United States
Privacy preference signal
Global Privacy Control: What your website must do with the signal
Global Privacy Control (GPC) is a browser setting that tells websites a visitor wants to opt out of the sale or sharing of their personal data. Whether and how your website must respond depends on the applicable state law and whether your business is within its scope.
At a glance
- Who it can apply to
- Businesses covered by a state privacy law that recognises the signal, such as the CCPA in California or the CPA in Colorado, when they sell or share personal data or use it for targeted advertising.
- What it is
- Global Privacy Control: a browser or extension setting that sends an opt-out preference signal. It is a technical signal, not a law; each state’s rules decide its effect.
- Choices to offer
- Signal handling: treat GPC as an opt-out of sale, sharing or targeted advertising where the law requires it, alongside your own opt-out method.
- Website actions
- Detect GPC before affected tags or transfers run.
- Apply the opt-out to the browser and any known profile.
- Do not let an earlier “accept” override the signal.
- Show visitors that the opt-out was honoured.
- Test server-side and audience flows, not only the banner.
- Primary sources
- CCPA regulations (§7025), California Attorney General: GPC, Colorado Attorney General: universal opt-out and GPC specification
- Last reviewed
When is GPC a legal opt-out?
GPC is a technical signal, not a law. Its effect depends on which state law applies, whether your business is in scope and which data activity is involved.
In California, a CCPA-covered business that sells or shares personal information must treat a qualifying opt-out preference signal as a valid opt-out of sale and sharing; the California Attorney General names GPC as such a signal. In Colorado, covered controllers have had to honour universal opt-out mechanisms for sale and targeted advertising since 1 July 2024, and the Colorado Attorney General recognises GPC as the only one so far.
Other state laws differ: some require you to honour these signals, some do not. Check each market instead of copying the California setup; the Colorado CPA guide covers Colorado’s other rules.
From 1 January 2027, California also requires businesses that make or maintain a web browser to offer a setting that sends an opt-out preference signal (Civil Code §1798.136), so more visitors may arrive with one switched on.
What the signal does, and does not, mean
Browsers send GPC as the Sec-GPC: 1 request header and expose it to scripts as navigator.globalPrivacyControl. Where the law gives it effect, it is an opt-out of sale and sharing in California, and of sale and targeted advertising in Colorado.
It is not a request to delete data or close an account, and it is not an automatic “reject all cookies” under every legal regime. Checkout, security and other necessary functions continue.
A missing signal is not consent. Where your website also serves regions that require prior consent, such as the EU, keep those choices separate from US opt-out signals.
Example: a visit with GPC switched on
Illustrative example: an online shop selling outdoor gear is covered by the CCPA and shares browsing events with an advertising platform through a pixel and a server-side conversion feed. A California customer arrives on a campaign landing page with GPC enabled.
- Signal received: the first page request carries the signal, before any advertising tag runs.
- Opt-out recorded: the site stores an opt-out of sale and sharing for that browser, with no click, form or sign-in.
- Browser flows react: the advertising pixel does not load; the basket and checkout work as normal.
- Server flows react: the conversion feed stops sending this browser’s events to the platform.
- Known profile handled: when the customer signs in, the account is opted out too and left out of audience uploads, as California’s rules require for a known consumer.
- Status shown: the site displays that the opt-out was honoured.
To test it, repeat the visit without GPC and compare the requests. Only the activities covered by the opt-out should differ.
What if GPC conflicts with an earlier choice?
A visitor may already have a stored banner choice, an account setting or a loyalty membership when the signal arrives. California and Colorado resolve the conflict in favour of the signal, with limited ways to ask again.
