What Is the Global Privacy Control?
The Global Privacy Control (GPC) is a browser-level signal that tells every website you visit — automatically, without you having to click anything — that you want to opt out of the sale and sharing of your personal data.
It was developed by a coalition of privacy advocates, browser makers, and technology companies in 2020, modeled on the earlier (and largely ignored) Do Not Track signal. Unlike Do Not Track, the GPC has legal teeth: California's CPRA, Colorado's CPA, and Connecticut's CTDPA all legally require covered businesses to honor the GPC signal as a valid opt-out.
Think of it as a privacy preference you set once, and it works automatically everywhere — without you having to find and click the "Do Not Sell" link on every website you visit.
Which States Legally Honor GPC?
As of 2024–2025, the following states have explicitly required businesses to honor the Global Privacy Control as a valid opt-out mechanism:
California: The CPRA explicitly requires businesses to honor "opt-out preference signals" like GPC. The CPPA has confirmed that GPC compliance is mandatory for covered businesses. Violations are enforceable by the CPPA.
Colorado: The Colorado Privacy Act requires covered businesses to honor universal opt-out mechanisms, and the Colorado AG has confirmed GPC qualifies. This requirement took effect July 1, 2024.
Connecticut: The CTDPA similarly requires businesses to recognize user-enabled global opt-out settings. Effective October 1, 2024.
Texas, Montana, Oregon, and others: Several other state laws include or are expected to include universal opt-out mechanism requirements, though implementation timelines vary.
How to Enable GPC in Your Browser
Enabling GPC takes less than two minutes:
Firefox: Go to Settings → Privacy & Security → scroll to "Website Privacy Preferences" → check "Tell websites not to sell or share my data." GPC is now built into Firefox and sends the signal automatically.
Brave Browser: GPC is enabled by default in Brave. Go to Settings → Privacy and Security → confirm "Send a 'Do Not Track' request with your browsing traffic" is enabled. Brave also sends the GPC signal automatically.
Chrome (via extension): Install the Global Privacy Control extension from the Chrome Web Store (published by privacytests.org or the GPC project). After installation, the signal is sent automatically.
Safari (via extension): Install the Privacy Browser extension from the App Store, which includes GPC functionality for Safari on Mac and iOS.
Mobile browsers: Firefox Focus on iOS and Android sends GPC by default. Brave for mobile also sends the signal.
What GPC Can and Cannot Do
What GPC does: Sends a legally valid opt-out signal to covered businesses in GPC-compliant states. This should stop those businesses from selling or sharing your personal data for targeted advertising. It also often triggers other privacy protections — many companies use GPC receipt as a trigger for broader privacy-respecting behavior.
What GPC does not do:
It doesn't delete data that's already been collected. It doesn't automatically remove you from data broker databases. It doesn't protect you from data collection by businesses not covered by state privacy laws (small businesses, nonprofits, etc.). It doesn't stop all tracking — only the sale/sharing of that tracked data. It doesn't substitute for other privacy tools like VPNs, private DNS, or ad blockers.
For maximum protection, use GPC in combination with a privacy-respecting browser, an ad blocker (like uBlock Origin), and regular opt-out requests to major data brokers.
Verifying That GPC Is Working
You can verify that your browser is correctly sending the GPC signal in a few ways:
Visit globalprivacycontrol.org/guide: This site will detect and display whether your browser is currently sending the GPC signal. It's the quickest verification tool.
Visit privacytests.org: This site runs comprehensive tests on your browser's privacy settings, including GPC, and gives you a report card.
Check a company's response: Visit the privacy settings page of a major company like Best Buy, Walmart, or the New York Times. If GPC is working, you should see a notice that your opt-out preference has been received and honored.
The GPC signal is technically implemented as an HTTP request header (Sec-GPC: 1) sent with every web request. Developer tools in your browser can confirm the header is being sent.