If you’ve been online, you’ve probably seen the term GPC and wondered what it means. GPC stands for Global Privacy Control.
Captain Compliance has created a Chrome plugin for Global Privacy Control to confirm if it’s working. Download our privacy software today for free in the Google Chrome store: 
Global Privacy Control (GPC)
Global Privacy Control, or GPC, is a browser- or device-level privacy signal that lets a person automatically tell websites not to sell or share their personal information. When GPC is enabled, a supporting browser or extension can send the Sec-GPC: 1 HTTP header and expose the user’s preference through the navigator.globalPrivacyControl JavaScript property.
For businesses, GPC is no longer an obscure browser setting.
As of 2026, twelve U.S. states require covered businesses or controllers to recognize universal opt-out mechanisms or opt-out preference signals. California regulators have repeatedly enforced failures involving GPC, including cases against Sephora, Healthline, Tractor Supply and Disney. California also changed its regulations in 2026 to require businesses to display whether an opt-out preference signal has been processed.
GPC is also moving further into the web standards infrastructure. The W3C Privacy Working Group published a new Global Privacy Control Working Draft on June 11, 2026. It defines a signal transmitted through HTTP and the DOM for communicating a person’s request not to have personal information sold or shared with third parties. It remains a Working Draft rather than a final W3C Recommendation.
For privacy, legal, marketing and engineering teams, the difficult part is no longer recognizing the letters “GPC.”
The harder question is whether the website actually changes what it does when the signal arrives.
What is Global Privacy Control?
Global Privacy Control is a technical privacy preference signal.
A person enables GPC through a supporting browser, browser setting, extension or other technology. The signal is then communicated automatically to websites the person visits.
The official GPC project describes it as a way for internet users to notify businesses of preferences concerning the sale or sharing of their personal information without submitting a separate request to every website.
Think of it as a machine-readable privacy instruction.
Instead of:
-
Visiting a website.
-
Finding its privacy controls.
-
Opening a preference center.
-
Locating the sale or targeted-advertising opt-out.
-
Submitting the request.
-
Repeating the process on the next website.
A user can enable GPC once and have the browser communicate the preference automatically.
Whether a particular business must honor that preference, and exactly what processing must stop, depends on the law that applies.
What does GPC stand for?
GPC stands for Global Privacy Control.
It is also commonly described as a universal opt-out mechanism, universal opt-out signal, opt-out preference signal or OOPS.
The terminology varies among state laws and regulators, but Global Privacy Control is currently the dominant technical implementation.
Colorado formally recognized GPC as the first Universal Opt-Out Mechanism meeting the standards of the Colorado Privacy Act and its regulations.
California uses the broader term “opt-out preference signal.” Its regulations expressly contemplate signals transmitted through mechanisms such as an HTTP header field or JavaScript object.
How does Global Privacy Control work?
GPC can communicate the preference through two primary technical interfaces.
The Sec-GPC HTTP header
A supporting browser can include this HTTP request header:
Sec-GPC: 1
The value 1 indicates that GPC is enabled.
Because an HTTP header can reach the server as part of the request itself, a server-side system can potentially detect the preference before client-side JavaScript executes.
That matters for organizations using server-side tagging, personalization, advertising infrastructure, APIs or other processing that does not depend entirely on the browser’s JavaScript environment.
The JavaScript GPC property
Supporting browsers can also expose:
navigator.globalPrivacyControl
When GPC is active, the property returns a value indicating that the user has expressed the preference.
MDN describes Navigator.globalPrivacyControl as a read-only property reflecting the user’s Global Privacy Control setting for the current website. The value corresponds with the Sec-GPC HTTP header.
A CMP, tag manager or first-party script can therefore detect GPC in the browser and apply the corresponding privacy state.
What information does GPC send?
GPC is a preference signal. It is not supposed to transmit a dossier about the user.
The essential instruction is that the person does not want their personal information sold or shared with third parties where the relevant legal framework gives effect to that request.
The applicable law determines what that means for a particular business.
What GPC does not mean
Several misconceptions cause bad implementations.
GPC is not automatically a request to reject every cookie.
GPC is not the same as an ad blocker.
GPC is not a request to delete all personal information.
GPC does not necessarily prohibit every form of analytics.
GPC is not a replacement for a CMP.
GPC is not the old Do Not Track signal under another name.
It communicates a privacy preference whose legal effect depends on the relevant jurisdiction and processing activity.
