Global Privacy Control (GPC)

Last checked: 28 Sep 2026; links rechecked 12 Oct 2026

Global Privacy Control (GPC) is a setting in your browser that sends every website a signal asking it not to sell or share your personal data. It's a W3C draft standard. Whether a site has to act on it depends on where you are: some US states require it; in the UK and EU it has no specific legal status yet.

Which browsers send it

Browser	GPC	How to turn it on
Brave	On by default (desktop and Android)	Nothing to do. On iOS, Brave exposes the signal to websites' scripts but doesn't send the header.
DuckDuckGo browser and extension	On by default	Nothing to do. DuckDuckGo may turn it off on sites where it breaks things.
Tor Browser and Mullvad Browser	On by default	Nothing to do.
Firefox (desktop)	On in private windows; off in normal windows	Settings → Privacy and security → Additional protections → tick "Tell websites not to sell or share my data" (Firefox 120 and later).
Firefox (Android)	Off by default	In Enhanced Tracking Protection settings, turn on "Tell web sites not to share & sell data" (Firefox 122 and later).
Chrome, Edge, Opera, Safari	No built-in setting	Add an extension that sends GPC (below).

Extensions that send GPC

Privacy Badger (EFF): sends GPC and Do Not Track by default. Available for Chrome, Firefox, Edge, Opera and Brave.
DuckDuckGo browser extension: sends GPC by default in Chrome, Edge, Opera and Firefox.
NAI GPC extension for Chrome, from the Network Advertising Initiative: off until you switch it on.

Does the law require sites to honour it?

United States

California: businesses that sell or share personal information must process opt-out preference signals, and the Attorney General says GPC must be honoured as a valid request. From 1 January 2027, the Opt Me Out Act (AB 566) requires browsers to include a setting consumers can switch on to send an opt-out signal.
Colorado: since 1 July 2024, businesses in scope must let consumers opt out of sale and targeted advertising using GPC, the only universal opt-out mechanism the Attorney General recognises.
Connecticut (since 1 January 2025) and Oregon (since 1 January 2026): businesses must honour opt-out signals such as GPC.
California's privacy agency says it's one of about a dozen states that require businesses to honour such signals. Each covers residents of that state, and the W3C draft notes that many states don't accept signals that are switched on by default.

United Kingdom

There's no official regulator position on GPC. The UK GDPR says you can exercise your right to object "by automated means using technical specifications", so a signal like GPC may count as an objection in principle, but no regulator or court has said so. The regulator's April 2026 cookie guidance says websites must not rely solely on browser settings as consent. For your UK rights, see the right to object.

European Union

The GDPR has the same "automated means" wording. A European Commission proposal (the Digital Omnibus) would require websites to accept machine-readable choices and large browser makers to support them, but on 28 September 2026 it was still awaiting a committee decision in the European Parliament.

Companies that say they honour it

Some companies state it in their own privacy notices; for example, Microsoft says it receives and responds to the GPC signal. A site can see the signal as a Sec-GPC: 1 header or the navigator.globalPrivacyControl property.

What about Do Not Track?

Do Not Track was an earlier browser signal; Mozilla says many sites don't respect it. Safari removed it in 2019 (Safari 12.1), and Firefox removed the setting in Firefox 135, pointing users to GPC instead.

Sources

This page describes your options and how organisations say they handle requests. It isn't legal advice. See About & sourcing to report a correction.