Global Privacy Control: the browser setting that says no for you

What does the signal actually do?

It adds one line to every request your browser sends. A site that looks for it sees Sec-GPC: 1 and knows that this visitor objects to the sale or sharing of their personal information. You set it once. It then applies to every site you visit, instead of you hunting for a "Do Not Sell My Personal Information" link on each one.

That is the whole mechanism. Global Privacy Control is a statement of preference, not a blocker. It does not stop a single script from loading. An older idea called Do Not Track worked the same way and died because nothing obliged anyone to read it. The difference this time is that several US legislatures wrote the obligation into law before the signal shipped widely.

The specification came out of research rather than industry. It was published in 2020 by Sebastian Zimmeck at Wesleyan University and Ashkan Soltani, a former chief technologist at the Federal Trade Commission, together with the Electronic Frontier Foundation and others. In November 2024 it became an official work item of the W3C Privacy Working Group, which is the body that standardises this sort of thing for the web.

Which laws make websites honour it?

Twelve US state privacy laws now require businesses to recognise an opt-out preference signal, and California, Colorado and Connecticut have each confirmed that Global Privacy Control is one. California got there first in practice. In August 2022 the state's Attorney General settled with Sephora for 1.2 million dollars, and the announcement put the point bluntly: businesses must treat opt-out requests made by user-enabled global privacy controls the same as requests from users who clicked the opt-out link.

Table scrolls sideways.

Colorado did something the others had not. Its Attorney General keeps a public list of universal opt-out mechanisms that businesses are required to accept, and after a consultation in December 2023 exactly one tool went on it: Global Privacy Control. Enforcement began on 1 July 2024.

Enforcement is no longer theoretical. On 9 September 2025 the California Privacy Protection Agency announced a joint investigative sweep with the Attorneys General of California, Colorado and Connecticut, looking for businesses that fail to process the signal. Three weeks later the agency settled with Tractor Supply Company for 1.35 million dollars, its largest penalty so far. One of the listed failures was not giving consumers an effective way to opt out of the selling and sharing of their information, including through opt-out preference signals such as Global Privacy Control.

At its meeting on 6 and 7 August 2026 the Californian agency voted unanimously to begin formal rulemaking on opt-out preference signals. The draft would name Global Privacy Control in the regulations and state that privacy controls have to be processed before personal information is sold, shared or disclosed. A deputy attorney general set out the same expectation in plainer terms at that meeting: opt-out rights belong to consumers, not merely to individual browsers or devices.

Where do you switch it on?

In three browsers it is either already on or one tick away. In the three most used ones it is not there at all yet.

• Firefox. Open Settings, choose Privacy and Security, scroll to Additional protections and tick "Tell websites not to sell or share my data". On Android the path is Settings, Privacy and Security, Enhanced Tracking Protection, then "Tell websites not to share & sell data". Firefox leaves it off in ordinary windows and switches it on by itself in private ones.
• Brave. On by default on desktop and Android. Nothing to do.
• DuckDuckGo. The browser sends the signal, as does the company's extension for other browsers.
• Chrome, Safari and Edge. No built-in setting. The Global Privacy Control project lists free extensions that send it, including Privacy Badger from the Electronic Frontier Foundation, OptMeowt from the privacy-tech-lab at Wesleyan, and Disconnect.

That gap closes on 1 January 2027. California's Opt Me Out Act, signed in October 2025, is short and unusually direct: a business shall not develop or maintain a browser that does not include functionality configurable by a consumer that enables the browser to send an opt-out preference signal. Browser makers that comply are protected from liability when a website then ignores what they send. The law does not carve out mobile, and the Californian agency's own explainer says the requirement covers browsers on desktop and mobile alike.

To check whether your browser is sending it, open globalprivacycontrol.org, which reports back what it received from you. The setting is per browser and per device, so a laptop and a phone are two separate jobs of about a minute each.

How can you tell whether a site took notice?

In California you are now supposed to be able to see it. The updated state regulations that took effect on 1 January 2026 turned an optional courtesy into a duty: a business has to give you a way to confirm that your opt-out, including one sent as a signal, has been processed. In practice that is the small "Opt-Out Preference Signal Honored" line that has started appearing on some sites in place of a consent banner.

