Global Privacy Control (GPC)

Their browser already said no.
Is your site listening?

Global Privacy Control (GPC) is a browser setting that tells every website a person visits not to sell or share their personal information. It arrives as a Sec-GPC: 1 header and a navigator.globalPrivacyControl flag. California has required the businesses its privacy law covers to honor it since 14 August 2020, 11 more states require it as of 17 October 2026, and from 1 January 2027 every browser in California must offer it. Honoring it means your advertising tags and data sharing stand down for that visitor, without a click, and that you show you did. Below: a live check of your own browser, the states and their dates, the fines so far, and a test for your site. Not legal advice.

Is my browser sending GPC? See the states

By the Builderify team Not legal advice This browser: Not checked yet

Illustration · One setting, one header on every request, and the tags that should stand down.
01 / The signal

What is Global Privacy Control,
and is your browser sending it?

GPC is a single yes-or-no preference, “don’t sell or share my personal information”, that the browser sends for you. When it’s on, every request carries the header Sec-GPC: 1, and the page’s scripts can read navigator.globalPrivacyControl as true. Your server sees the first, your tags the second. A site can also publish /.well-known/gpc.json to say it supports the signal. The specification is an editor’s draft in the W3C’s Privacy Working Group.

The GPC project lists Brave and DuckDuckGo as sending it by default and Firefox as offering it in its settings, with extensions such as Privacy Badger and OptMeowt for other browsers. That list is about to grow. California’s Opt Me Out Act (AB 566, signed on 8 October 2025) says that from 1 January 2027 a business may not develop or maintain a browser without a setting, easy for a reasonable person to find and configure, that sends an opt-out preference signal (Civil Code section 1798.136).

What the signal means depends on the law. In California it is a valid request to opt out of the sale and sharing of personal information, which is why the regulations call it an opt-out preference signal; other states say universal opt-out mechanism. In the EU it changes less: there, advertising cookies need a yes before they run anyway, and the Consent Mode guide covers that side.

Is your browser sending GPC? Live

Not checked yet

This check runs in your browser once the page has loaded, and sends nothing anywhere. With JavaScript off, nothing is read.

navigator.globalPrivacyControl
not read
Sec-GPC header
Can’t be read from here. A page’s scripts never see the headers of the request that loaded it. Your server logs can, and the GPC project’s reference page shows what yours sent.
After changing the setting
The flag is fixed when the page loads. to read it again.

This reads one property of your own browser, in your browser. Nothing is stored or sent.

02 / The states

Which states require you to honor GPC?
The opt-out preference signal, dated.

Each state below requires the businesses its privacy law covers to honor a universal opt-out signal, GPC being the one in wide use. The date is when that duty starts, which is not always when the law took effect. Move the line to see who required it when.

