Global Privacy Control (GPC): Website Requirements, State Laws & Testing

Published by Crandall Consulting · Informational litigation intelligence · Last substantive update: August 31, 2026

What Global Privacy Control Is

Global Privacy Control (GPC) is a browser- and device-level privacy preference signal — not a tracking technology. Instead of collecting data, it communicates a visitor's opt-out preference to the websites they visit. Some browsers send the signal natively and others via privacy extensions; the "Current Browser Support & Adoption Outlook" section below is refreshed automatically by our intelligence research cycles, so visitors always see the latest sourced landscape rather than static copy.

Under several U.S. state privacy laws, covered businesses may need to treat a qualifying opt-out preference signal as a consumer request to opt out of the sale or sharing of personal information — and, in some states, of targeted advertising. GPC is a mechanism for expressing that request; it is not itself a law.

How the Signal Works (Technical)

When GPC is enabled, the browser advertises the preference in two recognized ways:

• HTTP request header: Sec-GPC: 1 is sent on outbound requests.
• JavaScript exposure: navigator.globalPrivacyControl is set to true in the page environment.
• Transparency file (optional): some sites publish /.well-known/gpc.json declaring how they interpret the signal.

These are the recognized mechanisms defined by the Global Privacy Control technical specification. GPC does not transmit personal data — it communicates a preference. Whether a site changes any downstream behavior (for example, suppressing sale/share-related advertising tags) in response is a separate, testable question.

Why Businesses Should Care

Because qualifying opt-out preference signals are recognized under several state privacy laws, a mismatch between what a site says about GPC and what it actually does when the signal is present can be a potential concern warranting review. A cookie banner is not the whole story: many visitors send GPC automatically, before any banner interaction.

What GPC Does and Does Not Mean

• It does communicate opt-out rights relating to categories such as sale, sharing, or targeted advertising under applicable laws.
• It does not mean "reject all cookies" or withdraw every form of consent.
• It does not require every third-party service — maps, fonts, CAPTCHA, functional embeds — to stop loading.
• It is not a wiretap or interception signal, and it is not the same as the older Do Not Track header.

Which States Currently Recognize or Require Opt-Out Preference Signals

The tables below are generated entirely from our canonical jurisdiction intelligence. Current requirements are kept strictly separate from future and pending ones.

Currently Required or Recognized

Future Requirements & Legislation to Watch

Enacted future-effective requirements and pending legislation are shown separately from current law. Enacted future requirements are not presented as currently enforceable, and pending bills are not law and may never take effect.

No enacted future or pending opt-out preference signal requirements are currently tracked. This reflects our tracked source set, not an absence of legislative activity.

Full 50-State GPC Status

Every state's current classification, including jurisdictions where we have limited data. Each links to that state's full intelligence page.

How to Test a Website for GPC

Our scanner runs the same website twice in clean, isolated browser contexts:

• Pass A — normal browser: GPC not enabled.
• Pass B — GPC enabled: using the recognized Sec-GPC header and navigator.globalPrivacyControl property.

It first independently verifies that the GPC signal is actually being transmitted, then compares the two sessions — advertising and sale/share-related requests, cross-site identifiers, cookies, and storage — to see whether the site materially changed relevant behavior. It also checks for a /.well-known/gpc.json declaration and searches the site's public privacy text for GPC-related language, comparing stated policy against observed behavior. Results are reported as technical classifications (for example, "GPC response detected", "partial GPC response", "no detectable GPC response", "potential GPC concern", or "GPC test inconclusive") — never as a statement that a site is "illegal" or "violates" a law.

Common Implementation Failures

• Privacy policy acknowledges GPC, but no detectable behavioral change occurs when the signal is present (a policy-vs-behavior mismatch).
• A consent banner indicates advertising cookies are accepted even though a GPC signal was sent without any user interaction.
• Partial responses where some sale/share-related tags change behavior while others do not.
• Reliance on a consent tool's GPC handling without verifying the site actually detects both the request header and the JavaScript property.

Relationship to Consent Management, Litigation & State Privacy Laws

Consent management: a cookie banner asks for a choice on the site; GPC is sent automatically by the browser. The two should be reconciled so a GPC signal is not contradicted by a banner state.

Website tracking litigation: GPC concerns universal opt-out / privacy-choice rights and is a different legal theory from wiretap / interception litigation, which applies statutes like the Federal Wiretap Act and state interception laws to tracking technologies. See the 50-state litigation tracker.

State privacy laws (CCPA/CPRA and others): the scope of a recognized opt-out preference signal — sale, sharing, targeted advertising, profiling — is defined by each state's law. The state tables above reflect our current tracked intelligence per jurisdiction.

