# What is Global Privacy Control (GPC) and how to respect it

> What Global Privacy Control is, how the Sec-GPC header and navigator.globalPrivacyControl signal work, what California and Colorado require, and how to honor it before trackers run.

Author: OptinStack Team  
Published: 2026-06-27  
Page: https://optinstack.com/blog/what-is-global-privacy-control-gpc  
Markdown: https://optinstack.com/llms.md/blog/what-is-global-privacy-control-gpc

Global Privacy Control, or GPC, lets a visitor tell every website they visit, in a single browser setting, that they do not want their data sold or shared\. Its legal effect depends on whether a law applies to the business and processing\. California and Colorado are examples of regimes that recognize qualifying browser\-based opt\-out signals\. This post explains what GPC is, how the signal is transmitted, what the law requires you to do with it, and how to detect it on your site\.

## What GPC is

GPC is a proposed W3C specification that sends a single preference from the browser to every site\. The goal is a global, persistent opt\-out for the sale or sharing of personal data, so a person does not have to object site by site\. It is backed by a coalition of organizations and implemented in several major browsers and extensions\.

## How the signal is transmitted

GPC is sent in two parallel ways: as an HTTP header on every request, and as a JavaScript property readable in the browser\.


_GPC is sent as the Sec-GPC header on every HTTP request_
```http
GET / HTTP/2
Host: example.com
Sec-GPC: 1
```


_Read GPC from JavaScript via the navigator property_
```javascript
// true when the visitor has enabled Global Privacy Control
const gpcEnabled = navigator.globalPrivacyControl === true; if (gpcEnabled) { // treat as an opt-out of sale/sharing
}
```

> **Info:** The signal is binary: it is either present (enabled) or absent. There is no value for "partially" opted out. The W3C specification and MDN both document this behavior.

## What the law requires

GPC is not just a technical signal\. For a business subject to California requirements, a qualifying opt\-out preference signal such as GPC may need to be treated as a valid request to opt out of the sale or sharing of a consumer's personal information\. Colorado's privacy rules take the same approach for their opt\-out of targeted advertising and sale\. If you qualify as a business under these laws and you receive GPC, you are generally expected to honor it\.

*How California and Colorado treat GPC as an opt-out signal*

| Law | What GPC opts out of | Regulator |
| --- | --- | --- |
| CCPA/CPRA (California) | Sale and sharing of personal information | California Privacy Protection Agency |
| CPA (Colorado) | Sale, targeted advertising, certain profiling | Colorado AG |

> **Warning:** Honoring GPC means actually stopping the covered sale or sharing, not just recording the signal. If your ad tech continues to share data for cross-context advertising after receiving GPC, the signal is not honored.

## Detecting and honoring GPC

The reliable approach is to read GPC on the server from the Sec\-GPC header, because that signal arrives on the very first request before any script runs\. Reading it in JavaScript is fine for adjusting the banner UI, but it runs after page load, so it cannot block trackers that already fired\.

- Read Sec\-GPC on the server to set the default opt\-out state immediately\.
- Reflect the GPC state in the banner so the visitor sees it has been applied\.
- Block or release trackers based on the opt\-out, the same enforcement path as a manual choice\.
- Record the GPC signal in the consent record so you can evidence it\.

GPC turns a privacy preference into a machine\-readable signal you can act on automatically\. The technical detection is simple; the work is in enforcement and record\-keeping\. Treat it as a first\-class consent input, honor it before trackers run, and you turn a regulatory obligation into a default your visitors can trust\.