States requiring it
12
As of 17 Oct 2026
US states that require businesses to honor a universal opt-out signal such as Global Privacy Control, the date each requirement starts, what the signal opts out of, and the source
State Honor signals from Law What the signal opts out of Source
California In force CCPA regulations, 11 CCR § 7025 (first § 999.315(c)) The sale and sharing of personal informationThe duty came with the first regulations, approved on 14 August 2020. From 1 January 2027 browsers must offer the signal too (Civil Code 1798.136). CCPA regulations ↗
Colorado In force Colorado Privacy Act, C.R.S. 6-1-1306(1)(a)(IV) Targeted advertising and the sale of personal dataThe law took effect a year earlier. The Attorney General names GPC as the only mechanism it recognises so far. Colorado AG ↗
Connecticut In force Connecticut Data Privacy Act, Conn. Gen. Stat. 42-520(e) Targeted advertising and the sale of personal dataA 2025 amendment (Public Act 25-113, from 1 July 2026) keeps the duty. Statute ↗
Montana In force Montana Consumer Data Privacy Act, MCA 30-14-2809(3)(b) Targeted advertising and the sale of personal data Statute ↗
Nebraska In force Nebraska Data Privacy Act, Neb. Rev. Stat. 87-1111 Targeted advertising and the sale of personal dataWorded like Texas: an authorized agent using a browser setting or extension, with exceptions. Statute ↗
New Hampshire In force RSA 507-H:6, V Targeted advertising and the sale of personal data Statute ↗
Texas In force Texas Data Privacy and Security Act, Bus. & Com. Code 541.055(e) Targeted advertising and the sale of personal dataThe rest of the law took effect on 1 July 2024. Worded as an authorized agent using a browser setting or extension, with exceptions. Statute ↗
New Jersey In force N.J.S.A. 56:8-166.11 (P.L.2023, c.266) Targeted advertising and the sale of personal dataSix months after the law took effect on 15 January 2025, so around 15 July 2025. The statute gives no calendar date. Session law ↗
Minnesota In force Minnesota Consumer Data Privacy Act, Minn. Stat. 325M.14 Targeted advertising and the sale of personal dataHonoring signals that other states have approved counts as compliance. Statute ↗
Maryland In force Maryland Online Data Privacy Act, Com. Law 14-4607(f) Targeted advertising and the sale of personal dataWorded as one of two ways to meet the opt-out duty (a controller “may utilize” a link or the signal). Treat it as required and confirm with your lawyer. Chapter 455 (2024) ↗
Delaware In force Delaware Personal Data Privacy Act, 6 Del. C. 12D-106(e) Targeted advertising and the sale of personal data Statute ↗
Oregon In force Oregon Consumer Privacy Act, ORS 646A.578(5) The sale of personal data and targeted advertisingThe rest of the law took effect on 1 July 2024. Statute ↗
Does it apply to you?

Only if the state’s law covers your business. California’s applies to for-profit businesses that do business in the state and meet one of three tests: annual gross revenue over $26,625,000 (the 2025 figure, adjusted for inflation from $25 million), buying, selling or sharing the personal information of 100,000 or more consumers or households a year, or earning half their revenue from selling or sharing it. The other states set their own thresholds, mostly by how many of their residents’ data you process; Texas and Nebraska cover any business that isn’t a small business by the SBA’s definition. A small shop may be under all of them; the signal costs little to honor anyway.

Not in the table

Privacy laws with an opt-out but no duty to honor a signal, as we read them: Virginia, Iowa, Tennessee, Kentucky and Rhode Island, and the new laws in Oklahoma and Alabama, which start in 2027. We found none in Utah’s or Indiana’s either, but couldn’t read every amendment. Laws change every session: check your state’s own code before you rely on a row, and ask a lawyer about yours.

03 / Fines

Has anyone been fined for ignoring GPC?
Yes, and the first case was about it.

The Attorney General’s first settlement under California’s privacy law, in 2022, was over a retailer that ignored GPC. Every case below is one whose official announcement names the signal. California’s privacy agency can fine up to $2,663 per violation, or $7,988 per intentional one (the 2025 figures), and fines are counted per violation.

  1. California AG

    Sephora

    $1.2M

    The Attorney General’s first settlement under California’s privacy law. After a sweep of online retailers, the Attorney General alleged that Sephora didn’t disclose that it sold personal information, didn’t process opt-outs sent through user-enabled global privacy controls, and didn’t cure within the 30 days the law then allowed.

    GPC: Sephora had to honor GPC and report to the Attorney General on its efforts. The same day, other businesses were sent notices over GPC.

    AG press release ↗
  2. California AG

    Healthline Media

    $1.55M

    The health website kept sharing data with some advertising partners after readers opted out, sent article titles that could reveal a diagnosis, and showed a consent banner that didn’t switch tracking cookies off when a box was unticked.

    GPC: The Attorney General’s release says publishers must honor opt-out requests “including requests submitted through the Global Privacy Control”.

    AG press release ↗
  3. CPPA

    Tractor Supply Company

    $1.35M

    The agency’s largest fine at the time. Among the findings: no privacy notice for job applicants, contracts without the required protections, and no effective way to opt out of selling and sharing.

    GPC: The opt-out failure included “opt-out preference signals such as Global Privacy Control”. It must now scan its websites to inventory its tracking technologies.