Away from that, the honest answer is that you often cannot tell, and the measurements are not flattering. A study presented at the USENIX Security Symposium in August 2025 crawled 11,708 sites repeatedly and checked four machine-readable records of opt-out status. Only about a third of the sites that showed evidence of selling or sharing personal information used any of them. Among those that did, 44 per cent recorded the opt-out consistently in December 2023 and 45 per cent in April 2024. More than half of the sites that were paying some attention were still inconsistent about it.

A site can also declare its intentions in advance by publishing a small file at /.well-known/gpc.json saying it honours the signal. That declaration is voluntary and unverified. It tells you what the operator claims, not what the advertising code on the page does.

Does it mean anything in the UK or the EU?

Legally, no. No UK or EU rule obliges a website to read the header. The rights that matter here are withdrawing consent and objecting to processing, and the signal can be understood as a general request to exercise them, but nothing turns a site's silence into a breach. The enforceable obligations all sit in US state law.

That nearly changed. When the European Commission published its Digital Omnibus proposal on 19 November 2025, it included a new Article 88b that would have made machine-readable consent signals binding on the organisations receiving them, with controllers given two years to comply. Set your preference once in the browser and the pop-ups would have had to respect it. On 18 June 2026 the member states struck Article 88b from the Council's negotiating position, with Germany, France and Poland among those pushing for its removal after lobbying by the advertising industry. The European Parliament has not yet taken its position, so the idea is dormant rather than dead. Max Schrems of the campaign group noyb summed up what survives: cookie banners are not an invention of data protection, but of the tracking industry.

Switching the setting on outside the United States still costs nothing and does no harm. Some sites act on it everywhere. You just have no way to insist.

What does the signal not cover?

It covers the sale and sharing of your data for advertising, and that is all. It is not a tracking blocker, an ad blocker or a delete button. The page still loads whatever it was going to load. The company can carry on using what it collects about you for its own purposes. Anything sold or shared before you switched the setting on stays sold.

Three further limits are worth knowing. The signal travels with the browser, so every browser and every device needs its own setting. It only exists on the web, so apps, smart TVs and games consoles are untouched and have separate controls. And outside the twelve states, whether it is obeyed depends entirely on the goodwill of whoever runs the site.

Even with all that shaved off, it is one tick that applies to every site you will ever visit in that browser, and in a growing part of the United States it is legally binding. This piece explains the rules as they stand and is not legal advice.

Sources

1. Global Privacy Control, the specification's own site, on scope, supported browsers and W3C status, retrieved 5 September 2026
2. Global Privacy Control, Wikipedia, on origin, authorship and state recognition, retrieved 5 September 2026
3. Attorney General Bonta announces settlement with Sephora, California Attorney General, 24 August 2022
4. Colorado's approval of Global Privacy Control, Future of Privacy Forum, on the first approved universal opt-out mechanism
5. Joint investigative sweep on opt-out preference signals, California Privacy Protection Agency, 9 September 2025
6. Settlement with Tractor Supply Company, California Privacy Protection Agency, 30 September 2025
7. Global Privacy Control in 2026, Didomi, 4 December 2025, for the list of twelve states
8. Global privacy controls: preparing for the next wave of enforcement, Foster Garvey, 16 December 2025, for the individual state dates
9. States crack down on opt-out preference signal compliance, Freshfields, on the confirmation duty in the amended Californian regulations
10. New CCPA rules require businesses to prove compliance, Nelson Mullins, on section 7025 from 1 January 2026
11. California privacy regulators signal increased scrutiny of opt-out preference signals, Alston & Bird, 14 August 2026, on the board meeting of 6 and 7 August 2026
12. Assembly Bill 566, the Opt Me Out Act, California Legislative Information, operative 1 January 2027
13. California governor signs new law requiring in-browser opt-out preference signal, IAPP, October 2025
14. California's Opt Me Out Act: your privacy just got easier, California Privacy Protection Agency, 15 January 2026
15. Global Privacy Control, Mozilla Support, for the Firefox settings paths
16. Websites' Global Privacy Control compliance at scale and over time, Hausladen and others, USENIX Security Symposium, August 2025
17. EU member states suddenly want to keep cookie banners, noyb, 23 June 2026