A business therefore needs rules connecting the signal to the actual uses of data that the consumer has a right to stop.
Is Global Privacy Control legally binding?
In a growing number of U.S. states, yes, for covered businesses and processing subject to the relevant laws.
California’s Attorney General describes GPC as a “stop selling or sharing my data switch” and states that covered businesses must honor qualifying GPC signals as valid consumer requests to stop the sale or sharing of personal information.
The requirement is not limited to California anymore.
As of 2026, twelve states have requirements involving universal opt-out mechanisms or opt-out preference signals:
| State | Privacy law / framework | GPC or universal signal requirement |
|---|---|---|
| California | CCPA, as amended by CPRA | Yes |
| Colorado | Colorado Privacy Act | Yes |
| Connecticut | Connecticut Data Privacy Act | Yes |
| Delaware | Delaware Personal Data Privacy Act | Yes |
| Maryland | Maryland Online Data Privacy Act | Yes |
| Minnesota | Minnesota Consumer Data Privacy Act | Yes |
| Montana | Montana Consumer Data Privacy Act | Yes |
| Nebraska | Nebraska Data Privacy Act | Yes |
| New Hampshire | New Hampshire privacy law | Yes |
| New Jersey | New Jersey Data Privacy Act | Yes |
| Oregon | Oregon Consumer Privacy Act | Yes |
| Texas | Texas Data Privacy and Security Act | Yes |
The Maryland Attorney General described opt-out preference signals in June 2026 as technology “already mandated by twelve states.” California’s CPPA likewise describes California as one of a dozen states requiring businesses to honor opt-out preference signals.
The scope is not identical across all twelve laws. Depending on the state, the relevant rights may address sale, targeted advertising, sharing or related processing. Businesses still have to determine which statutes apply to them and how each defines the covered activity.
For a national website, however, treating GPC as an obscure California-only requirement is no longer a viable compliance strategy.
California’s GPC requirements became stricter in 2026
California provides the most developed regulatory framework for opt-out preference signals.
Section 7025 of the CCPA regulations requires a business that sells or shares personal information to process a qualifying opt-out preference signal as a valid request to opt out.
The regulations go further than simply detecting the browser.
When a qualifying signal is received, a business must generally apply the request to the browser or device and to consumer profiles associated with that browser or device. If the business knows the consumer, the regulations can require the signal to be treated as an opt-out request for that consumer as well.
That becomes particularly important for logged-in users.
A consumer could send GPC from a laptop while logged into an account that also exists on a television, phone, tablet or another website operated by the same business.
Treating GPC solely as a temporary browser cookie can therefore be inadequate.
California now requires visible GPC status
An important change took effect with California’s updated regulations on January 1, 2026.
Section 7025(c)(6) states that a business must display whether it has processed the consumer’s opt-out preference signal as a valid request to opt out of sale or sharing on its website.
The regulations give “Opt-Out Request Honored” as one example of how that status could be displayed.
This is worth checking immediately if your California implementation was designed before 2026.
Previously, many businesses treated visible GPC confirmation as an optional usability feature.
It is now part of California’s regulatory requirements.
The absence of GPC is not necessarily consent
Another detail in California’s regulations deserves more attention than it receives.
Where the consumer is known to the business, the business cannot treat the later absence of an opt-out preference signal as consent to resume selling or sharing information after that consumer previously sent one.
Consider this scenario:
A customer logs into an account using Firefox with GPC enabled.
The business recognizes the customer and processes the GPC opt-out.
A month later the same customer logs in from another browser that does not send GPC.
The missing signal on the second browser does not automatically erase the earlier choice.
Privacy architecture that treats every page load as a brand-new consumer can therefore produce incorrect results.
GPC and logged-in users: the Disney enforcement action
California’s February 2026 settlement with Disney provides a concrete example.
The Attorney General alleged that Disney failed to fully apply consumers’ opt-out requests across the devices and services associated with their Disney accounts.
For consumers using GPC, Disney allegedly limited the request to the particular device transmitting the signal even when the consumer was logged into an identifiable account.
Disney agreed to pay $2.75 million in civil penalties. At the time, California described it as the largest CCPA settlement to date.
The technical lesson is straightforward.
If your system knows who the consumer is, GPC may have implications beyond the browser instance where you first detected it.
A mature implementation needs to answer:
-
Is this visitor anonymous or authenticated?
-
Is the browser associated with an existing privacy profile?
-
Should the preference propagate to an account?
