Global Privacy Control (GPC): Tracking Behavior & Litigation Context

Published by Crandall Consulting · Informational litigation intelligence · Last substantive update: August 15, 2026

What Global Privacy Control (GPC) Is

Global Privacy Control (GPC) is a browser- and device-level privacy preference signal, not a tracking technology in the usual sense. Rather than collecting data, it communicates a visitor's opt-out preference to the websites they visit. Some browsers send the signal natively, others require a privacy extension, and the support landscape is changing — the 'Current Browser Support & Adoption Outlook' section on this page is refreshed automatically by our intelligence research cycles, so it reflects the latest sourced findings rather than static copy. As adoption grows, an increasing share of visitors may transmit a GPC signal automatically, without taking any action on the site itself.

What It Does

When GPC is enabled, the browser advertises the preference in two recognized ways: it sends an HTTP request header, 'Sec-GPC: 1', on outbound requests, and it exposes a JavaScript property, 'navigator.globalPrivacyControl', set to true. Under several U.S. state privacy laws, a qualifying opt-out preference signal from a consumer may need to be treated by covered businesses as a request to opt out of the sale or sharing of personal information and, in some states, of targeted advertising. GPC is a mechanism for expressing that request — it is not itself a law, and it does not withdraw every form of consent or require every third-party service to stop loading.

Current Browser Support & Adoption Outlook

This section is refreshed automatically by our intelligence research cycles — last researched October 12, 2026. It reflects sourced findings, not static site copy.

• Send GPC natively: Brave (enabled by default), DuckDuckGo Browser (enabled by default), Firefox (built-in setting; platform availability and defaults vary), Cromite (enabled by default), Microsoft Edge (built-in setting currently available in the United States)
• Require an extension: Google Chrome desktop (Privacy Badger or another GPC extension; ordinary stable-release native availability was not confirmed), Opera desktop (Privacy Badger; native support was not confirmed)

As of October 12, 2026, the reviewed sources support using a GPC extension in desktop Chrome but do not confirm ordinary stable-release native availability. Official Chromium work includes a January 6, 2026 intent to prototype and a July 23, 2026 implementation commit for Sec-GPC and navigator.globalPrivacyControl behind the GlobalPrivacyControl feature; these sources do not confirm a Google-announced Chrome release version or date.

The GPC project reports over 150 million users of supported browsers and tools, but that figure does not establish how many actively send GPC. California's forthcoming browser requirement and Chromium implementation work provide pathways for broader availability, without establishing individual browsers' rollout dates.

Laws Requiring Browsers to Offer Opt-Out Signals

• California, United States: The California Opt Me Out Act (AB 566) requires browser providers to offer built-in, consumer-configurable opt-out preference signal functionality on desktop and mobile beginning January 1, 2027. This browser functionality requirement is distinct from businesses' obligations to honor signals and does not prescribe GPC by name. (effective 2027-01-01)

Enforcement activity: On September 9, 2025, the California Privacy Protection Agency and the attorneys general of California, Colorado, and Connecticut announced a coordinated GPC investigative sweep. The coalition contacted businesses that might not be processing GPC opt-out requests and requested compliance; the announcement described investigative activity rather than final findings against every recipient.

Browser Communications Generally Observed

GPC is observable on the request side ('Sec-GPC: 1' header) and in the page's JavaScript environment ('navigator.globalPrivacyControl === true'). Some sites also publish a '/.well-known/gpc.json' transparency file declaring how they interpret the signal. GPC does not transmit personal data; it communicates a preference. Whether a site changes any downstream behavior (for example, suppressing sale/share-related advertising tags) in response is a separate, testable question.

How Our Scanner Detects It

Our scanner runs the same website twice in clean, isolated browser contexts: PASS A is a normal browser with GPC not enabled; PASS B enables GPC using the recognized browser-level mechanisms (the 'Sec-GPC' request header and the 'navigator.globalPrivacyControl' JavaScript property). It first independently verifies that the GPC signal is actually being transmitted, then compares the two sessions — advertising and sale/share-related requests, cross-site identifiers, cookies, and storage — to see whether the site materially changed relevant behavior. It also checks for a '/.well-known/gpc.json' declaration and searches the site's public privacy text for GPC-related language, then compares stated policy against observed behavior.

Common Implementation Behavior

Common implementation patterns observed include: sites that acknowledge GPC in their privacy policy but show no detectable behavioral change when the signal is present (a potential policy-vs-behavior mismatch warranting review); consent banners that indicate advertising cookies are accepted even though a GPC signal was sent without any user interaction; and partial responses where some sale/share-related tags change behavior while others do not. A site legitimately does not need to block functional or essential services (for example, maps, fonts, or CAPTCHA) purely because GPC is present.

Litigation & Risk Context

Whether a site's handling of GPC raises a concern depends on the applicable state law, the site's own stated policy, and the categories of processing involved. Our scanner reports technical classifications — for example, 'GPC response detected', 'partial GPC response', 'no detectable GPC response', 'potential GPC concern', or 'GPC test inconclusive' — and never states that a site is 'illegal' or 'violates' a law based on automated behavior. A detectable mismatch between a site's stated GPC treatment and its observed behavior is a potential concern that warrants manual review, not a legal determination.

