---
source_url: "https://en.wikipedia.org/wiki/Global_Privacy_Control"
title: Global Privacy Control - Wikipedia
mirrored_at: 2026-08-13T15:39:45.416Z
host: en.wikipedia.org
cited_in_42a: true
mirror_canonical: "https://index.42a.ai/en.wikipedia.org/wiki/Global_Privacy_Control"
---

> **Original source:** https://en.wikipedia.org/wiki/Global_Privacy_Control

From Wikipedia, the free encyclopedia

Global Privacy Control project logo

**Global Privacy Control** (**GPC**) is a set of web technologies that can be used to inform websites of the user's wish to have their information not be sold or used by ad trackers.[\[1\]](#cite_note-1) Unlike the now-deprecated [Do Not Track](https://en.wikipedia.org/wiki/Do_Not_Track "Do Not Track") header, which was unsuccessful as it was ignored by third parties, GPC is intended to have legal force under [privacy laws](https://en.wikipedia.org/wiki/Privacy_law "Privacy law").[\[2\]](#cite_note-2)[\[3\]](#cite_note-3)

GPC was developed in 2020 by privacy technology researchers including Sebastian Zimmeck, professor at [Wesleyan University](https://en.wikipedia.org/wiki/Wesleyan_University "Wesleyan University"), and [Ashkan Soltani](https://en.wikipedia.org/wiki/Ashkan_Soltani "Ashkan Soltani"), former Chief Technologist of the [Federal Trade Commission](https://en.wikipedia.org/wiki/Federal_Trade_Commission "Federal Trade Commission"), as well as a group of privacy-focused companies including the [Electronic Frontier Foundation](https://en.wikipedia.org/wiki/Electronic_Frontier_Foundation "Electronic Frontier Foundation") and [Automattic](https://en.wikipedia.org/wiki/Automattic "Automattic") (owner of [Tumblr](https://en.wikipedia.org/wiki/Tumblr "Tumblr") and [WordPress](https://en.wikipedia.org/wiki/WordPress "WordPress")).[\[4\]](#cite_note-4) The development of GPC was initiated by a [National Science Foundation](https://en.wikipedia.org/wiki/National_Science_Foundation "National Science Foundation") grant.[\[5\]](#cite_note-5)

The GPC specification defines two parts for implementing GPC in clients, and one part when implementing for servers.

The first part of a client implementation is a [HTTP header](https://en.wikipedia.org/wiki/HTTP_header "HTTP header") with the form:

`Sec-GPC: 1`

The character '1' is the only allowed value for the header.[\[6\]](#cite_note-6) There is deliberately no mechanism for [extensibility](https://en.wikipedia.org/wiki/Extensibility "Extensibility"); the creators of the standard have stated that they will create new headers if extension becomes necessary.[\[7\]](#cite_note-7)

The second part of a client implementation is setting the `navigator.globalPrivacyControl` property to the value `true`.[\[8\]](#cite_note-8)

Websites can optionally host a [JSON](https://en.wikipedia.org/wiki/JSON "JSON")\-formatted file known as the GPC support resource at the [well-known URI](https://en.wikipedia.org/wiki/Well-known_URI "Well-known URI") `.well-known/gpc.json` to indicate how they respond to the GPC signal. This file has up to two relevant members (all other members should be ignored): a `gpc` boolean member where `true` means that the server intends on complying with GPC requests, and `false` means it does not, and a `lastUpdate` member.[\[9\]](#cite_note-9) By default, a website's support is unknown.

