Global Privacy Control (GPC): Which Laws Require It, With Code

Regulators have spent four years telling websites to honor Global Privacy Control, and three companies have now paid seven-figure settlements for ignoring it: Sephora ($1.2M), Healthline ($1.55M), and Tractor Supply ($1.35M). The signal itself is almost comically simple — one HTTP header, one boolean — yet most compliance articles explain the law at length and never show you a single line of code.

This guide does both. We'll cover what GPC is, which laws actually require honoring it as of mid-2026 (twelve states, verified below), what "honoring" means operationally, and the actual detection code for the browser and the server.

If your site has US traffic and runs third-party ad pixels — which regulators usually count as "selling or sharing" — this is no longer optional homework.

What is Global Privacy Control?

Global Privacy Control (GPC) is a browser-level signal that tells every website you visit "do not sell or share my personal information." Technically it's two artifacts: an HTTP request header (Sec-GPC: 1) and a JavaScript property (navigator.globalPrivacyControl === true). Twelve US state privacy laws currently require businesses to treat it as a valid opt-out request.

The user flips one switch in their browser or extension, and the signal rides along with every request — no banners, no per-site forms. State laws give consumers the right to opt out of data sales and targeted advertising; GPC lets them exercise it everywhere at once.

Standardization status (June 2026)

GPC started as a proposal from a coalition including the California AG's office, EFF, and major publishers. It's now an official work item of the W3C Privacy Working Group, published as a Working Draft on the Recommendation track (most recently updated April 2026). So: not yet a finished W3C Recommendation, but far past the "experimental" stage — the spec is stable enough that two state attorneys general and the CPPA enforce against it by name.

The spec defines three things:

Which browsers and extensions send GPC?

• Brave and the DuckDuckGo browser — built in, on by default
• Firefox — built in, user-enabled in settings
• Extensions for Chrome and others: Privacy Badger (EFF), DuckDuckGo Privacy Essentials, OptMeowt, Disconnect
• Chrome, Safari, and Edge — no native support yet

That last line has an expiration date. California's Opt Me Out Act (AB 566), signed October 8, 2025, requires browser makers to ship a built-in opt-out preference signal by January 1, 2027. Once Chrome has a GPC toggle in settings, expect the share of GPC traffic — currently a few percent on most sites — to jump. The globalprivacycontrol.org project already counts 150M+ users with access to the signal.

Which laws require honoring GPC in 2026?

Twelve states, all in force as of June 2026. Verified dates:

A few details worth knowing:

• Colorado runs a shortlist. The Colorado AG maintains a public list of recognized universal opt-out mechanisms — and GPC is currently the only mechanism on it. When new mechanisms are added, controllers get six months to support them. Several other states (Texas, Montana, Delaware, Minnesota) wrote their requirements generically as "opt-out preference signals," which today means GPC in practice.
• California's rules are the most detailed. CCPA regulations §7025 spells out exactly how to process the signal (more below), and a 2026 amendment added a new obligation: since January 1, 2026, businesses must display on their site whether they've processed a visitor's opt-out preference signal — previously this was optional.
• Other state laws (Virginia, Utah, Iowa, Tennessee, Indiana, Kentucky, Rhode Island, and friends) grant opt-out rights but don't make you read them from a browser signal. Given the twelve above, most teams honor GPC for all US visitors rather than maintaining a state-by-state matrix. For the broader per-state picture, see our US state cookie banner requirements guide.

Note that GPC is a US story for now. The EU's GDPR/ePrivacy regime requires opt-in consent before non-essential cookies fire, so a missing GPC signal means nothing there — see where opt-in consent is required and our CCPA vs GDPR comparison for how the two models differ.