Tracked Cases Involving This Technology

Remediation Options Operators Commonly Consider

• Confirm the site actually detects the GPC signal on both the request header ('Sec-GPC: 1') and the JavaScript property ('navigator.globalPrivacyControl') before relying on any consent tool's GPC handling.
• Where applicable state law treats a qualifying signal as an opt-out request, ensure sale/share-related and targeted-advertising tags respond appropriately when GPC is present.
• Reconcile the privacy policy or 'Your Privacy Choices' text with observed behavior so stated GPC treatment matches what the site actually does.
• Avoid contradictory states — for example a banner indicating advertising cookies are accepted when a GPC signal was sent without user interaction.
• Consider publishing a '/.well-known/gpc.json' transparency declaration and re-testing after any consent-tool or tag-manager change.

Whether any option is appropriate for a specific website is a decision for the operator and qualified counsel.

Frequently Asked Questions

What is Global Privacy Control (GPC)?

GPC is a browser- or device-level privacy preference signal that communicates a visitor's opt-out preference to the websites they visit. Under several U.S. state privacy laws, covered businesses may need to treat a qualifying opt-out preference signal as a consumer request to opt out of the sale or sharing of personal information — and, in some states, of targeted advertising. GPC is a mechanism for expressing that request, not a law itself.

Does GPC mean 'reject all cookies' or block every third-party script?

No. GPC generally communicates opt-out rights relating to categories such as sale, sharing, or targeted advertising under applicable laws. It does not withdraw every form of consent, and functional or essential services (maps, fonts, CAPTCHA) do not automatically have to stop loading simply because GPC is present.

Is GPC the same as Do Not Track?

No. Do Not Track was an earlier, largely unenforced request header that most sites ignored. GPC is a distinct, current opt-out preference signal that several state privacy laws recognize as a valid mechanism for expressing opt-out rights.

Which browsers send GPC today?

Browser support changes over time, so we do not hardcode the answer here. The 'Current Browser Support & Adoption Outlook' section on this page is refreshed automatically by our intelligence research cycles and lists which browsers currently send GPC natively and which require an extension, along with any laws requiring browsers to offer opt-out preference signals.

Is GPC adoption expected to grow?

Adoption depends on browser vendors and on legislation requiring browsers to offer opt-out preference signal mechanisms. Because that landscape moves, our research cycles track it continuously — see the 'Current Browser Support & Adoption Outlook' section above for the latest sourced findings. Testing how a site responds to GPC is a forward-looking exercise, not just a current-traffic one.

Do these state laws require every website to implement GPC?

No. State universal opt-out provisions generally apply to businesses or controllers within that law's scope (thresholds vary by state), and they require recognizing a qualifying opt-out signal from covered consumers — typically as an opt-out of sale, sharing, or targeted advertising. They do not require every website to respond to GPC, and GPC is not a 'reject all cookies' instruction. Some businesses nonetheless choose to honor GPC for all visitors as a simpler, more conservative engineering posture than maintaining per-state logic.

Are regulators actually enforcing GPC requirements?

There has been coordinated enforcement activity: California, Colorado, and Connecticut have participated in joint privacy enforcement efforts involving opt-out preference signals, and Colorado's Attorney General formally recognizes GPC as a qualifying universal opt-out mechanism. Whether any particular site's handling raises a concern remains a fact- and state-specific question for qualified counsel.

How can I tell if my website honors GPC?

Our scanner runs the site twice — once normally and once with GPC enabled using the recognized 'Sec-GPC' header and 'navigator.globalPrivacyControl' property — verifies the signal was transmitted, and compares the two sessions to see whether relevant sale/share-related behavior changed. It also checks for a '/.well-known/gpc.json' file and compares your stated privacy policy against observed behavior.

What happens if a website ignores a GPC signal?

That depends on the applicable state law and the categories of processing involved. Our scanner reports observed behavior and technical classifications; it does not declare that ignoring GPC is 'illegal' or a 'violation'. A mismatch between stated policy and observed behavior is a potential concern that warrants review.

How is GPC different from website wiretap litigation?

They are different legal theories. GPC concerns universal opt-out / privacy-choice rights under state privacy laws. Website wiretap litigation applies electronic interception statutes to tracking technologies. Both affect third-party website data flows, which is why they live in the same platform, but they are not the same thing and this platform keeps them separate.

Related Intelligence

Sources

This page is based on direct technical observation by our scanner and vendor documentation; tracked litigation sources will be listed as the intelligence engine links them to this technology.

About This Page

Publisher: Inspection-Ready Institute, Inc. (DBA Crandall Consulting), an independent website compliance and risk consultancy. We are not a law firm and nothing on this page is legal advice.

How this content is produced: Facts are extracted from publicly available sources — court and government materials, recognized legal press, professional analysis, and industry reports — by our litigation intelligence engine, stored with full source provenance, and rendered from the database. Risk guidelines are computed by a deterministic formula, never by an AI model directly. See the full methodology.

Limitations: Counts labeled "Tracked" reflect matters identified in our source set and are not official court statistics. We report what courts decided and did not decide; we do not predict outcomes.

Corrections: If you believe anything on this page is inaccurate, contact us via the contact page and we will review the underlying sources promptly.