Question 1

What is Global Privacy Control (GPC)?

Accepted Answer

Global Privacy Control (GPC) is a browser-level signal that communicates a user's privacy preferences to websites. When enabled, the browser sends a Sec-GPC: 1 HTTP header and sets navigator.globalPrivacyControl to true, signaling that the user opts out of data sales, sharing, and targeted advertising. GPC is supported by browsers like Firefox, Brave, and DuckDuckGo, as well as browser extensions like Privacy Badger.

Question 2

Which states require honoring GPC signals?

Accepted Answer

As of 2026, the following states require businesses to honor GPC or universal opt-out mechanism signals: California (CCPA/CPRA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), Montana (MCDPA), Oregon (OCPA), Delaware (DPDPA), New Hampshire (NHPA), New Jersey (NJDPA), Nebraska (NDPA), Maryland (MODPA), and Minnesota (MCDPA). More states are expected to add GPC requirements in coming years.

Question 3

How do I implement GPC on my website?

Accepted Answer

To implement GPC: (1) On the server side, check for the Sec-GPC HTTP request header. (2) On the client side, check navigator.globalPrivacyControl in JavaScript. (3) When GPC is detected, treat it as a valid opt-out request — suppress advertising cookies, stop data sales/sharing, and disable targeted advertising. Many consent management platforms (CMPs) like OneTrust, Cookiebot, and Osano support GPC detection natively.

Question 4

What are the penalties for not honoring GPC?

Accepted Answer

Penalties vary by state. California has actively enforced GPC compliance — the CPPA fined Sephora $1.2 million for ignoring GPC signals. Penalties under CCPA reach $7,500 per intentional violation. Texas TDPSA penalties reach $7,500 per violation after the 30-day cure period. Other states typically impose $2,500–$10,000 per violation, while Maryland can reach $25,000 for subsequent violations. Since GPC violations can be per-consumer, exposure can escalate rapidly.

Question 5

Is GPC the same as Do Not Track (DNT)?

Accepted Answer

No. GPC and Do Not Track (DNT) are different signals. DNT was a browser signal that was never legally mandated in the US and was largely ignored by websites. GPC, in contrast, has explicit legal backing under California's CCPA/CPRA and other state privacy laws. When a state requires honoring "universal opt-out mechanisms," GPC is the primary signal that must be honored. GPC has legal force; DNT does not.

GPC Compliance Checker

Step 1: Where are your users located?

GPC Compliance Checker

Step 1: Where are your users located?