    CalPrivacy ↗
  4. California AG

    The Walt Disney Company

    $2.75M

    The largest settlement under California’s privacy law so far. Disney’s opt-outs stopped short: toggles applied to one streaming service and often one device, and its web form left third-party ad tech running.

    GPC: For people who opted out with GPC, Disney limited the request to that device, even when they were logged in to their Disney account.

    AG press release ↗
  5. CPPA

    PlayOn Sports

    $1.10M

    The ticketing platform for school sports allegedly made people click “agree” to advertising trackers before they could use their tickets, and sent them to industry opt-out sites instead of offering its own.

    GPC: It also allegedly “failed to recognize opt-out preference signals”. It must now implement proper opt-out methods.

    CalPrivacy ↗
  6. CPPA

    Ford Motor Company

    $375,703

    Ford made people verify their email address before it would process an opt-out, and didn’t process the ones that weren’t verified. The decision calls that unnecessary friction.

    GPC: Part of the remedy: audit the tracking technologies on its website and ensure it complies with opt-out preference signals, including GPC.

    CalPrivacy ↗
  7. CA, CO and CT

    A joint GPC sweep

    The California Privacy Protection Agency and the Attorneys General of California, Colorado and Connecticut announced an investigative sweep of businesses that may not be processing opt-outs sent through GPC.

    GPC: Businesses found ignoring the signal were contacted and asked to comply. It followed the three states’ Data Privacy Day education on GPC earlier that year.

    CalPrivacy ↗
The lesson regulators keep repeating

“Using a consent management platform doesn’t get you off the hook for compliance.”

Michael Macko, CPPA head of enforcement, 6 May 2025

He said it about Todd Snyder, a clothing retailer fined $345,178 after its privacy portal was misconfigured and failed to process opt-out requests for 40 days. A banner or a consent tool is only as good as its setup: whoever runs the website answers for what the tags actually do.

That’s why section 05 is a test you run yourself, with the signal on and off. It’s also why this page isn’t legal advice: take the table and the rules to a lawyer who knows your business.

04 / Honoring it

How do you honor a GPC signal?
California spells it out.

California’s regulations have the most detailed rules for the signal, in section 7025. The other states’ laws are shorter, but they ask for the same core thing: treat the signal as the person’s opt-out, without making them do anything else. Here are California’s rules, in plain words.

“Sale” and “sharing” are wide. Sharing includes giving data to third parties for cross-context behavioural advertising, which is what most ad pixels do. That’s why the practical answer for a website starts with its advertising tags.

What a browser signal can reach

  • Tags in the page. Pixels and ad tags that run in the visitor’s browser: the Meta Pixel, TikTok, Google Ads, LinkedIn and the rest. A consent tool can hold these back the moment it reads the signal.
  • Google’s own tags. Through Consent Mode: ad_storage, ad_user_data and ad_personalization set to denied tell Google’s tags not to use the visit for advertising.

What it can’t, on its own

  • Sharing from your server. Meta’s Conversions API, TikTok’s Events API, offline conversion uploads and customer lists for ad audiences leave from your servers, not the browser. They are still selling or sharing, and they need their own off switch.
  • Accounts and offline sales. A browser setting can’t tell you which customer record it belongs to unless they are logged in. Data you sell or share offline needs its own opt-out route.
  • Requests to know, delete or correct. GPC only says “don’t sell or share”. Access, deletion and correction requests still come through your own forms and email.
  • Consent in Europe. GPC isn’t a cookie consent. In the EU, the UK and similar regimes, advertising cookies need a yes first, whatever the browser sends.
  1. 01

    Treat it as an opt-out

    § 7025(c)(1)

    A signal is a valid request to opt out of selling and sharing, for that browser or device and any profile you link to it, pseudonymous ones included.

  2. 02

    Apply it to the person, when you know them

    § 7025(c)(1), (c)(7)(B)

    If the visitor is logged in, or you otherwise know who they are, the opt-out covers them, not only this browser. Disney’s settlement was largely about this.