GPC has been implemented by [Mozilla Firefox](https://en.wikipedia.org/wiki/Mozilla_Firefox "Mozilla Firefox"),[\[10\]](#cite_note-10) [Brave](https://en.wikipedia.org/wiki/Brave_\(web_browser\) "Brave (web browser)"),[\[11\]](#cite_note-ElReg-11) and [DuckDuckGo Private Browser](https://en.wikipedia.org/wiki/DuckDuckGo_Private_Browser "DuckDuckGo Private Browser").[\[12\]](#cite_note-CB-12)[\[11\]](#cite_note-ElReg-11) GPC is not yet supported by [Google Chrome](https://en.wikipedia.org/wiki/Google_Chrome "Google Chrome")[\[13\]](#cite_note-13) or [Microsoft Edge](https://en.wikipedia.org/wiki/Microsoft_Edge "Microsoft Edge"),[\[11\]](#cite_note-ElReg-11) despite Chrome still allowing users to enable the Do Not Track header.[\[14\]](#cite_note-14) However, there are third-party extensions available for Chrome that enable sending the GPC header during HTTP requests, including the [EFF](https://en.wikipedia.org/wiki/Electronic_Frontier_Foundation "Electronic Frontier Foundation")'s [Privacy Badger](https://en.wikipedia.org/wiki/Privacy_Badger "Privacy Badger") extension[\[15\]](#cite_note-15) and the [DuckDuckGo](https://en.wikipedia.org/wiki/DuckDuckGo "DuckDuckGo") Privacy Essentials add-on[\[16\]](#cite_note-16) amongst others. Starting January 1, 2027 the CCPA requires businesses that develop or maintain a browser to include functionality configurable by a consumer that enables the browser to send an opt-out preference signal.[\[17\]](#cite_note-17) effectively requiring GPC in all browsers available to California residents. Many websites including the _[New York Times](https://en.wikipedia.org/wiki/New_York_Times "New York Times")_ and _[Washington Post](https://en.wikipedia.org/wiki/Washington_Post "Washington Post")_ have started to recognize and respect GPC signals.[\[12\]](#cite_note-CB-12) As of May 2, 2026 close to 400,000 websites declare via their `.well-known/gpc.json` that they respect GPC.[\[18\]](#cite_note-18)

As of March 2026, GPC has legal authority in five states:

-   In Colorado, GPC was the first Universal Opt-Out Mechanism (UOOM) to be recognized as meeting the standards of the Colorado Privacy Act (CPA).[\[19\]](#cite_note-CPA-19)
-   GPC signals achieved legal status in Connecticut on January 1, 2025, when the Connecticut Data Privacy Act (CDPA) took effect.[\[20\]](#cite_note-CDPA-20)
-   New Jersey started requiring businesses to respect universal opt-out mechanisms such as GPC under the New Jersey Data Privacy Law (NJDPL) which went into effect on July 15, 2025.[\[21\]](#cite_note-NJDPL-21)
-   In California, unlike the Do Not Track header, GPC is a valid do-not-sell-my-personal-information signal according to the [California Consumer Privacy Act](https://en.wikipedia.org/wiki/California_Consumer_Privacy_Act "California Consumer Privacy Act") (CCPA), which stipulates that websites are legally required to respect a signal sent by users who want to opt-out of having their personal data sold.[\[22\]](#cite_note-State-of-California-Department-of-Justice-Office-of-the-Attorney-General-2018-22) In July 2021, the [California Attorney General](https://en.wikipedia.org/wiki/Attorney_General_of_California "Attorney General of California") clarified that under law, the Global Privacy Control signal must be honored.
-   As of January 1, 2026, under the Oregon Consumer Privacy Act (CPA) businesses have to honor opt-out signals that meet certain technical requirements, such as GPC.[\[23\]](#cite_note-OCPA-23)

## Enforcement actions

\[[edit](https://en.wikipedia.org/w/index.php?title=Global_Privacy_Control&action=edit&section=4 "Edit section: Enforcement actions")\]

On August 24, 2022, the California Attorney General announced [Sephora](https://en.wikipedia.org/wiki/Sephora "Sephora") paid a $1.2 million settlement for allegedly failing to process opt-out requests via a user-enabled global privacy control signal.[\[24\]](#cite_note-24) Later on July 1, 2025, the California Attorney General announced the largest CCPA settlement to date of $1.55 million against [Healthline.com](https://en.wikipedia.org/wiki/Healthline.com "Healthline.com") for failing to allow consumers to opt out of [targeted advertising](https://en.wikipedia.org/wiki/Targeted_advertising "Targeted advertising") and for sharing data with third parties without CCPA-mandated privacy protections.[\[25\]](#cite_note-25) On September 9, 2025, the Connecticut, California, and Colorado Attorneys General announced a joint investigative privacy sweep that involved sending letters to businesses that do not appear to be processing consumer requests to opt out of the sale of their personal information submitted via GPC as required by law and requested that those businesses come into immediate compliance.[\[26\]](#cite_note-26) On February 11, 2026, the California Attorney General announced a $2.75 Million settlement with [Disney](https://en.wikipedia.org/wiki/Disney "Disney") resolving allegations that the company violated the CCPA by failing to fully effectuate consumers' opt-out requests across all devices and streaming services associated with consumers' Disney accounts clarifying that GPC applies to all devices of a consumer's account.[\[27\]](#cite_note-27) On March 5, 2026, the [California Privacy Protection Agency](https://en.wikipedia.org/wiki/California_Privacy_Protection_Agency "California Privacy Protection Agency") Board issued a decision requiring [Ford Motor Company](https://en.wikipedia.org/wiki/Ford_Motor_Company "Ford Motor Company") to pay a $375,703 fine for creating unnecessary friction in the opt-out process under the CCPA and required Ford to conduct an audit of the tracking technologies on its website and ensure compliance with opt-out preference signals, including GPC.[\[28\]](#cite_note-28)

