Skip to main content
DataRidge
Category: Data Subject Rights

Global Privacy Control

Also known as: GPC, GPC signal, Global Privacy Control signal
Simply put

Global Privacy Control (GPC) is a browser or device setting that automatically tells websites a user does not want their personal information sold or shared. Instead of clicking an opt-out link on every site, a person can set this preference once and have it communicated to businesses as they browse. It was created largely in response to consumer privacy rights under California law.

Formal definition

Global Privacy Control (GPC) is a set of web technologies, described in a specification published through the W3C, that transmits a signal from a user agent (such as a browser or extension) to communicate an individual's opt-out preference regarding the sale or sharing of their personal information. Per the California Department of Justice, GPC was developed in response to the CCPA to allow consumers to exercise opt-out rights, and the underlying specification frames the signal as a mechanism for users to invoke legal rights to stop certain sharing or processing of their data. GPC functions as an expression of a preference that a business must interpret and honor under applicable law; it does not by itself determine a lawful basis for processing, and its legal effect depends on the governing regime and jurisdiction. This definition addresses the nature and purpose of the GPC signal only. It does not cover the specific technical wire format, the scope of businesses obligated to honor it, enforcement outcomes, or how GPC is treated outside the CCPA context, all of which vary and are out of scope here.

Why it matters

Global Privacy Control matters because it shifts the mechanics of exercising an opt-out from a per-site, manual action to a single, persistent preference expressed by the user agent. Under the CCPA, as described by the California Department of Justice, GPC was developed to let consumers exercise their rights to stop the sale or sharing of personal information without hunting for an opt-out link on every website they visit. For businesses within the scope of that regime, this changes the compliance question from whether a user clicked a particular control to whether the organization can receive, interpret, and honor an inbound signal at scale.

Who it's relevant to

Privacy and compliance officers
Those responsible for CCPA-scope obligations need to determine whether their organization is required to honor GPC and to document how the signal is received and actioned. Because its legal effect depends on jurisdiction and regime, teams should scope their obligations to the governing law rather than assuming universal treatment, and should maintain demonstrable evidence that opt-out preferences are respected.
Privacy engineers and web developers
Engineers building or maintaining consumer-facing sites are responsible for detecting the inbound GPC signal from user agents and translating it into the appropriate downstream behavior regarding the sale or sharing of personal information. This work sits at the intersection of the W3C-described technologies and the organization's data flows; the specific wire format and integration details are beyond the scope of this entry.
Information governance leads
Governance leads are concerned with ensuring that GPC handling is embedded in ownership, stewardship, and policy, and that the organization can produce evidence it honors the signal. Accountability under governance frameworks generally requires demonstrable proof, not stated intent, so honoring GPC should be traceable through the relevant data flows and controls.
Legal counsel
Counsel advising on consumer privacy rights must assess whether GPC constitutes a binding opt-out under the applicable regime and how obligations differ across jurisdictions. Because GPC expresses a preference rather than determining a lawful basis, and because its treatment outside the CCPA context varies, legal analysis should be scoped to the specific governing law.

Inside GPC

Browser or Device Signal
Global Privacy Control is a technical specification that transmits a signal from a user's browser, extension, or device indicating a preference to opt out of the sale or sharing of personal information. The signal is communicated automatically rather than requiring the user to interact with each site individually.
Machine-Readable Opt-Out Preference
GPC expresses the user's opt-out choice in a standardized, machine-readable form so that receiving websites and services can detect and act on it programmatically, rather than relying on manual cookie-banner selections.
Regulatory Recognition Under Certain US Frameworks
In some US state privacy regimes, notably California under the CCPA as amended by the CPRA, an opt-out preference signal such as GPC is treated as a valid mechanism for exercising opt-out rights. Recognition and enforceability vary by jurisdiction, and GPC does not carry the same defined status under the EU GDPR or UK GDPR, where consent and lawful basis frameworks operate differently.
Business Obligation to Honor the Signal
Where a jurisdiction requires it, the business or controller receiving the signal bears the obligation to detect and give effect to the opt-out. Merely publishing a privacy notice is not sufficient; the accountability rests on demonstrably acting on the received preference.

Common questions

Answers to the questions practitioners most commonly ask about GPC.