-
What other properties, apps or devices use that account?
-
Can server-side systems still sell or share information after the browser has opted out?
-
What happens when the consumer returns through a browser that does not transmit GPC?
Those are identity and data-governance questions, not banner-design questions.
GPC enforcement is already real
The Disney case is part of a much longer enforcement record.
Sephora: $1.2 million
In August 2022, California reached a $1.2 million settlement with Sephora.
Among the Attorney General’s allegations was that Sephora failed to process user requests to opt out of the sale of personal information through Global Privacy Control. The settlement required Sephora to provide mechanisms for consumers to opt out, including GPC.
This was the case that put many privacy teams on notice that GPC was not merely an experimental browser feature.
Healthline: $1.55 million
In July 2025, California announced a $1.55 million settlement with Healthline Media.
The Attorney General alleged that Healthline failed to properly stop sharing consumers’ information for targeted advertising after consumers opted out, including through GPC.
The case is especially useful for privacy engineering teams because the alleged failure was operational. California said one opt-out mechanism was misconfigured and had not been properly tested. Trackers continued transmitting identifying information to advertising companies even after consumers exercised their opt-out rights.
A privacy interface can look correct while the website underneath it continues doing the wrong thing.
Tractor Supply: $1.35 million
In September 2025, the California Privacy Protection Agency announced a $1.35 million resolution with Tractor Supply Company.
Among the violations alleged by the CPPA was failure to provide consumers with an effective mechanism for opting out of selling and sharing, including through opt-out preference signals such as GPC.
The remediation also required scanning the company’s digital properties to inventory tracking technologies.
That last requirement deserves attention.
Regulators are increasingly connecting privacy rights with what actually runs on the website.
California, Colorado and Connecticut launched a coordinated GPC sweep
On September 9, 2025, the California Attorney General, California Privacy Protection Agency and attorneys general of Colorado and Connecticut announced a coordinated investigative sweep focused on businesses that appeared not to be processing opt-out requests transmitted through GPC.
The states sent letters asking companies to come into compliance.
GPC enforcement is therefore no longer confined to one regulator or one state.
How regulators can test whether a website honors GPC
A regulator does not necessarily need access to your CMP dashboard.
The test can begin from the outside.
Enable GPC.
Visit the site.
Inspect what loads.
Watch the network requests.
Compare website behavior with GPC disabled and enabled.
Check which cookies appear.
Observe whether advertising pixels continue transmitting identifiers.
See whether the site displays the required privacy status.
Test again while logged into an account.
That type of testing can expose the gap between a privacy configuration and the actual website.
The Healthline complaint is a strong example. California investigators tested the opt-out mechanisms and alleged that identifying information continued moving to advertising companies after the consumer had opted out.
Detecting GPC is not the same as honoring GPC
This is probably the most important point for businesses.
A website can correctly execute:
navigator.globalPrivacyControl === true
and still fail to honor the consumer’s request.
Detection tells you what the browser said.
Compliance depends on what happens because the browser said it.
Suppose your CMP recognizes GPC and switches a preference to “opted out.”
But Meta Pixel fires before the CMP initializes.
Or Google Tag Manager contains a tag that ignores the CMP’s consent state.
Or a server-side endpoint continues sending advertising identifiers.
Or a newly installed marketing script was never placed behind the relevant consent rule.
Or the visitor logs in and the preference never reaches the account-level privacy profile.
The signal was detected.
The implementation still failed.
Our more technical guide to GPC Signal Handling examines this layer in detail, including the HTTP header, JavaScript property, tag management architecture and server-side processing.
Does GPC block cookies?
Not by itself.
GPC sends a privacy preference. The browser signal itself is not a general-purpose cookie blocker.
Mozilla says this explicitly: GPC is a signal, not a blocker. Firefox has separate tracking-protection functionality for blocking trackers.
When applicable law requires the business to honor GPC, however, the website may need to prevent or restrict cookies, pixels or other technologies involved in covered sale, sharing or targeted advertising.
So the sequence is:
GPC communicates the choice.
The website’s privacy controls enforce the choice.
Those are separate technical functions.
Do ad blockers send the GPC signal?
Some do. Many do not.
Ad blocking and Global Privacy Control should not be treated as interchangeable.
An extension can block advertising domains without sending Sec-GPC: 1.
A browser can send GPC without functioning as an ad blocker.
