Global Privacy Control: The Opt-Out Signal Your Banner Has to Honor

A shopper in California turns on Global Privacy Control in their browser and visits your store. No banner appears, no toggle is flipped, no form is filled in. The browser has already told your site, in a header and a JavaScript property, that this person opts out of the sale and sharing of their personal information. If your site ignores that signal and keeps sharing data with ad networks, the banner on the homepage is irrelevant. The violation already happened, silently, on every page load.

What GPC is

Global Privacy Control is an opt-out preference signal, sent by the browser as the Sec-GPC: 1 HTTP header and set as the navigator.globalPrivacyControl JavaScript property. It is the browser telling every site the person visits that they opt out of the sale or sharing of their personal information, without submitting an individual request on each site. The California Consumer Privacy Act, as amended by the CPRA, requires businesses to honor opt-out preference signals, and the CPPA regulations name GPC explicitly as a signal that meets the standard. The signal must be honored frictionlessly: no identity verification, no confirmation modal, no extra steps before the choice takes effect.

The scope is wider than California now. As of 2026, at least a dozen states require businesses to honor opt-out preference signals or universal opt-out mechanisms: California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, and Texas. And from January 1, 2027, California's Opt Me Out Act, AB 566, requires browsers to implement opt-out preference signal functionality, which means the signal will get easier to send and harder to ignore.

The 15-business-day rule and the states list

The obligations are specific. A business that receives an opt-out preference signal must stop selling and sharing personal information associated with that browser or device, and any profile, including pseudonymous profiles, associated with it, and the consumer, if known. The business must comply as soon as feasibly possible, and no later than 15 business days after receiving the request. The business must also display whether it has processed the signal, for example by showing Opt-Out Preference Signal Honored on the site, or through a toggle that shows the opt-out state.

When a GPC signal conflicts with a choice the shopper made in the banner, the GPC signal wins. The regulations say so, and the reason is simple: the signal is the person's standing choice, expressed once for every site, and a banner that overrides it with a newer click is a banner that talks the shopper out of their own preference. The business must also disclose whether it honors universal opt-out signals. A privacy policy that says nothing about GPC is a policy that has not been read since the CPRA regulations took effect.

The test: send the signal and watch

Turn on GPC in a test browser, visit the site, and watch the network panel. The ad and analytics requests should stop, or drop to the restricted, cookieless form, and the site should display that the signal was honored. If the requests keep flowing with identifiers attached, the signal is being ignored, and the fix is server-side: the site has to check the Sec-GPC header on every request and suppress sharing before the tags fire, not after the banner loads. A banner-side check is too late, because the banner loads after the tags. For the consent records that prove the choice was honored, see how long to keep consent records and what they must prove, and for the string that carries the choice, reading a TCF consent string by hand.

Frequently asked questions

What is Global Privacy Control, in one sentence?

It is a browser signal, sent as the Sec-GPC header and a JavaScript property, that tells every site the person opts out of the sale or sharing of their personal information.

Which states require businesses to honor GPC?

California requires it under the CCPA and CPRA regulations, and as of 2026 at least a dozen states have similar requirements, including Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, and Texas.

How fast must a business act on a GPC signal?

As soon as feasibly possible, and no later than 15 business days after receiving it. The business must also display whether it has processed the signal, for example by showing Opt-Out Preference Signal Honored.

What wins if GPC conflicts with a banner choice?

GPC wins. The signal is the person's standing choice for every site, and the regulations require businesses to prioritize it over any other user-stated preference, including a newer click in the banner.