1.  [↑](#cite_ref-1) ["Global Privacy Control (GPC)"](https://privacycg.github.io/gpc-spec/). _privacycg.github.io_. Retrieved August 17, 2024.
2.  [↑](#cite_ref-2) ["Global Privacy Control (GPC)"](https://oag.ca.gov/privacy/ccpa/gpc). _State of California - Department of Justice - Office of the Attorney General_. 2025-01-28. Retrieved 2025-03-17.
3.  [↑](#cite_ref-3) Desai, Anokhy (25 October 2022). ["Is GPC the new 'do not track'?"](https://iapp.org/news/a/is-gpc-the-new-do-not-track). _iapp.org_. Retrieved 2025-03-17.
4.  [↑](#cite_ref-4) ["Frequently Asked Questions | Global Privacy Control"](https://globalprivacycontrol.org/faq). _globalprivacycontrol.org_. Retrieved August 17, 2024. Who is supporting the development of GPC?
5.  [↑](#cite_ref-5) ["Award Abstract # 2055196 SaTC: CORE: Small: Improving Internet Privacy with Global Privacy Control"](https://www.nsf.gov/awardsearch/show-award/?AWD_ID=2055196). _nsf.gov_. Retrieved 2026-05-02.
6.  [↑](#cite_ref-6) ["Global Privacy Control (GPC) - The Sec-GPC header for HTTP requests"](https://w3c.github.io/gpc/#the-sec-gpc-header-field-for-http-requests). _w3c.github.io_. Retrieved 2025-03-17.
7.  [↑](#cite_ref-7) ["Global Privacy Control (GPC) - Extensibility of the Sec-GPC field value"](https://w3c.github.io/gpc/#extensibility-of-the-sec-gpc-field-value). _w3c.github.io_. Retrieved 2025-03-17.
8.  [↑](#cite_ref-8) ["Global Privacy Control (GPC) - Preference caching"](https://w3c.github.io/gpc/#preference-caching). _w3c.github.io_. Retrieved 2025-03-17.
9.  [↑](#cite_ref-9) ["Global Privacy Control (GPC) - GPC Support Resource"](https://w3c.github.io/gpc/#gpc-support-resource). _w3c.github.io_. Retrieved 2025-07-26.
10.  [↑](#cite_ref-10) ["Global Privacy Control"](https://support.mozilla.org/en-US/kb/global-privacy-control). _Mozilla Support_. Retrieved December 20, 2024.
11.  [1](#cite_ref-ElReg_11-0) [2](#cite_ref-ElReg_11-1) [3](#cite_ref-ElReg_11-2) Vigliarolo, Brandon (2024-12-12). ["Mozilla removing Do Not Track option from Firefox 135"](https://www.theregister.com/2024/12/12/firefox_do_not_track/). _The Register_. Retrieved 2024-12-20.
12.  [1](#cite_ref-CB_12-0) [2](#cite_ref-CB_12-1) ["What is Global Privacy Control, the Do Not Track replacement?"](https://circuitbulletin.com/what-is-global-privacy-control-the-do-not-track-replacement/). _Circuit Bulletin_. 2024-12-20. Retrieved 2024-12-20.
13.  [↑](#cite_ref-13) ["Chrome Privacy Now!"](https://chromeprivacy.org/). _Chrome Privacy Now!_. Retrieved August 17, 2024.
14.  [↑](#cite_ref-14) ["Turn "Do Not Track" on or off"](https://support.google.com/chrome/answer/2790761). _Google Chrome Help_. Google Inc.
15.  [↑](#cite_ref-15) ["Privacy Badger"](https://privacybadger.org/#What-is-Global-Privacy-Control). _Electronic Frontier Foundation_. Retrieved August 17, 2024. What is Global Privacy Control (GPC)?
16.  [↑](#cite_ref-16) ["Global Privacy Control (GPC) Enabled by Default in DuckDuckGo Apps & Extensions"](https://spreadprivacy.com/global-privacy-control-enabled-by-default/). _Spread Privacy_. January 28, 2021. Retrieved August 17, 2024.
17.  [↑](#cite_ref-17) ["AB-566 California Consumer Privacy Act of 2018: opt-out preference signal,"](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260AB566). _gpcsup.com_. Retrieved May 2, 2026.