Privacy Badger, DuckDuckGo, Ghostery and certain AdGuard configurations are examples of privacy technologies that support GPC. Ghostery added GPC signaling in April 2026 and expanded its implementation in July 2026.
For the full current comparison, read Do Ad Blockers Send the GPC Signal? Which Ad Blockers Support Global Privacy Control.
[EDITOR: Internally link the complete sentence above to the new Captain Compliance ad-blocker/GPC article.]
The key rule for website operators is simple: detect the signal, not the product.
Do not try to infer GPC from whether somebody appears to be using an ad blocker, Firefox, Brave or another privacy tool.
Which browsers support Global Privacy Control?
Browser support continues to change.
Brave
Brave supports GPC and enables it by default on supported desktop and Android versions. Brave describes GPC as an additional privacy mechanism rather than a substitute for its browser-level privacy protections.
DuckDuckGo
DuckDuckGo’s browsers and privacy extensions support GPC, with the setting enabled by default.
DuckDuckGo documents both HTTP-header and JavaScript implementations across several platforms, although platform limitations can affect how the signal is transmitted on some mobile systems.
Firefox
Firefox supports GPC through its Privacy & Security settings.
Mozilla says Firefox users can select “Tell websites not to sell or share my data” to enable the signal.
Privacy Badger
The Electronic Frontier Foundation’s Privacy Badger sends GPC by default.
Ghostery
Current versions of Ghostery support GPC.
Ghostery added GPC signaling in April 2026 and full JavaScript API exposure in July 2026.
AdGuard
AdGuard has supported GPC through its privacy and Stealth Mode functionality.
Browser support should be checked periodically rather than copied from an old comparison chart.
And browser support is about to become much more important because of California’s Opt Me Out Act.
California will require browsers to offer opt-out preference signals in 2027
California enacted AB 566, the Opt Me Out Act, in October 2025.
Beginning no later than January 1, 2027, web browsers covered by the law must provide Californians with an easily accessible built-in option for transmitting an opt-out preference signal.
This can materially change GPC adoption.
Today, many consumers have to choose a privacy-oriented browser, install an extension or find a privacy setting before they transmit GPC.
California’s new law moves universal opt-out capability toward the browser itself.
That could produce a substantial increase in the number of visitors arriving at websites with opt-out preference signals enabled.
Businesses waiting for GPC traffic to become “large enough to matter” are solving the wrong problem.
The legal requirement already exists for covered businesses.
The number of users capable of exercising it is likely to grow.
Is Global Privacy Control the same as Do Not Track?
No.
Do Not Track, or DNT, was an earlier browser signal intended to communicate that the user did not want to be tracked.
The critical problem was enforcement.
Most websites had no general legal obligation to honor DNT, and adoption never translated into a dependable universal privacy right.
GPC was designed around legal frameworks in which an opt-out signal can carry statutory consequences.
Mozilla removed the old Do Not Track option from Firefox settings beginning with Firefox 135 and now directs users toward Global Privacy Control.
The distinction can be summarized this way:
| Do Not Track | Global Privacy Control |
|---|---|
| General request not to be tracked | Privacy preference concerning sale/sharing and related rights |
| Historically voluntary | Legally recognized under multiple state privacy laws |
DNT header |
Sec-GPC header and DOM signal |
| Weak enforcement framework | Active regulator enforcement |
| Largely unsuccessful as a universal standard | Expanding through state law and browser requirements |
Is GPC the same as a cookie consent banner?
No.
A consent management platform and GPC address different parts of the privacy workflow.
A CMP can present notices, obtain or record consent, manage categories, control tags, provide preference interfaces and maintain consent evidence.
GPC arrives from the user’s browser or device.
The CMP should be capable of interpreting that signal and applying the correct state.
A useful way to think about the relationship is:
GPC = the user’s machine-readable instruction.
CMP = part of the business’s system for interpreting and enforcing that instruction.
A banner that ignores GPC is a problem.
A CMP that detects GPC but fails to stop the relevant processing is also a problem.
Does GPC override a website’s privacy settings?
Under California’s regulations, a qualifying GPC signal must generally be processed as a valid opt-out request even if it conflicts with an existing business-specific privacy setting allowing sale or sharing.
The business may inform the consumer about the conflict and provide an opportunity to give valid consent, but it cannot simply ignore the signal because an older preference says otherwise.
This creates an important precedence issue for CMP architecture.
