GPC stands for Global Privacy Control. It is a one-bit signal a browser sends to every site it contacts: do not sell my personal information, do not share it with third parties, do not use it for advertising targeting in another context. It exists because privacy laws in a growing number of United States jurisdictions grant a right to opt out of exactly those activities, and because exercising that right site by site, across hundreds of domains a month, is impractical. GPC collapses it into one browser setting.

What the browser actually sends

The signal travels by two paths. The first is an HTTP request header, whose grammar, as published in the W3C Working Draft of 11 June 2026, is two lines: field name Sec-GPC, field value 1. A server receiving Sec-GPC: 0, or any value other than that single numeric character, must process the request as though the header were absent. There is no way to un-opt-out; absence is the neutral state. The rigidity is deliberate, because implementers test for such headers with string equality rather than parsing them, so extension content would silently break existing checks. Intermediaries must not strip a 1, though they may insert one where they have reason to believe the originating person holds the preference.

The second is a DOM property, navigator.globalPrivacyControl, exposed on Navigator and WorkerNavigator, returning a boolean matching the header value. Ad tech implementers tend to prefer it, because a script reads it immediately rather than waiting on server-side header inspection, and auction timeouts leave no room for a round trip. Both paths read one cached state, a gpcAtNavigation boolean fixed when the top-level document begins loading, so toggling GPC mid-session changes nothing until the next navigation.

Sites may publish a GPC support resource at /.well-known/gpc.json, served as application/json, with a gpc member set to true or false and a lastUpdate member in RFC 3339 format. The New York Times publishes one. It declares awareness, not compliance. WebDriver commands at /session/{session id}/privacy let scanners set and read the signal at scale.

Where it sits in the ad transaction

On the sell side, the header dies at the first hop, so a publisher's server or tag must translate it for the downstream stack. That translation is usually the IAB Tech Lab's Global Privacy Platform, which reserves a subsection named Gpc, appended to state sections with a dot delimiter, whose only job is to carry the browser value onward. The IAB's MSPA signalling guidelines of 26 January 2024 leave signatories free to use it alongside fields such as SaleOptOut and TargetedAdvertisingOptOut, or to rely on those alone.

On the platform side, the dominant handling is Google's restricted data processing. Ad Manager, AdMob, AdSense and Google Ads documentation all state that Google receives GPC signals directly from users in applicable states and triggers RDP for those ad requests without publisher intervention. Under RDP, Google serves only non-personalised ads: no interest-based audience targeting, no demographic targeting, no user list targeting, and geo-targeting limited to coarse city-level location. That is how a browser toggle strips an impression of remarketing, Customer Match and demographic reach without an advertiser touching anything, while the request still reaches third-party bidders. PPC Land has tracked the footprint expanding state by state, from an eight-state expansion on 30 June 2025, through Delaware and Oregon on 17 November 2025, to Indiana, Kentucky and Rhode Island ahead of their January 2026 effective dates. Buy-side adoption has been thinner: Adform announced support in July 2024, warning that server-side tracking setups must be configured to forward the header.

Origin and evolution

The lineage runs through two failures. The Platform for Privacy Preferences Project was standardised at the W3C in 2002 and 2003, then abandoned as too complex. Do Not Track began at the W3C in 2009 and shipped in every major browser, but collapsed because no law obliged anyone to honour it; sites read it and ignored it lawfully.

GPC inverted the sequence. The legal right came first, in the California Consumer Privacy Act of 2018, and the signal was built to exercise it. The proposal reached the W3C Privacy Community Group in April 2020, from a coalition including Sebastian Zimmeck of Wesleyan University and Ashkan Soltani, later the first executive director of the California Privacy Protection Agency, plus the Electronic Frontier Foundation, Mozilla, Brave, DuckDuckGo, Consumer Reports and two major newspapers.

California's requirement took effect in January 2021. Colorado's attorney general recognised GPC as the first, and so far only, approved universal opt-out mechanism under its Privacy Act, binding from 1 July 2024. In November 2024 the W3C Privacy Working Group adopted GPC as a formal work item on the Recommendation track, where it remains a Working Draft.

Counting the states is harder than it sounds, and published tallies conflict. Several compliance trackers put the figure at twelve as of 1 January 2026: California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon and Texas. Others count eleven, or eight, depending on whether phase-in dates tied to unfinished rulemaking count as active. Laws modelled on Virginia's mostly omit the mandate.

California tightened its rules on 1 January 2026. Section 7025(c)(6) of the CCPA regulations previously said a business may display that it had processed an opt-out preference signal; the amended text, approved in September 2025, says a business must, offering "Opt-Out Request Honored" or a settings toggle as examples. Separately, the California Opt Me Out Act, signed on 8 October 2025 after a predecessor was vetoed in September 2024, requires browser developers to offer the setting from 1 January 2027. PPC Land covered the vetoed 2024 version and the lobbying against it.

