Short answer: some ad blockers send the Global Privacy Control (GPC) signal, but many do not. Installing an ad blocker does not automatically mean your browser is sending GPC.
That distinction matters.
An ad blocker can stop an advertising script from loading without communicating any legal privacy preference to the website. Global Privacy Control does something different: it tells the website that the user wants to exercise applicable privacy rights concerning the sale, sharing, or use of personal data for targeted advertising.
Some privacy-focused browsers and extensions now do both.
Others block ads and trackers without sending GPC at all.
And as of 2026, several lists circulating online about which blockers support GPC are already out of date.
Do ad blockers automatically send GPC?
No.
Ad blocking and Global Privacy Control are separate technologies.
An ad blocker generally works by identifying network requests, scripts, domains, advertising resources, cookies, or page elements and preventing some of them from loading.
GPC is a privacy preference signal sent by the browser or an extension.
When GPC is active, the browser can send:
Sec-GPC: 1
as an HTTP request header.
GPC can also be exposed to website JavaScript through:
navigator.globalPrivacyControl
A website receiving that signal can then determine that the user has enabled Global Privacy Control and apply the appropriate privacy choices.
Blocking an advertising request does not itself create that signal.
This means a browser could block dozens of trackers while never telling the website that the visitor has exercised a legal opt-out right.
The reverse is also possible: a browser can send GPC while allowing a website’s scripts to load. In that situation, the responsibility falls on the website and its privacy infrastructure to interpret the signal and change what happens with the user’s data.
That is the fundamental difference between an ad blocker and GPC.
Which ad blockers send the GPC signal?
The answer changes as browser extensions update, so any list should include a date.
As of August 2026, several privacy products support GPC, while support among traditional ad blockers remains inconsistent.
Privacy Badger: Yes
Privacy Badger sends Global Privacy Control by default.
The Electronic Frontier Foundation describes Privacy Badger primarily as a tracker blocker rather than a traditional ad blocker. It sends GPC alongside its technical tracking protections.
That gives users two different forms of protection.
Privacy Badger can attempt to stop tracking technically, while GPC communicates the user’s privacy preference to the website.
DuckDuckGo: Yes
DuckDuckGo’s browser and browser extensions support GPC.
DuckDuckGo says GPC is enabled by default in its privacy products. Its Chrome, Firefox, Edge and Opera extensions can send GPC through both the request header and JavaScript interface.
DuckDuckGo is another good example of why “ad blocker” is becoming an imprecise term. Its privacy products combine tracker blocking, cookie protections and privacy signals rather than performing only conventional advertisement filtering.
Ghostery: Yes
Ghostery now supports GPC.
This deserves attention because older comparisons may say otherwise.
Ghostery’s April 2026 product release added transmission of the Global Privacy Control signal. In July 2026, Ghostery added full GPC support that exposes the preference to websites through the JavaScript API as well.
Any comparison stating categorically that Ghostery does not send GPC should therefore be checked against the current Ghostery version.
AdGuard: Yes, when the relevant privacy setting is enabled
AdGuard also supports Global Privacy Control.
AdGuard documents a privacy setting called “Ask websites not to track me,” which sends Global Privacy Control and Do Not Track signals to visited websites.
Its browser extension added Global Privacy Control support to its Stealth Mode functionality several years ago.
This is another case where current product documentation matters. Some recent online comparisons continue to categorize AdGuard as an ad blocker that does not support GPC, despite AdGuard’s own documentation describing the feature.
Users should still check which AdGuard product they are running and whether the applicable tracking-protection setting is enabled.
uBlock Origin: Do not assume GPC is being sent
uBlock Origin is one of the most capable content blockers available, but using uBlock Origin should not by itself be treated as evidence that a GPC signal is active.
uBlock Origin’s primary function is network and content filtering. It blocks advertising, trackers and other unwanted resources using filter lists and user-defined rules.
That is different from automatically expressing a Global Privacy Control preference.
