Global Privacy Control: The Opt-Out Signal You're Probably Required to Honor

Global Privacy Control is the rare privacy mechanism that is both technically trivial and legally serious. It's a single browser signal — yet ignoring it has already featured in real enforcement. If your site has US traffic and sells or shares personal information in the CCPA sense (which, given how broadly "sharing" covers ad-tech, most sites with marketing pixels do), GPC deserves twenty minutes of your attention.

What it is

GPC is a preference a person sets once, in their browser or via an extension. It travels with every request in two forms: an HTTP header (Sec-GPC: 1) and a JavaScript property (navigator.globalPrivacyControl === true). Its meaning, per the specification: this person opts out of the sale and sharing of their personal information. The point is that a person shouldn't have to click an opt-out link on every single website — the browser says it for them, everywhere.

Who must honor it

• California (CCPA/CPRA) — explicitly requires honoring opt-out preference signals like GPC. This is not theoretical: the California Attorney General's 2022 settlement with Sephora specifically cited failure to honor GPC signals among the violations. California's regulator has stated plainly that GPC must be treated as a valid opt-out request.
• Colorado — the Colorado Privacy Act requires recognition of universal opt-out mechanisms, and GPC is on the state's approved list.
• Other US states — Connecticut and a growing number of state privacy laws include universal opt-out mechanism provisions. The trend across new state laws is clearly toward requiring it; check the current status of the states you do business in.
• EU/UK — GDPR has no GPC provision; consent there is opt-in, so the signal is legally redundant. Honoring it anyway (treating GPC as a decline) is harmless and arguably respectful — it costs you nothing on traffic that hasn't consented yet anyway.

How to implement it correctly

The logic is short: on page load, before showing any banner, check navigator.globalPrivacyControl. If it's true and the visitor has no prior consent choice stored, treat non-essential categories as declined — no marketing pixels, no "sale or sharing" — and don't nag them with a banner asking them to reconsider. A person who set GPC has already answered. If they later open your preferences panel and explicitly grant categories, that specific, later choice can override the general signal.

Two implementation subtleties matter. First, don't override a real choice with the signal: if a visitor previously accepted analytics explicitly, the spec doesn't require you to discard that consent — prior specific consent generally stands (though you may choose the stricter reading). Second, decide what happens server-side: the Sec-GPC header lets your backend suppress server-side sharing (conversions APIs, server-side tagging) too — GPC is not only about browser cookies.

The evidence problem nobody talks about

Here's a question a regulator can ask: "Show me that you honor GPC." If your implementation silently declines categories client-side and records nothing, you have working behavior and zero proof. But logging the visitor's identity would contradict the very signal they sent. The approach we landed on after thinking this through: record an anonymous evidence entry — timestamp, domain, the declined state, marked as GPC-triggered, with no visitor identifier and no IP or user-agent stored. The tenant gets aggregate proof the signal is honored ("N GPC opt-outs honored this month"); the visitor gets exactly what they asked for: nothing about them retained. If you build this yourself, that shape is worth copying.

How to test yours

Install a GPC-enabling extension (or use a browser with native support), visit your site in a fresh profile, and check three things: no marketing/advertising requests fire in the network tab, no banner demands a choice that was already made, and your do-not-sell obligations are actually suppressed — including any server-side event forwarding. Five minutes, once per quarter, and after any consent-stack change.

*State privacy law is a moving target and this is a technical guide, not legal advice — confirm current obligations for your states with counsel.*