Global Privacy Control (GPC) explained for website owners

Global Privacy Control, or GPC, lets people set their privacy choice once in their browser instead of on every website. When it is on, every site they visit receives the same message: do not sell or share my personal information.

How GPC works technically

A browser with GPC turned on sends the HTTP header Sec-GPC: 1 with every request and exposes navigator.globalPrivacyControl === true to JavaScript. Your server or your consent script can read either one. Brave and DuckDuckGo send it by default, Firefox has a setting for it, and privacy extensions add it to Chrome and other browsers.

Where GPC is legally required

California regulations under the CCPA require covered businesses to treat GPC as a valid request to opt out of sale and sharing. Colorado requires recognition of universal opt-out mechanisms and recognised GPC as one in 2024. Connecticut, Oregon, Texas, Montana, New Jersey and several other states with comprehensive privacy laws have similar requirements. The list keeps growing, so check the current state of the law for the states where you have customers.

Each law has its own thresholds, such as revenue or the number of residents whose data you process, so not every business is covered. If you run ads or analytics that count as sharing, honouring GPC is usually the safer default.

Step by step

1. Check which state laws apply to you. Review revenue and data thresholds for the states where your visitors live.
2. Turn on GPC detection in your banner. In North Consent, it is on by default under Regional rules.
3. Map GPC to your marketing category. A GPC signal should switch off sale and sharing, which usually means marketing.
4. Test with a GPC browser. Open the site in Brave or Firefox with GPC on and confirm marketing tags do not fire.
5. Mention GPC in your privacy policy. Explain that you honour the signal and what it changes.

What honouring GPC means in practice

• Turn off the marketing category, including ad pixels and retargeting, for that visitor.
• Send ad_storage, ad_user_data and ad_personalization as denied in Google Consent Mode.
• Do not show a pop-up asking the visitor to confirm or override the signal.
• Optionally show a small note that their GPC signal was honoured.

GPC in Canada and Europe

Canadian and EU laws do not name GPC. Many sites still honour it everywhere because it is a clear statement of the visitor’s wishes. North Consent honours GPC by default in every region, and you can change that per region on Pro and Agency. See how the laws compare in our Law 25, PIPEDA, US and GDPR comparison.