What is Global Privacy Control, and do I have to honor it?

Global Privacy Control is a browser signal that tells websites the visitor wants to opt out of the sale or sharing of their personal data. California's CCPA, as enforced by the state, requires covered businesses to honor it, and several other US states now do too. Browsers like Firefox, Brave, and DuckDuckGo send it automatically.

How the signal works

When enabled, the browser sends a GPC header or sets a JavaScript property on every site it visits. The site reads that signal and must treat it as a valid opt-out request, without requiring the visitor to find and click an opt-out link.

Where it is legally required

California's enforcement actions, including its settlement with Sephora, established that honoring GPC is a real obligation under the CCPA. Colorado, Connecticut, and other states with privacy laws have similar universal opt-out signal requirements. The list of states grows as more laws take effect.

What your consent setup should do

A compliant consent tool detects the GPC signal, automatically opts the visitor out of non-essential cookies and data sharing, and shows that the choice was honored. If your banner ignores the signal entirely, that is a known enforcement target in California.