| Signal received | Previous preference | Activity affected | Expected effect |
|---|---|---|---|
| GPC on a first visit | Previous preferenceNone | Activity affectedSale, sharing or targeted advertising | Expected effectApply the opt-out at once, with no click needed. |
| GPC after a banner “accept” | Previous preferenceStored setting allowing sale or sharing | Activity affectedAd tags that sell or share data | Expected effectApply the opt-out. California lets you mention the conflict and offer consent. |
| GPC from a signed-in customer | Previous preferenceAccount setting allowing sale or sharing | Activity affectedSale or sharing tied to the account, online and offline | Expected effectApply the opt-out to the browser and the account. |
| GPC from a loyalty member | Previous preferenceProgramme that needs consent to sale or sharing | Activity affectedSale or sharing for the programme | Expected effectCalifornia: you may ask if they mean to leave. Apply the opt-out unless you asked and they did not confirm. |
| No signal on a later visit | Previous preferenceEarlier GPC opt-out by a known customer | Activity affectedSale, sharing or targeted advertising | Expected effectKeep the opt-out. |
| GPC still on after opting back in | Previous preferenceLater consent through your privacy settings | Activity affectedThe use consented to | Expected effectValid consent can prevail (in California, while the visitor is known). Keep showing the status. |
In California, mentioning the conflict is optional. Any consent request must offer clear, symmetric choices, and a business relying on frictionless processing to skip the “Do Not Sell or Share” link cannot show such prompts. Beyond that, wait at least 12 months before asking an opted-out visitor to opt back in (CCPA regulations §7025 and §7026).
Colorado’s rules are similar: treat the browser, device and known consumer as opted out until they consent, and do not ask through pop-ups, page-dominating banners or other interstitials. A link to a privacy settings page, for example beside the opt-out status, is an accepted route (CPA Rules 5.08, 5.09 and 7.05).
Carry the opt-out through every data flow
List the tools involved in sale, sharing or targeted advertising: pixels, server-side events, customer-list uploads and partner integrations. Judge each by its use and recipient, not its cookie name. In California, a service provider under a compliant contract is outside the opt-out, but a vendor providing cross-context behavioural advertising is a third party.
Read the signal on every entry page, including campaign landing pages and checkout, before affected tags run. Stopping a transfer after the banner loads leaves data already sent.
Then check what continues outside the browser: conversion APIs, audience exports and partner settings. California requires you to stop sale and sharing as soon as feasibly possible and to notify third parties that received the data in the meantime.
Passiro handles Global Privacy Control on every plan and treats a supported signal as an opt-out automatically in the consent setup it manages on your website. Server-side integrations, audience uploads and account records sit outside any browser tool, so test them separately.
Expect smaller remarketing audiences where the opt-out applies, and plan reporting around that rather than rebuilding the same data flow under another label.
Show and explain the result
California’s current regulations require you to display whether you processed the signal as an opt-out, for example “Opt-Out Request Honored” or a settings toggle showing the opt-out. Colorado allows a similar display but does not require it.
Your privacy policy should describe the opt-out rights and how you handle signals. Colorado requires it to explain how universal opt-out requests are processed; in California, a business relying on frictionless processing must say so and explain how to turn on a signal.
Label the choice as “sale or sharing” rather than an unexplained “personalisation” toggle, and keep access and deletion requests easy to find: they are separate processes.
GPC checklist
- Scope: record which state laws apply and which activities count as sale, sharing or targeted advertising.
- First visit: compare requests on a campaign landing page with and without GPC.
- Earlier choices: send GPC from a browser that previously accepted, and confirm the opt-out wins.
- Signed-in journey: confirm the account is marked as opted out and left out of audience uploads.
- Server side: check conversion APIs and partner integrations, not only browser tags.
- Status and policy: confirm the honoured status shows and the privacy policy matches.
FAQ
Is GPC the same as “Do Not Track”?
No. They are different signals with different legal treatment. Detecting one does not mean your site handles the other correctly.
Does every California website have to honour GPC?
No. The duty applies to CCPA-covered businesses that sell or share personal information. A covered business that does neither need not apply the signal, but its privacy policy should say that it does not sell or share.
Can we require sign-in or extra details first?
No. California and Colorado do not let you make the opt-out depend on an account or extra information. You may offer an optional field, such as an email address, to extend the opt-out offline or across devices, and use it only for that.
Does honouring GPC replace our opt-out link?
Not by itself. In California you must process signals even if you post the opt-out links, and you may skip the “Do Not Sell or Share” link only with frictionless processing that fully carries out the opt-out. Colorado also requires a clear opt-out method. The CCPA guide covers the link options.
Can we apply GPC only to visitors from certain states?
Many sites use location to decide where the signal applies, and Colorado’s rules allow, but do not require, a residency check. Location detection is approximate, so decide how to treat unknown locations. As a practical choice, applying GPC to all US visitors is simpler to test and explain.