Organizations need clear rules for:
-
browser-level GPC;
-
CMP preferences;
-
authenticated account preferences;
-
mobile-app preferences;
-
prior consent;
-
later consent;
-
financial incentive programs;
-
state-specific rights.
Leaving each system to independently decide which preference wins invites inconsistent results.
How should a website implement Global Privacy Control?
A defensible implementation needs more than a JavaScript if statement.
1. Detect the signal
Detect the GPC preference through the appropriate browser and server interfaces.
That can include:
Sec-GPC: 1
and:
navigator.globalPrivacyControl
Do not rely solely on browser-name detection.
2. Determine the applicable privacy state
Map the signal to the rights that apply.
This may depend on:
-
consumer jurisdiction;
-
whether the business falls within the relevant law;
-
sale of personal data;
-
sharing for cross-context behavioral advertising;
-
targeted advertising;
-
exemptions;
-
account status;
-
other privacy choices already associated with the consumer.
3. Apply the preference before affected technologies fire
This is where many implementations break.
If the site waits until after Meta Pixel, TikTok Pixel or another advertising technology has transmitted data, updating the CMP afterward does not undo the disclosure.
Consent and opt-out gating need to occur at the correct point in the page lifecycle.
4. Propagate the preference beyond the CMP
A CMP cannot protect data flows it does not control.
The GPC state may need to reach:
-
Google Tag Manager;
-
client-side tags;
-
server-side tag management;
-
advertising platforms;
-
analytics configurations;
-
CDPs;
-
identity systems;
-
preference centers;
-
backend APIs;
-
customer profiles;
-
marketing systems.
5. Connect the preference to an account when required
California’s rules and the Disney settlement make this particularly important.
When a consumer is known, consider whether the browser-level choice must become an account-level choice rather than remaining attached only to one cookie or device.
6. Retain evidence
Keep records showing:
-
the signal received;
-
when it was received;
-
the privacy state applied;
-
which jurisdictional rule was used;
-
relevant changes to consent state;
-
downstream propagation;
-
subsequent user changes.
A regulator examining the implementation will care more about evidence of actual behavior than a screenshot of a banner.
7. Display the appropriate status
For California, review the 2026 requirement to display whether the GPC opt-out was processed.
8. Test the whole system
Test with GPC enabled and disabled.
Test logged out.
Test logged in.
Test new visitors.
Test returning visitors.
Test after clearing cookies.
Test different regions.
Inspect network requests.
Check cookies.
Check pixels.
Check server-side events.
Then repeat the test after marketing or development teams deploy changes.
Why continuous GPC testing matters
A correct implementation today does not guarantee a correct implementation six months from now.
Websites change constantly.
A marketer installs a new pixel.
An agency publishes a GTM container.
A developer replaces analytics libraries.
A new chatbot loads.
An A/B testing tool appears.
A server-side marketing integration gets added.
A CMP configuration changes.
One newly introduced technology can sit outside the controls that were correctly configured during the original implementation.
That is why Captain Compliance treats GPC as part of continuous website privacy monitoring rather than a one-time configuration exercise.
The relevant test is not:
“Does our CMP support GPC?”
It is:
“What actually happens on our website when a GPC visitor arrives right now?”
How can businesses test Global Privacy Control?
There are several levels of testing.
Basic browser test
Use a browser or extension with GPC enabled and visit a GPC detection service to confirm that the signal is being transmitted.
The official Global Privacy Control website can identify whether GPC is active in the current browser.
JavaScript test
Open the browser developer console and inspect:
navigator.globalPrivacyControl
Network test
Inspect browser network requests for:
Sec-GPC: 1
Compliance test
This is the important part.
Visit your own website with GPC disabled.
Record cookies, pixels, tags and network destinations.
Repeat with GPC enabled.
Compare the results.
The website should not merely detect a different browser state. The actual data flows affected by the user’s opt-out rights should change.
What should be blocked when GPC is enabled?
There is no universal list of cookie names that always must be blocked.
The answer depends on what each technology does.
A privacy team should determine whether a tracker, pixel, API call or other processing causes personal information to be sold, shared or processed for targeted advertising under an applicable law.
Common technologies requiring scrutiny include:
-
advertising pixels;
-
cross-site behavioral advertising technologies;
-
retargeting tools;
-
advertising identifiers;
-
data broker integrations;
-
audience-matching technologies;
-
third-party marketing tags;
-
server-side ad-tech events.
Do not classify technologies purely by vendor name.