What "honoring GPC" actually means

California's §7025 is the strictest spec, and the other states are close enough that building to it covers you everywhere. Operationally:

1. Treat the signal as a valid opt-out of sale/sharing (California) and of targeted advertising and sales (everyone else). Practically: don't fire third-party ad tech, don't pass identifiers to data brokers, turn off "sharing" for cross-context behavioral advertising.
2. Scope it to the browser/device and any associated profile, including pseudonymous profiles. An anonymous visitor with GPC on is opted out for that browser.
3. If you know who the user is (logged in, or otherwise identifiable), apply the opt-out to the consumer themselves — their account, and offline sales/sharing too, not just the current session.
4. No extra steps. You cannot make GPC users fill out a form, click a confirmation, or provide more information to "complete" the opt-out. The signal is the request. (You may offer an optional way to identify themselves so the opt-out follows their account.)
5. GPC wins conflicts. If the signal contradicts an earlier banner choice ("Accept all" last month, GPC today), process the opt-out. You may then notify the user and let them re-confirm — the main carve-out is bona fide loyalty/financial-incentive programs, where you can ask for confirmation first.
6. Check on every request. Users toggle GPC on and off; the signal applies whenever it's present. Don't cache the decision for a year.
7. Show your work (California, since Jan 1, 2026). Display whether you processed the signal — e.g. a "GPC signal honored" state on your banner or preferences widget.

Detecting GPC: the code

Client-side JavaScript

function gpcEnabled() {
  return navigator.globalPrivacyControl === true;
}

if (gpcEnabled()) {
  // Treat as an opt-out of sale/share + targeted advertising.
  window.consentState = window.consentState || {};
  window.consentState.adPersonalization = false;
  window.consentState.dataSharing = false;

  // Example: Google Consent Mode v2
  gtag('consent', 'update', {
    ad_user_data: 'denied',
    ad_personalization: 'denied',
    ad_storage: 'denied'
  });
}

The property is true when the signal is sent, and false or undefined otherwise — so always compare against true rather than truthiness gymnastics. Run this before your tag manager fires anything that sells or shares data, not after.

Server-side: the Sec-GPC header

Anything the browser requests — HTML, API calls, server-rendered pages — carries Sec-GPC: 1 when GPC is on. In Rails:

# app/controllers/application_controller.rb
class ApplicationController < ActionController::Base
  before_action :detect_gpc

  private

  def detect_gpc
    @gpc_opt_out = request.headers["Sec-GPC"] == "1"
  end
end

Then use it where decisions get made:

# Suppress server-side ad/share calls for GPC users
def sync_to_ad_partner(user)
  return if @gpc_opt_out

  AdPartnerClient.sync(user)
end

# Apply the opt-out to a known consumer (§7025(c)(3)):
def apply_gpc_to_account
  return unless @gpc_opt_out && current_user

  unless current_user.opted_out_of_sale?
    current_user.update!(opted_out_of_sale: true,
                         opt_out_source: "gpc",
                         opt_out_recorded_at: Time.current)
  end
end

One caveat: if you serve cached pages through a CDN, the header check happens too late or not at all for cached responses. Either vary your cache on Sec-GPC (it's a low-cardinality header, so this is cheap) or handle GPC purely client-side and in your APIs.

Wiring GPC into consent state and handling conflicts

The annoying edge case is a stored banner choice that disagrees with the live signal. The rule in every state that addresses it (California, Connecticut, Delaware, and others): the signal overrides the older choice, and you may ask the user to re-confirm.

const stored = loadConsentChoices();        // from your CMP / cookie
const gpc = navigator.globalPrivacyControl === true;

if (gpc && stored?.adPersonalization === true) {
  // GPC wins. Opt them out now...
  applyOptOut();
  // ...then optionally surface a notice:
  // "Your browser sent a Global Privacy Control signal, so we've
  //  opted you out of targeted advertising. Re-enable it here."
} else if (gpc) {
  applyOptOut();   // no conflict, just honor it silently
}

And publish the optional well-known resource so auditors and crawlers can see you participate — served at GET /.well-known/gpc.json:

{ "gpc": true, "lastUpdate": "2026-07-21" }

Enforcement: this is the most-cited violation in US privacy actions

• Sephora — $1.2M (August 2022). The California AG's first big CCPA settlement: Sephora "failed to process user requests to opt out of sale via user-enabled global privacy controls," and had to start honoring GPC and report compliance to the AG.
• Healthline — $1.55M (July 2025). The largest CCPA settlement to date. Healthline kept sending visitor data to ad partners after opt-outs — including GPC signals — and had a misconfigured opt-out mechanism it never tested. That last detail is the lesson: test the pipeline end to end.
• Tractor Supply — $1.35M (September 2025). The CPPA's record fine. Among the violations: no effective opt-out mechanism, "including through opt-out preference signals such as Global Privacy Control." Remediation includes quarterly scans of its digital properties for four years.

Connecticut's AG has run GPC enforcement sweeps too. The pattern across all of them: regulators install Privacy Badger, visit your site, and watch the network tab. You should do the same before they do.

What to actually do

1. Decide your scope. Easiest defensible choice: honor GPC for all US visitors (or globally) instead of geo-fencing twelve states.
2. Detect the signal client-side (navigator.globalPrivacyControl) and server-side (Sec-GPC header), per the code above.
3. Map "opt-out" to concrete tag behavior. List every tag/pixel/SDK that sells or shares data and make sure the opt-out state actually blocks it — including Consent Mode signals to Google.
4. Handle known users. Persist the opt-out to the account when the visitor is logged in.
5. Resolve conflicts in GPC's favor, with an optional re-confirm prompt.
6. Display the processed status (mandatory in California since January 2026).
7. Log it. Keep records of received signals and applied opt-outs — that's your evidence when a regulator asks.
8. Test like a regulator: Firefox or Brave with GPC on, open DevTools, confirm ad-tech requests stop firing. Re-test after every tag change.

Where CookieChimp fits

You can build all of this by hand — or let your CMP do it. CookieChimp has supported GPC natively since early 2024: it detects the signal, applies the opt-out to the consent state automatically, syncs it to Google Consent Mode v2, and logs the event for your audit trail. Combined with geo-targeted banners (opt-in UX for the EU, opt-out for the US), one snippet covers both regimes without custom plumbing.

Supportive: GPC is the rare privacy mechanism that's genuinely good engineering — one header, clear semantics. Cynical: it took $4M in settlements to make people read one header.

FAQ

References

1. W3C Privacy Working Group, "Global Privacy Control (GPC)" (Working Draft): w3.org
2. Global Privacy Control project, "Take Control of Your Privacy": globalprivacycontrol.org
3. Cornell LII, "Cal. Code Regs. Tit. 11, § 7025 – Opt-Out Preference Signals": law.cornell.edu
4. California Attorney General, "Attorney General Bonta Announces Settlement with Sephora": oag.ca.gov
5. California Attorney General, "Attorney General Bonta Announces Largest CCPA Settlement to Date, Secures $1.55 Million from Healthline.com": oag.ca.gov
6. California Privacy Protection Agency, "CPPA Settlement with Tractor Supply Company" (September 30, 2025): cppa.ca.gov
7. Connecticut Attorney General, "Tong Advises Connecticut Consumers and Businesses of Opt Out Rights and Requirements": portal.ct.gov
8. Oregon Department of Justice, "Oregon DOJ Highlights New Universal Opt-Out Tool on Data Privacy Day": doj.state.or.us
9. Minnesota Statutes § 325M.14, "Consumer Personal Data Rights": revisor.mn.gov
10. Future of Privacy Forum, "Colorado's Approval of Global Privacy Control: Implications for Advertisers and Publishers": fpf.org
11. IAPP, "California governor signs new law requiring in-browser opt-out preference signal" (AB 566): iapp.org

Honoring GPC takes a CMP that treats the signal as a first-class consent input — CookieChimp does it out of the box. Get started with CookieChimp.