  3. 03

    Ask for nothing more

    § 7025(c)(2)

    You can’t require extra information to process it. You may offer an optional form, for instance to reach offline sales, but the opt-out stands if they ignore it.

  4. 04

    Show that you did

    § 7025(c)(6)

    You must display whether you processed the signal. The regulations give “Opt-Out Request Honored” as an example, with a toggle showing the visitor is opted out.

  5. 05

    The signal beats your own settings

    § 7025(c)(3)

    If it conflicts with a setting that allows selling, process the signal. You may tell the visitor and offer them the chance to consent, under the rules for consent in section 7004.

  6. 06

    Silence isn’t a yes

    § 7025(c)(5)

    A known visitor who sent the signal once hasn’t opted back in because a later visit, from another device, doesn’t carry it.

  7. 07

    Links, or frictionless

    § 7025(e)–(g)

    Either keep the “Do Not Sell or Share My Personal Information” link and honor the signal, or honor it with no pop-up or change in experience and drop the link. Honoring the signal is required either way.

From the CCPA regulations as published by the California Privacy Protection Agency, in the version effective 1 January 2026. Section 7025 has worked examples, worth reading in full.

05 / Test your site

Does your site honor the GPC signal?
Test it in ten minutes.

Regulators test the way a visitor would: a browser with GPC on, a page with your ads, and a look at what loads. Do the same before they do. The snippet runs in your own browser’s console, on your own site, and reports what it sees.

  1. 1

    Turn the signal on

    Use Brave or DuckDuckGo, where GPC is on by default, Firefox with its GPC setting on, or add Privacy Badger or OptMeowt to the browser you use. Then check it in section 01.

    You should seeThe detector says “Yes, GPC is on”.

  2. 2

    Start with a clean slate

    Open a private window. A choice your site remembered from an earlier visit wins over the signal, so test without one.

    You should seeYour cookie banner appears, if your site shows one to visitors from your state.

  3. 3

    Open the page your ads measure

    Usually a product page or the checkout’s thank-you page. Open DevTools (F12, or Cmd+Option+I on a Mac) and leave the banner alone: the signal has to work without a click.

    You should seeNothing yet. Leave the banner unanswered.

  4. 4

    Paste the snippet into the Console

    It lists the advertising scripts that loaded, the advertising cookies that were set, and what Google’s Consent Mode and Builderify last said.

    You should see0 scripts and “-” for cookies on every advertising row. Google Consent Mode’s last call with ad_storage, ad_user_data and ad_personalization denied. With Builderify, a line with “GPC honored: true” and marketing false.

  5. 5

    Find the status

    California’s regulations want the visitor to see that the signal was honored. Look where you show it, such as your privacy choices page or the banner’s preferences panel.

    You should seeA line that the opt-out was honored, and the advertising switch shown off.

  6. 6

    Repeat with the signal off

    New private window, GPC off, same page, same snippet. This proves it was the signal that held the tags back, not a broken tag.

    You should seeUnder an opt-out setup, the advertising scripts now load.

  7. 7

    Check what the browser can’t see

    List what leaves your servers: conversions APIs, CRM syncs, customer list uploads, and anything tied to a logged-in account. Each needs its own way to honor the opt-out.

    You should seeA written answer for each, before a regulator asks.