The distinction between classic uBlock Origin and uBlock Origin Lite also matters. The products operate under different browser extension architectures and support different capabilities. Advanced configurations can modify request headers in some environments, but users should not infer from the presence of uBlock Origin that Sec-GPC: 1 is being transmitted.
If GPC matters to you, test the browser rather than relying on the name of the extension.
AdBlock and Adblock Plus: Do not assume GPC support
The same rule applies to conventional ad-blocking extensions such as AdBlock and Adblock Plus.
Their principal job is blocking advertising and selected tracking resources.
An ad blocker may substantially reduce tracking without implementing Global Privacy Control as a default privacy preference signal.
Unless the product specifically states that it sends GPC, users should verify the browser’s actual behavior.
Current GPC support at a glance
| Browser or privacy tool | GPC support? | Important detail |
|---|---|---|
| Brave | Yes | GPC is supported natively |
| DuckDuckGo Browser | Yes | Enabled by default |
| DuckDuckGo Extension | Yes | Sends GPC |
| Firefox | Yes | Available through Firefox privacy settings |
| Privacy Badger | Yes | Sends GPC by default |
| Ghostery | Yes | GPC added in 2026; full JS support added in July 2026 |
| AdGuard | Yes | Available through its privacy/tracking-protection settings |
| uBlock Origin | Do not assume | Content blocking does not itself mean GPC is active |
| uBlock Origin Lite | Do not assume | Check the actual signal rather than relying on the extension |
| AdBlock | Do not assume | Ad blocking and GPC are separate functions |
| Adblock Plus | Do not assume | Verify independently |
The most important column is not the product name. It is whether the browser actually sends the signal.
What about browsers?
You do not necessarily need an ad blocker to use Global Privacy Control.
Several browsers support GPC directly.
Brave
Brave has long supported GPC as part of its built-in privacy protections.
The browser treats GPC as an additional layer rather than a replacement for tracker blocking. This is an important design distinction: Brave can attempt to prevent tracking technically while simultaneously communicating the user’s opt-out preference.
Firefox
Firefox introduced built-in Global Privacy Control support in Firefox 120.
Users can enable the setting under Firefox’s privacy controls by selecting the option telling websites not to sell or share their data.
Mozilla makes the distinction particularly clear in its documentation: GPC is a signal, not a blocker.
Firefox therefore combines GPC with separate technologies such as Enhanced Tracking Protection.
DuckDuckGo
DuckDuckGo supports GPC in its browsers and browser extensions and enables the setting by default.
Its desktop extensions can transmit both the GPC HTTP header and JavaScript signal.
How can you tell whether your ad blocker sends GPC?
Test it.
The official Global Privacy Control website provides a reference test that can determine whether GPC is active in your browser.
You can also inspect it yourself.
Check the JavaScript GPC value
Open the browser’s developer console and enter:
navigator.globalPrivacyControl
If the browser exposes the GPC JavaScript property and GPC is active, you should see:
true
A result of false, undefined, or no property does not necessarily tell you everything about the HTTP header, however.
Check the Sec-GPC header
Open your browser’s developer tools and inspect a network request.
Look at the request headers for:
Sec-GPC: 1
That confirms that the browser is transmitting GPC at the HTTP level.
For privacy compliance testing, checking both is preferable.
Why isn’t blocking ads the same as opting out?
Consider a website running a Meta Pixel.
An ad blocker may recognize the Meta request and stop it from reaching Meta.
That protects the user technically.
But the website itself may never receive a statement saying:
“I am exercising my right to opt out of the sale or sharing of my personal information.”
GPC provides that statement.
Now consider a server-side advertising integration.
A traditional browser extension may have nothing obvious to block because the transfer occurs through the website’s backend rather than directly from the browser to the advertising company.
GPC still tells the website about the user’s preference.
The site’s legal and technical obligations can therefore extend beyond what an ad blocker can see.
This is why GPC should not be viewed as another filter list.
It operates at a different layer.
GPC is not Do Not Track
Global Privacy Control is also different from the older Do Not Track, or DNT, signal.
