitor previously accepted tracking, then enables GPC later

Their prior explicit consent is preserved. Under CCPA section 7025(c)(3), where the signal conflicts with a visitor's own site-specific setting, a business may obtain the visitor's consent and continue, and that explicit choice persists. New visitors with GPC enabled get default-deny on opt-out categories; they can still grant per-category exceptions through the preferences panel, and that exception survives reloads. To reset their state, the visitor clears site data or revokes individual categories from the preferences UI.

Do I need to change my Google Ads or Meta Pixel setup

No. ConsentStack automatically sets Google Consent Mode v2 to denied and applies Meta Limited Data Use when GPC is honored. No changes to your pixel code are required.

Do I need to do anything to satisfy the 2026 confirmation requirement

No. The opt-out confirmation toast and the preferences panel state are on by default for every site running ConsentStack, so the display obligation under CCPA sections 7025(c)(6) and 7026(g) is met without configuration.

What percentage of my traffic has GPC enabled

Today, typically 2 to 8 percent for consumer sites, and higher for tech-niche audiences. Most of it comes from Brave and DuckDuckGo Browser, where the signal is on by default, plus privacy-extension users on Chrome and Firefox.

Treat that as a floor rather than a stable number. California's AB 566 requires browser developers to include an opt-out preference signal setting from January 1, 2027, and the share of GPC traffic will move once Chrome, Safari and Edge ship it. Sites that handle the signal correctly now will not need to do anything when that happens.