AI & Privacy · guide
How to Honor Global Privacy Control (GPC) Signals: Legal Requirements and Implementation
Updated
Global Privacy Control (GPC) is a browser signal that tells a website the visitor does not want their personal information sold or shared. It began as a community proposal and has become a legal obligation in a growing list of US states. This guide covers what the signal is technically, where honoring it is mandatory, and how to implement it so that a regulator testing your site sees the right behavior. Details are current at time of writing (September 2026).
What GPC is
The GPC specification is published by the W3C Privacy Working Group as a Working Draft on the Recommendation track; the latest draft at time of writing is dated June 11, 2026. It defines two signals:
- An HTTP request header, Sec-GPC, whose value is exactly 1 when the user has enabled the preference.
- A JavaScript property, navigator.globalPrivacyControl, which returns true when the header was sent for the page load.
The spec also lets a site publish a support resource at /.well-known/gpc.json containing a boolean field named gpc and a lastUpdate date, so that auditors and researchers can see whether the origin claims to honor the signal. Browsers and extensions that send GPC include Firefox, Brave, DuckDuckGo and Privacy Badger, according to globalprivacycontrol.org.
Where honoring it is required
California. Section 7025 of the CCPA regulations requires a business that sells or shares personal information to treat a valid opt-out preference signal as a request to opt out of sale and sharing. The signal must be honored for the browser or device and any consumer profile linked to it, and if the business knows who the consumer is, for that consumer too. The regulations, as amended effective January 1, 2026, also require the business to display on its site that the signal has been processed; the text is on the CPPA regulations page.
Colorado. The Colorado Privacy Act required controllers to honor universal opt-out mechanisms beginning July 1, 2024. The Attorney General maintains a list of recognized mechanisms; GPC was the first and, at time of writing, the only mechanism on it.
Other states. Comprehensive privacy laws in Connecticut, Delaware, Montana, Nebraska, New Hampshire, New Jersey, Oregon and Texas required recognition of universal opt-out signals by July 1, 2025, with Minnesota following on July 31, 2025 and Maryland on October 1, 2025, according to a practitioner comparison. Most of these statutes follow the Colorado model rather than California's, but the practical outcome is the same: a compliant signal is an opt-out of sale and of targeted advertising. Check each statute, because scope and effective dates continue to change.
The Sephora settlement
GPC enforcement is not theoretical. On August 24, 2022 the California Attorney General announced a 1.2 million dollar settlement with Sephora, the first public CCPA enforcement action. Among the allegations: Sephora failed to process opt-out requests sent through user-enabled global privacy controls. The settlement required Sephora to honor GPC and to report to the Attorney General on its GPC efforts. The same announcement disclosed a sweep of notices to other businesses about GPC non-compliance.
Implementation steps
| Step | What to do |
|---|---|
| Detect | Read the Sec-GPC header server-side on every request and check navigator.globalPrivacyControl client-side before any tag or SDK fires |
| Treat as an opt-out | Suppress every sale or sharing pathway: advertising pixels, data-clean-room feeds, third-party cookies, server-side event forwarding and SDK sharing in apps |
| Persist | Record the opt-out against the browser or device identifier so the choice survives page loads |
| Handle known users | If the visitor is logged in or otherwise identifiable, apply the opt-out to the account and any linked profiles, not only the current browser |
| Resolve conflicts | If the signal conflicts with a prior consent, California requires you to honor the signal, though you may then ask the consumer to re-consent using a compliant flow |
| Confirm | Show a visible confirmation that the signal was recognized, such as a status line in the footer or privacy settings page |
Frictionless versus non-frictionless
California distinguishes the two. A business processes the signal in a frictionless manner when it does not charge a fee, degrade the service, or display a notification, pop-up or interstitial in response to the signal. A business that does so, and includes the required privacy policy language, may omit the Do Not Sell or Share My Personal Information link. Anything less, for example a banner asking the visitor to confirm, is non-frictionless, and the link must remain.
The gpc.json file
Publishing /.well-known/gpc.json with gpc set to true is optional under the spec, but it signals good faith and is easy for regulators to check. Keep lastUpdate accurate and only publish true after the suppression logic is live.
Testing
- Enable GPC in a supporting browser and confirm with developer tools that no sale or sharing requests fire.
- Test both anonymous and logged-in sessions.
- Test the mobile app if it uses the same identifiers.
- Repeat after every tag manager or consent platform change, because regressions are common.
RegPing's AI and privacy bot delivers state opt-out rulemaking and enforcement notices like these into Discord.
Where to verify
- W3C GPC specification, Working Draft
- Editor's draft with the well-known resource details
- Global Privacy Control project site
- CPPA regulations page, section 7025
- Colorado Attorney General universal opt-out mechanism list
- California AG Sephora settlement announcement
This guide is general information, not legal advice. Verify against the primary source and consult counsel before acting.
Questions people ask
Is Global Privacy Control legally binding?
Yes in a growing number of states. California's CCPA regulations require businesses to treat it as an opt-out of sale and sharing, Colorado has required it since July 1, 2024, and roughly a dozen states recognize universal opt-out signals at time of writing.
How does a website detect a GPC signal?
The browser sends an HTTP header named Sec-GPC with the value 1 and exposes navigator.globalPrivacyControl as true in JavaScript. Sites should check both before any tracking or advertising code runs.
What happened in the Sephora case?
In August 2022 the California Attorney General settled with Sephora for 1.2 million dollars over CCPA violations that included failing to honor GPC opt-out signals. It was the first public CCPA enforcement settlement.