Console · step 4 
(() => {
  const g = navigator.globalPrivacyControl;
  console.log('GPC in this browser:', g === true ? 'ON' : g === false ? 'off' : 'not supported');
  const loaded = performance.getEntriesByType('resource').map((e) => e.name);
  const jar = document.cookie.split(';').map((c) => c.trim().split('=')[0]);
  const tags = [
    ['Meta Pixel', ['connect.facebook.net'], ['_fbp', '_fbc']],
    ['TikTok Pixel', ['analytics.tiktok.com'], ['_ttp', 'ttcsid']],
    ['Google Ads', ['googletagmanager.com/gtag/js?id=AW-'], ['_gcl_']],
    ['LinkedIn Insight Tag', ['snap.licdn.com'], ['li_fat_id']],
    ['Microsoft Advertising', ['bat.bing.com'], ['_uetsid', '_uetvid']],
    ['Pinterest Tag', ['s.pinimg.com/ct/'], ['_pin_unauth', '_epik']],
    ['Snap Pixel', ['sc-static.net/scevent'], ['_scid']],
    ['X Pixel', ['static.ads-twitter.com'], []],
    ['Reddit Pixel', ['redditstatic.com/ads/'], ['_rdt_uuid', '_rdt_cid']],
  ];
  console.table(tags.map(([tag, hosts, names]) => ({
    tag,
    scripts: loaded.filter((u) => hosts.some((h) => u.includes(h))).length,
    cookies: jar.filter((c) => names.some((n) => c.startsWith(n))).join(' ') || '-',
  })));
  const consent = (window.dataLayer || []).filter((e) => e && e[0] === 'consent').pop();
  if (consent) console.log('Google Consent Mode, last call:', consent[1], JSON.stringify(consent[2]));
  if (window.bdfConsent) {
    const s = window.bdfConsent.get();
    console.log('Builderify:', s.regime, '| GPC honored:', s.gpc, '| answered:', s.decided, '|', JSON.stringify(s.granted));
  }
})();
Reading the result
  • scripts 0, cookies “-” on every advertising row: the tags stood down.
  • A number above 0: that tag’s script loaded on a GPC visit. Find where it’s installed, often pasted into the theme or added by a plugin or app, and put it behind your consent tool.
  • Google Ads with Consent Mode may load with ad_storage denied, by design. Check the Consent Mode line rather than the count.
  • Tags loaded through Google Tag Manager show up only by their own script address; the snippet doesn’t open your container. A cookie set by an ad platform’s own domain can’t be seen from your page.
06 / With Builderify

Honor the GPC signal with Builderify,
and see exactly what it does.

Builderify Cookie Consent reads the signal in the visitor’s browser and honors it by default. Set the banner up the way you would, and this simulator, written from the banner’s own code, shows what a visitor gets.

How consent is asked
The visitor’s browser is set to

Regional mode decides from the browser’s time zone, not the IP address: opt-in for European and other consent-first zones, opt-out elsewhere.

Then the visitor clicks
Hasn't answered Accept all Do not sell or share
This visitor gets · Opt-out Advertising held

Advertising off, no click needed

The signal switched Marketing off before the visitor touched the banner. Advertising tags stay held and Google hears "denied". Analytics keeps running.

Categories
Necessary Preferences Analytics Marketing
Google Consent Mode
  • ad_storagedenied
  • ad_user_datadenied
  • ad_personalizationdenied
  • analytics_storagegranted
Consent log

Nothing yet. The log records decisions, not visits.

Each record also keeps the consent ID, banner version, page, country, a truncated IP and the browser.

Connected tags that load
Google Analytics 4 Microsoft Clarity Hotjar
Held back
Google Ads Meta Pixel TikTok Pixel LinkedIn Insight Tag Microsoft Advertising Pinterest Tag Snap Pixel X Pixel Reddit Pixel
  • BannerThe banner is showing. The Cookie settings button stays on the page afterwards.
  • Status shownThe preferences panel tells the visitor: "Your browser sent a Global Privacy Control signal, so sharing for advertising is switched off."
  • On ShopifyNot told yet: Builderify passes only a real choice to Shopify's Customer Privacy API.

Tags in their default categories, with all three categories offered. You can move a connected tag to another category.

What it does

  • “Honour Global Privacy Control” is on by default, under Visitor choices in the cookie banner’s settings
  • Under opt-out (and for visitors the regional mode treats as opt-out), a GPC browser starts with Marketing off: tags you connect by ID in that category don’t load, scripts you mark data-bdf-consent="marketing" stay blocked, and Google’s Consent Mode gets ad_storage, ad_user_data and ad_personalization as denied
  • The preferences panel tells the visitor the signal was honored, and shows Marketing switched off
  • Every decision in the consent log carries a GPC flag, in the dashboard and the CSV export, and the log’s summary counts the decisions made with GPC on. Records are kept 24 months, with the IP address truncated
  • The opt-out banner’s button reads “Do not sell or share my personal information”, and you can add a “Your Privacy Choices” link pointing to your own page