18.  [↑](#cite_ref-18) ["Check a site - GPC Support"](https://gpcsup.com/). _gpcsup.com_. Retrieved May 2, 2026.
19.  [↑](#cite_ref-CPA_19-0) ["Universal Opt-Out and the Colorado Privacy Act"](https://coag.gov/opt-out/). _coag.gov_. Retrieved July 26, 2025.
20.  [↑](#cite_ref-CDPA_20-0) ["Attorney General Tong advises Connecticut consumers and businesses of opt out rights and requirements"](https://portal.ct.gov/ag/press-releases/2024-press-releases/tong-advises-connecticut-consumers-and-businesses-of-opt-out-rights-and-requirements). _[ct.gov](https://en.wikipedia.org/wiki/Ct.gov "Ct.gov")_. December 30, 2024. Retrieved July 26, 2025.
21.  [↑](#cite_ref-NJDPL_21-0) ["New Jersey Data Privacy Law FAQs"](https://www.njconsumeraffairs.gov/ocp/Pages/NJ-Data-Privacy-Law-FAQ.aspx). _njconsumeraffairs.gov_. Retrieved July 28, 2025.
22.  [↑](#cite_ref-State-of-California-Department-of-Justice-Office-of-the-Attorney-General-2018_22-0) ["California Consumer Privacy Act (CCPA)"](https://oag.ca.gov/privacy/ccpa). _State of California - Department of Justice - Office of the Attorney General_. October 15, 2018. Retrieved August 17, 2024.
23.  [↑](#cite_ref-OCPA_23-0) ["Consumer Privacy - Oregon Department of Justice: Consumer Protection"](https://www.doj.state.or.us/consumer-protection/id-theft-data-breaches/privacy/). _doj.state.or.us_. Retrieved May 2, 2026.
24.  [↑](#cite_ref-24) Merken, Sara (August 24, 2022). ["Sephora to pay $1.2 mln in privacy settlement with Calif. AG over data sales"](https://www.reuters.com/legal/litigation/sephora-pay-12-mln-privacy-settlement-with-calif-ag-over-data-sales-2022-08-24/). _[Reuters](https://en.wikipedia.org/wiki/Reuters "Reuters")_. [Archived](https://web.archive.org/web/20230510060201/https://www.reuters.com/legal/litigation/sephora-pay-12-mln-privacy-settlement-with-calif-ag-over-data-sales-2022-08-24/) from the original on May 10, 2023. Retrieved June 13, 2024.
25.  [↑](#cite_ref-25) ["Attorney General Bonta Announces Largest CCPA Settlement to Date, Secures $1.55 Million from Healthline.com"](https://oag.ca.gov/news/press-releases/attorney-general-bonta-announces-largest-ccpa-settlement-date-secures-155). _oag.ca.gov_. Retrieved 2025-07-27.
26.  [↑](#cite_ref-26) ["Connecticut, California and Colorado Announce Joint Investigative Privacy Sweep"](https://portal.ct.gov/ag/press-releases/2025-press-releases/connecticut-california-and-colorado-announce-joint-investigative-privacy-sweep). _portal.ct.gov_. Retrieved 2026-05-02.
27.  [↑](#cite_ref-27) ["California Won't Let It Go: Attorney General Bonta Announces $2.75 Million Settlement with Disney, Largest CCPA Settlement in California History"](https://oag.ca.gov/news/press-releases/california-wont-let-it-go-attorney-general-bonta-announces-275-million). _oag.ca.gov_. Retrieved 2026-05-02.
28.  [↑](#cite_ref-28) ["Ford to Change Practices, Pay Fine for Adding Unnecessary Friction to Opt-Out Process"](https://privacy.ca.gov/2026/03/ford-to-change-practices-pay-fine-for-adding-unnecessary-friction-to-opt-out-process/). _privacy.ca.gov_. Retrieved 2026-05-02.

-   [Official website](https://globalprivacycontrol.org/) 
-   [Full technical specification](https://w3c.github.io/gpc/)