Does honoring Global Privacy Control signals make my organization compliant with all applicable privacy laws?
No. Recognizing and acting on GPC signals addresses a specific type of user-directed preference (generally an opt-out of sale or sharing under certain frameworks), but it does not, on its own, satisfy broader obligations such as providing notice, honoring other consumer rights, maintaining lawful bases for processing, or meeting security requirements. Compliance depends on jurisdiction, the specific regime in scope, and your overall program. GPC handling is one component, not a comprehensive compliance solution.
Is Global Privacy Control the same thing as a cookie consent banner or consent management platform?
No. A GPC signal is a browser- or device-level indication of a user's preference that is transmitted automatically, whereas a consent banner or consent management interface collects an explicit choice through on-site interaction. They can coexist and may address overlapping concerns, but they are distinct mechanisms. Treating a consent banner as a substitute for detecting GPC signals, or vice versa, can leave gaps depending on the requirements of the applicable regime.
How can our website or application detect a GPC signal from a visitor?
A GPC signal is generally communicated by the user's browser or device, and organizations typically detect it by inspecting the relevant preference indication exposed to the site or received in the request. Implementation details vary by platform and by the tooling in use. This entry does not specify particular technical headers, property names, or code, and teams should confirm the current mechanism against authoritative technical documentation for their environment.
Once we detect a GPC signal, what action should we take?
The appropriate action depends on the applicable legal regime and how that regime treats an opt-out preference signal. In frameworks that recognize such signals, the typical response is to treat the signal as a request to opt out of the relevant processing (for example, sale or sharing as defined in that regime) for the associated user or browser. Organizations should map GPC handling to their specific obligations rather than assuming a uniform action applies everywhere.
How should we handle a conflict between a GPC signal and a preference the user set directly on our site?
Conflicts between an automated signal and an explicit on-site choice should be resolved according to the rules of the applicable regime and your documented policy. Some frameworks specify how such conflicts are handled or allow confirmation of the user's intent. Because treatment varies, organizations should define and document their reconciliation logic and be prepared to demonstrate it as evidence of their approach, rather than relying on stated intent alone.
What should we document to demonstrate that we are handling GPC signals appropriately?
Accountability generally requires demonstrable evidence rather than a stated commitment. Organizations typically document how signals are detected, how they are interpreted against applicable obligations, what action is taken, how conflicts are resolved, and how the outcome is recorded. The specific records depend on the regime and your program. This entry does not address retention periods, cross-border transfer implications, or enforcement outcomes associated with such documentation.

Common misconceptions

GPC is a universal, globally binding privacy standard that all websites must honor.
GPC is a technical signal whose legal effect depends on jurisdiction. Its recognized status is tied to specific frameworks such as California's regime under the CCPA and CPRA. It does not have an equivalent defined role under the EU GDPR or UK GDPR, and its treatment differs across regimes, so it should not be assumed to be universally enforceable.
Honoring GPC on its own makes an organization compliant with applicable privacy law.
Acting on GPC addresses one specific opt-out mechanism where required. Compliance depends on context, jurisdiction, and implementation, and involves other obligations such as lawful bases, notices, and rights handling that GPC does not by itself satisfy.
GPC is equivalent to consent or the withdrawal of consent.
GPC generally expresses an opt-out preference regarding sale or sharing of personal information, which is distinct from consent as a lawful basis. Opt-out mechanisms and consent are separate concepts and should not be conflated, particularly across the US opt-out model and the EU or UK consent-based model.

Best practices

Determine which jurisdictions' requirements apply to your processing and confirm whether an opt-out preference signal such as GPC must be recognized under each, rather than assuming uniform treatment.
Implement technical detection of the GPC signal on relevant web properties and ensure it is programmatically actioned where the applicable framework requires it.
Maintain demonstrable evidence that received GPC signals were honored, since accountability under governance frameworks requires records, not merely stated intent.
Treat GPC as one component of a broader rights-handling and opt-out program, and avoid presenting it as a stand-alone guarantee of compliance.
Keep the distinction clear between opt-out preference signals and consent-based mechanisms so that US opt-out obligations and EU or UK consent obligations are handled by appropriate, separate processes.
Review your handling of GPC periodically as regulatory recognition and guidance evolve across jurisdictions.