Know this first

  • GPC switches off Marketing only. Analytics and Preferences keep running, and so do Builderify’s Journey and A/B tests, which wait for Analytics. If your analytics tags sell or share data, move them to Marketing
  • The banner still appears to a GPC visitor, so it isn’t the “frictionless” route: keep a “Do Not Sell or Share” link. And if that visitor clicks “Accept all”, their click wins
  • A GPC visitor who never answers isn’t in the log: it records decisions, not visits. With the switch off, decisions are logged without a GPC flag
  • Tags pasted into your theme run unless you connect them by ID or mark them up. Nothing server-side is touched, and Shopify hears only an explicit choice
  • A choice is kept per browser. Applying an opt-out to a logged-in customer’s account, and handling requests to know or delete, stays with you
  • If your credits run out, the widget pauses until you top up, but the cookie banner keeps running, signal and all
  • It helps you honor the signal; it isn’t legal advice or a compliance guarantee

Installing it

On WordPress, the Builderify plugin does it: paste your site key under Settings › Builderify and tick “Load the cookie consent tag first in <head>”, so the consent tag runs before other plugins’ tags. On Shopify, Squarespace, Wix and Webflow, paste one script tag at the top of the site’s head and the Builderify snippet you may already have. Then connect your tags by ID in the banner’s settings, or mark the ones you paste with type="text/plain" data-bdf-consent="marketing". The guide to Meta Pixel cookie consent walks through a pixel.

What it costs

The consent tag, the decisions and the consent log cost no credits. The banner comes with the Builderify widget, whose page loads are 10 credits per 1,000: the 250 free credits every account gets each month cover about 25,000 page loads. After that, packs start at $9, one-time, and don’t expire. Comparing banners? Read the CookieYes free plan limits and the Cookiebot free plan guides.

Questions

Global Privacy Control, before you ask.

A browser setting that tells every website you visit not to sell or share your personal information. When it is on, the browser sends a Sec-GPC: 1 header with each request and sets navigator.globalPrivacyControl to true. Brave and DuckDuckGo send it by default, Firefox has a setting for it, and extensions such as Privacy Badger add it to other browsers.

As of 17 October 2026, twelve: California since 14 August 2020; Colorado since 1 July 2024; Connecticut, Montana, Nebraska, New Hampshire and Texas since 1 January 2025; New Jersey from about 15 July 2025; Minnesota since 31 July 2025; Maryland since 1 October 2025; and Delaware and Oregon since 1 January 2026. Each law applies only to the businesses it covers, so check your state's thresholds. This is not legal advice.

Signed on 8 October 2025, it adds section 1798.136 to California's Civil Code. From 1 January 2027, a business may not develop or maintain a web browser without a setting that sends an opt-out preference signal, and the setting must be easy for a reasonable person to find and configure. It is aimed at browser makers, but it means more of your visitors will send the signal.

Yes. California's Attorney General settled with Sephora for $1.2 million in August 2022, partly for ignoring GPC, and with Disney for $2.75 million in February 2026, after it applied GPC opt-outs only to one device. The California Privacy Protection Agency fined Tractor Supply $1.35 million in September 2025 and PlayOn Sports $1.10 million in March 2026, in both cases partly over opt-out preference signals.

Not necessarily. In California the signal is an opt-out of selling and sharing personal information, and sharing means cross-context behavioural advertising, which is mainly what ad pixels do. Builderify maps the signal to its Marketing category only, so analytics keeps running. If your analytics setup sells or shares data, for advertising for example, treat it as marketing too.

Sources

Read on 17 October 2026. Pages on oag.ca.gov and on several state legislatures’ sites, which wouldn’t load from here, were read in the Wayback Machine’s 2026 copies.

← All guides Google Consent Mode v2

Stop losing the visitors
you already paid for.

More leads from the traffic you already have, and follow-up that sends itself. Free to start. No card, no monthly fee.

Start free See what it does