Technical Implementation Concepts

For a deeper technical reference on the signal itself — signal type, browser support, website behavior, and testing methodology — see the Global Privacy Control technology page. Our full research and scoring approach is documented on the methodology page.

Frequently Asked Questions

What is Global Privacy Control (GPC)?

Global Privacy Control is a browser- or device-level privacy preference signal that communicates a visitor's opt-out preference to the websites they visit. Support varies by browser — some send it natively, others via privacy extensions; the browser-support section on this page is refreshed automatically by our research cycles. Under several U.S. state privacy laws, covered businesses may need to treat a qualifying opt-out preference signal as a consumer request to opt out of the sale or sharing of personal information — and, in some states, of targeted advertising.

How does the GPC signal work technically?

When enabled, the browser advertises the preference two ways: it sends an HTTP request header, 'Sec-GPC: 1', on outbound requests, and it exposes a JavaScript property, 'navigator.globalPrivacyControl', set to true. A site may also publish a '/.well-known/gpc.json' transparency file describing how it interprets the signal. GPC does not transmit personal data; it communicates a preference.

Does GPC mean 'reject all cookies'?

No. GPC generally communicates opt-out rights relating to categories such as sale, sharing, or targeted advertising under applicable laws. It is not a blanket withdrawal of every form of consent, and it does not require every third-party service to stop loading.

Is GPC the same as Do Not Track?

No. Do Not Track was an earlier, largely unenforced signal that most sites ignored. GPC is a distinct, current opt-out preference signal that several state privacy laws recognize as a valid mechanism for expressing opt-out rights.

Does GPC require all third-party scripts to stop?

No. Functional or essential services — for example maps, fonts, or CAPTCHA — do not automatically have to stop loading simply because GPC is present. Whether a specific technology should change behavior depends on its purpose, the data flow, the jurisdiction, and applicable law.

How is GPC different from cookie consent?

A cookie banner asks the visitor to make a choice on the site. GPC is a preference the browser sends automatically, before any banner interaction. A potential concern arises when a banner indicates advertising cookies are accepted even though a GPC signal was sent without any user interaction.

How is GPC different from website wiretap litigation?

They are different legal theories. GPC concerns universal opt-out / privacy-choice rights under state privacy laws. Website wiretap litigation applies electronic interception statutes (like CIPA or the Federal Wiretap Act) to tracking technologies. Both affect third-party website data flows, which is why they live in the same platform, but they are not the same thing.

How can a website test whether it honors GPC?

Our scanner runs the site twice in clean, isolated browser contexts — once normally and once with GPC enabled using the recognized 'Sec-GPC' header and 'navigator.globalPrivacyControl' property — independently verifies the signal was transmitted, and compares the two sessions to see whether relevant sale/share-related behavior changed. It also checks for a '/.well-known/gpc.json' file and compares stated privacy policy against observed behavior.

What happens if a website ignores a GPC signal?

That depends on the applicable state law and the categories of processing involved. Our scanner reports observed behavior and technical classifications; it does not declare that ignoring GPC is 'illegal' or a 'violation'. A mismatch between stated policy and observed behavior is a potential concern that warrants manual review.

Can GPC requirements change by state?

Yes. Whether a qualifying opt-out preference signal must be honored, and the exact scope (sale, sharing, targeted advertising, profiling), varies by state and by applicable law. The state-by-state table on this page reflects our current tracked intelligence for each jurisdiction.

Sources

GPC legal-status classifications on this page are derived from our canonical jurisdiction intelligence, which stores government sources, court decisions, and secondary corroboration per jurisdiction. Each state's specific sources are listed on its individual intelligence page. For GPC specifically we prioritize official state statutes, state Attorney General and privacy-agency materials, official regulations and rulemaking, court decisions, and the official Global Privacy Control technical specification over industry commentary.

About This Page

Publisher: Inspection-Ready Institute, Inc. (DBA Crandall Consulting), an independent website compliance and risk consultancy. We are not a law firm and nothing on this page is legal advice.

How this content is produced: Facts are extracted from publicly available sources — court and government materials, recognized legal press, professional analysis, and industry reports — by our litigation intelligence engine, stored with full source provenance, and rendered from the database. Risk guidelines are computed by a deterministic formula, never by an AI model directly. See the full methodology.

Limitations: Counts labeled "Tracked" reflect matters identified in our source set and are not official court statistics. We report what courts decided and did not decide; we do not predict outcomes.

Corrections: If you believe anything on this page is inaccurate, contact us via the contact page and we will review the underlying sources promptly.