DNT attempted to communicate a user’s desire not to be tracked, but it never received the same legal recognition that GPC has developed.
Mozilla removed the traditional Do Not Track setting beginning with Firefox 135 and now directs users toward Global Privacy Control instead.
GPC was designed around privacy rights that exist under statutes such as the California Consumer Privacy Act.
California’s Attorney General describes it as a mechanism consumers can use to opt out of the sale or sharing of personal information. Covered businesses must honor a qualifying user-enabled GPC signal.
Colorado has gone further by formally recognizing GPC as a Universal Opt-Out Mechanism under the Colorado Privacy Act.
Other U.S. state privacy statutes have added similar requirements.
The practical distinction is substantial.
Ad blocking says, technically, “this request isn’t leaving my browser.”
GPC says, “I am communicating a privacy preference that may carry legal consequences for what you do with my data.”
Does a website have to honor GPC if an ad blocker sends it?
The website’s obligation depends on the law that applies to the business, the consumer and the processing involved.
In California, covered businesses must treat qualifying Global Privacy Control signals as valid requests to opt out of the sale or sharing of personal information.
Colorado requires covered controllers to recognize qualifying Universal Opt-Out Mechanisms for sale and targeted advertising. The Colorado Attorney General currently recognizes GPC as a valid UOOM.
A growing group of state privacy laws contains comparable opt-out preference signal requirements.
The fact that the signal comes from a privacy extension rather than a browser does not automatically make it meaningless.
What matters is whether the signal qualifies under the applicable legal framework and represents the consumer’s privacy preference.
California has already enforced GPC
This is not a theoretical technical standard.
California’s 2022 Sephora enforcement action remains the best-known example.
The California Attorney General alleged that Sephora failed to process consumer opt-out requests transmitted through user-enabled Global Privacy Controls.
Sephora agreed to a $1.2 million settlement and, among other requirements, had to provide mechanisms for honoring Global Privacy Control.
That case changed the compliance discussion around browser privacy signals.
A company cannot safely treat GPC as an obscure browser preference that nobody checks.
Regulators can reproduce the same test themselves: enable GPC, load the website and observe what happens.
Receiving GPC is only the first part of compliance
For businesses, detecting:
Sec-GPC: 1
is easy.
What happens next is harder.
A website may correctly detect GPC while advertising pixels continue to fire.
A CMP might update an internal preference while Google Tag Manager continues loading tags configured outside the consent architecture.
Client-side tracking might stop while server-side data sharing continues.
A privacy banner may even say that the preference has been honored while the network activity tells a different story.
That is why GPC compliance should be tested based on behavior, not solely configuration.
The real questions are:
Did the website detect the signal?
Which privacy state did the CMP apply?
Which cookies were created?
Which third-party requests fired?
Did advertising or cross-context behavioral advertising technologies continue operating?
Did server-side systems receive the same privacy preference?
Was the preference retained appropriately?
If the visitor later logs into an account, is the preference handled as required by applicable law?
Those are implementation questions, not banner-design questions.
Ad blockers can actually make GPC testing harder
There is another issue privacy teams should understand.
Suppose you test your own website while running an aggressive ad blocker.
The blocker prevents Meta, Google, TikTok and other tracking technologies from loading.
You enable GPC.
Nothing fires.
The website appears compliant.
But you have not necessarily tested whether your website honored GPC.
Your extension may simply have blocked the requests before your website’s consent architecture had a chance to make the decision.
For compliance testing, you need to distinguish between:
The browser blocking the tracker
and
The website honoring the privacy signal.
Those are not the same result.
A proper GPC audit should test what the website itself does when presented with the signal.
This is particularly important for privacy teams, defense counsel and organizations trying to document that their controls actually operate as designed.
What website owners should do
Do not design your GPC implementation around a list of particular browsers or ad blockers.
Detect the signal itself.
Your privacy stack should be capable of recognizing qualifying GPC requests regardless of whether they originated from Firefox, Brave, DuckDuckGo, Privacy Badger, Ghostery, AdGuard or another compliant implementation.
