Global Privacy Control: what the opt-out signal is, and how to see if your site honors it

What Global Privacy Control is

Global Privacy Control (GPC) is a setting in a visitor’s browser or extension. When it is on, every page request carries a small signal that says the visitor opts out of the sale or sharing of their personal data. Firefox, Brave and DuckDuckGo offer it today, and extensions add it to other browsers.

California’s privacy rules recognise signals like GPC as an opt-out request, and several other states have followed. The visitor does not have to find your “Do Not Sell or Share” link: the signal is the request.

Why it matters more from 2027

California’s Opt Me Out Act (AB 566), signed in October 2025, takes effect on 1 January 2027. From then, browsers have to offer their users an opt-out signal setting. Today GPC is mostly used by people who went looking for it. From 2027 it will be one switch away for everyone in California.

What going wrong looks like

In the public cases, the problem is rarely that a site has never heard of GPC. It is usually one of these:

• The consent tool supports GPC, but the setting was never switched on.
• The signal is read, but advertising tags still load and still send data.
• The signal is honored on one page or one device, but not across the visitor’s account.
• The signal is honored for cookies, but not for data sent by a pixel or by the server.

How to look at it on your own site

Open your site in a browser with GPC turned on, and with your browser’s developer tools open on the network tab. Load the home page and a product page, and look at which outside companies receive requests. Then do the same with GPC off and compare. If the same advertising requests appear in both, the signal is not changing what your site sends.

One check from one browser on one day is a start, not an answer: sites behave differently by page, by device and by where the visitor is.

Public cases about opt-out signals

• 24 Aug 2022 · California Attorney General · $1.2 million

  Sephora settles the first California action over Global Privacy Control

  Honouring a browser opt-out signal is checked, not assumed.

  Read the summary
• 3 Mar 2026 · California Privacy Protection Agency (CalPrivacy) · $1.1 million

  Youth sports streamer PlayOn ordered to give its own opt-out and honour browser signals

  Sending visitors to a third-party ad-industry opt-out page does not replace your own opt-out.

  Read the summary
• 11 Feb 2026 · California Attorney General · $2.75 million

  Disney settles claims that its opt-outs stopped at one device

  An opt-out has to follow the person across every device and service tied to their account.

  Read the summary
• 30 Sep 2025 · California Privacy Protection Agency (CalPrivacy) · $1.35 million

  Tractor Supply ordered to pay and to keep an inventory of its trackers

  Knowing every tracker running on your sites is now part of the work: this order requires a current list.

  Read the summary

Each case is summarised on our news page and linked there to the regulator’s or court’s own announcement. Allegations are the regulator’s own, and a settlement usually comes without any admission.

Common questions

Is Global Privacy Control the same as Do Not Track?

No. Do Not Track was an older browser signal with no agreed meaning. GPC is defined as an opt-out of the sale or sharing of personal data, and California’s regulators have acted on sites that did not respond to it.

My consent tool says it supports GPC. Am I done?

Support is a setting, and settings can be off. In one public case a misconfigured consent tool left opt-out requests waiting 40 days. What matters is what the site sends when the signal arrives.

Do I need a banner as well?

The signal and the banner do different jobs: the banner asks, the signal tells. Which ones your business needs is a question for your counsel.