One vendor can provide multiple services under different contractual and technical configurations.
Does Global Privacy Control apply outside the United States?
GPC was designed to operate with multiple legal frameworks, and the specification is not inherently limited to the United States.
Its strongest explicit statutory recognition today is in U.S. state privacy law.
European privacy law presents a different architecture because GDPR and ePrivacy requirements often depend on lawful basis and, for many website technologies, prior consent.
GPC should therefore not be treated as a substitute for European consent requirements.
There is active European discussion about browser-level privacy choices. In August 2026, GPC co-founder Sebastian Zimmeck wrote for the IAPP about proposals to allow browser-based privacy choices to play a larger role in the EU’s consent regime, although the legislative process remains unsettled.
What businesses should do about GPC in 2026
If your organization operates websites or apps used by U.S. consumers, GPC belongs in the technical privacy review.
Start with four questions:
Can we detect it?
Do we know what processing must change?
Does that processing actually stop?
Can we prove it?
Then look beyond the banner.
Check the CMP.
Check GTM.
Check server-side tagging.
Check advertising and analytics integrations.
Check user accounts.
Check preference persistence.
Check what happens when a user moves between devices.
Check the privacy policy.
And for businesses subject to California’s requirements, check whether the site now displays that the GPC signal has been processed.
The companies that have already faced enforcement were not accused because they lacked a beautifully written explanation of GPC.
The problem was what their systems did after consumers exercised their rights.
That is where GPC compliance ultimately lives.
Frequently asked questions about Global Privacy Control
What is Global Privacy Control in simple terms?
Global Privacy Control is a browser or device setting that automatically tells websites that the user wants to opt out of covered sale or sharing of their personal information. Several U.S. state privacy laws require covered businesses to honor qualifying signals.
What does GPC stand for?
GPC stands for Global Privacy Control.
What is the GPC signal?
The GPC signal is a machine-readable privacy preference. Supporting browsers can transmit it using the Sec-GPC: 1 HTTP header and expose it through navigator.globalPrivacyControl.
Is GPC legally binding?
It can be. Twelve U.S. states have requirements concerning universal opt-out mechanisms or opt-out preference signals as of 2026. The exact obligation depends on the law, consumer, business and processing involved.
Does California require businesses to honor GPC?
Yes. California requires covered businesses that sell or share personal information to process qualifying opt-out preference signals as valid opt-out requests. California has also brought multiple enforcement actions involving failures to properly honor GPC.
Which states require GPC in 2026?
The twelve-state group consists of California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon and Texas.
Does Chrome have Global Privacy Control?
Users of browsers without native GPC functionality can use supported extensions. California’s Opt Me Out Act will require covered browsers to provide a built-in opt-out preference signal option no later than January 1, 2027.
Does Firefox support GPC?
Yes. Firefox includes a Global Privacy Control setting under its privacy controls.
Does Brave support GPC?
Yes. Brave supports Global Privacy Control and enables it by default on supported platforms.
Does DuckDuckGo support GPC?
Yes. DuckDuckGo’s browsers and privacy extensions support Global Privacy Control, and DuckDuckGo enables GPC by default.
Do ad blockers automatically send GPC?
No. Some privacy and ad-blocking products send GPC while others do not. Ad blocking and GPC are separate functions. See our guide, Do Ad Blockers Send the GPC Signal? Which Ad Blockers Support Global Privacy Control, for the current comparison.
[EDITOR: Link the title above to the new Captain Compliance article.]
Is GPC the same as rejecting cookies?
No. GPC communicates a privacy preference. It does not itself function as a universal cookie blocker. The website must interpret the signal and enforce the rights that apply.
Is GPC the same as Do Not Track?
No. Do Not Track was a largely voluntary tracking preference signal. GPC is designed to communicate privacy rights that can be legally enforceable under applicable privacy laws.
Does GPC replace a cookie consent banner?
No. GPC and consent management perform different functions. A CMP can detect and act on GPC, but GPC does not eliminate other consent or notice requirements that apply to a website.
How do I know whether my website honors GPC?
Test the website with GPC enabled and inspect the resulting cookies, scripts, tags and network requests. A CMP merely reporting that GPC was detected does not prove that the underlying data flows changed.
What happens if a company ignores GPC?
Covered businesses can face regulator investigations, remediation orders and monetary penalties. California enforcement involving GPC or ineffective opt-outs has included settlements or penalties involving Sephora, Healthline, Tractor Supply and Disney.