Then test what happens after detection.
Captain Compliance’s approach is to distinguish between merely recognizing GPC and actually enforcing the corresponding privacy state across the website.
That includes examining the cookies, trackers, pixels and scripts that continue operating after a GPC-enabled visitor arrives.
This matters because a CMP showing “opted out” is not much evidence if advertising requests continue leaving the page.
What if GPC and the cookie banner disagree?
This is another common implementation problem.
Suppose a visitor arrives with GPC enabled but then encounters a cookie banner offering an “Accept All” button.
Which signal wins?
The answer depends on the applicable law, the nature of the later interaction and whether that interaction constitutes a valid request to change the consumer’s preference.
Businesses should not simply overwrite a GPC preference because the visitor clicked through an unrelated interface.
The consent architecture needs defined precedence rules for browser-level signals, account-level choices and site-specific preferences.
This is one reason universal opt-out handling should be designed as part of the consent architecture rather than added later as a single JavaScript check.
Does Chrome send GPC?
Standard Chrome should not be assumed to transmit Global Privacy Control simply because a user has enabled Chrome’s privacy settings or installed an ordinary ad blocker.
Chrome users can obtain GPC through supported extensions.
That means two people using the same version of Chrome may send completely different privacy signals depending on their installed extensions and settings.
For website owners, browser identification is therefore the wrong approach.
Detect GPC directly.
Does Safari send GPC?
Safari includes extensive privacy and tracking protections, but website operators should not treat Safari usage itself as proof that a GPC signal has been sent.
Again, tracking prevention and GPC are separate concepts.
Your implementation should respond to the actual signal rather than trying to infer a user’s privacy preferences from the browser they use.
Does Firefox send GPC?
Firefox supports Global Privacy Control natively.
Users can enable the option telling websites not to sell or share their data from Firefox’s Privacy & Security settings.
Once enabled, Firefox can communicate that preference to websites automatically.
Does Brave send GPC?
Yes.
Brave supports Global Privacy Control as part of its built-in privacy functionality and has been involved in GPC since the standard’s early development.
Brave’s approach combines technical browser privacy controls with the separate GPC preference signal.
Does Privacy Badger send GPC?
Yes.
Privacy Badger sends GPC by default in addition to its tracker-blocking functionality.
Does Ghostery send GPC?
Yes, current versions do.
Ghostery added GPC signaling in April 2026 and expanded that implementation in July 2026 so websites can access the preference through the JavaScript GPC API.
Older articles saying Ghostery does not support GPC may now be outdated.
Does AdGuard send GPC?
AdGuard supports GPC through its tracking-protection privacy settings.
Users should check that the applicable “Ask websites not to track me” functionality is enabled for the AdGuard product they are using.
Does uBlock Origin send GPC?
Do not assume that it does simply because uBlock Origin is installed.
uBlock Origin is primarily a content and network blocker. Users who specifically want GPC should verify whether Sec-GPC: 1 is present in their browser requests or use a browser or extension with documented GPC support.
The answer: some ad blockers send GPC, but never assume
So, do ad blockers send the GPC signal?
Some do.
Some don’t.
Some privacy tools send GPC by default. Others make it an optional setting. Traditional ad blockers may block substantial amounts of tracking without transmitting Global Privacy Control at all.
That distinction matters for consumers, but it matters even more for businesses testing their privacy controls.
A visitor using an ad blocker cannot automatically be classified as a GPC visitor.
A visitor sending GPC cannot be assumed to have an ad blocker.
And a website that appears tracker-free when tested through an ad blocker has not necessarily proven that it honors Global Privacy Control.
Test the signal.
Then test the website’s response to it.
Captain Compliance continuously scans websites to identify cookies, trackers and privacy technologies and can test how a site behaves when Global Privacy Control is enabled. For organizations subject to U.S. privacy laws, the objective is not simply to detect Sec-GPC: 1. It is to make sure the site’s actual data flows respond correctly when that signal arrives.