Enforcement began early. California fined Sephora $1.2 million in August 2022 over GPC opt-outs. Healthline settled for $1.55 million on 1 July 2025, then the largest CCPA penalty, after investigators observed 118 advertising cookies still being set following a triple opt-out through banner, link and GPC. On 9 September 2025 the California Privacy Protection Agency and the attorneys general of California, Colorado and Connecticut announced a joint investigative sweep. Disney settled for $2.75 million in February 2026, PlayOn Sports for $1.1 million that same month, and private litigation followed, including a March 2026 wiretap suit against Ace Hardware.

Limitations and disputes

The compliance rate is poor. A webXray audit of 7,634 popular sites run from a California residential address in March 2026 found 55 percent set advertising cookies despite an active GPC signal, with Google failing 86 percent of the time and all eleven Google-certified consent management platforms tested failing to block Google cookies after opt-out. Aggregate liability was estimated at $5.8 billion.

Scope is the second problem. GPC restricts cross-context selling and sharing. It does not touch first-party processing in the same context, does not invoke deletion rights, and does not reach server-side transfers made after collection: a publisher passing data to Meta's Conversions API downstream of a GPC-flagged visit sends nothing telling the recipient a signal existed. Academics have flagged a further asymmetry, in that first-party processing survives, so GPC may structurally favour large platforms over the third parties they compete with.

Adoption is uneven. Firefox, Brave and DuckDuckGo send the signal; Chrome, Safari and Edge, holding the overwhelming majority of desktop share, do not support it natively, which is what the California browser mandate is meant to fix. Mobile app environments have no equivalent. The specification concedes a privacy cost of its own: splitting users into signalling and non-signalling groups adds an entropy bit usable for fingerprinting. Uptake figures conflict: a study reported by PPC Land put roughly 388,000 sites declaring support as of 5 April 2026, against the project's own claim of around 150 million users.

In Europe the mapping is unresolved. A peer-reviewed study published on 5 May 2026 found GPC could reduce but not eliminate EU consent banners, because "sell", "share" and "context" have no settled GDPR definitions and because Article 5(3) of the ePrivacy Directive requires consent for device storage regardless of whether data is later sold. One 2025 measurement put the first-visit cut in intractable cookies at about 30 percent. The proposed Article 88b GDPR would have made machine-readable signals enforceable, but the Council's 18 June 2026 position dropped it, leaving the European Parliament as the remaining route.

Disambiguation

GPP, the IAB Tech Lab's Global Privacy Platform, is a transport format, not an opt-out. It carries encoded consent strings between vendors and includes a Gpc subsection to relay the browser signal onward. GPC originates the preference; GPP moves it.

DNT, Do Not Track, is GPC's non-binding predecessor: two values, no legal force, deprecated.

TCF, the Transparency and Consent Framework, is IAB Europe's consent string standard for the EEA, UK and Switzerland, recording granular purpose-level consent under an opt-in model.

RDP, restricted data processing, is Google product behaviour, not a signal. GPC is one of several inputs that switch it on.

Recent developments

The centre of gravity has shifted from whether businesses must honour the signal to whether they can prove they did. California's display mandate took effect on 1 January 2026, and the tri-state sweep made non-compliance a coordinated exposure rather than a state-by-state one. The browser mandate arriving on 1 January 2027 changes the volume question. If Chrome, Safari and Edge ship a visible setting for Californian users, the share of traffic carrying Sec-GPC: 1 could rise sharply from a base that privacy-focused browsers have kept small, and platforms already wired to the header would absorb the shift without further work.

Timeline

  • 2002-2003: Platform for Privacy Preferences Project standardised at the W3C, then abandoned
  • 2009: Do Not Track development begins at the W3C
  • June 2018: California Consumer Privacy Act enacted, creating the opt-out right GPC exercises
  • April 2020: GPC introduced at the W3C Privacy Community Group
  • October 2020: GPC publicly launched by its founding coalition
  • January 2021: California compliance requirement takes effect
  • 24 August 2022: California settles with Sephora for $1.2 million over GPC non-compliance
  • 26 January 2024: IAB publishes MSPA Technical Signaling Implementation Guidelines covering the GPP Gpcsubsection
  • 1 July 2024: Colorado requirement takes effect; GPC is the only approved universal opt-out mechanism on the state list
  • July 2024: Adform announces GPC support
  • November 2024: W3C Privacy Working Group adopts GPC as an official work item
  • 1 January 2025: Connecticut, Texas and Montana requirements take effect
  • 1 July 2025: Healthline settles with California for $1.55 million
  • 9 September 2025: California, Colorado and Connecticut announce a joint GPC investigative sweep
  • 30 September 2025: California Privacy Protection Agency fines Tractor Supply $1.35 million
  • 8 October 2025: California Opt Me Out Act signed, effective 1 January 2027
  • 1 January 2026: Amended CCPA regulations make opt-out confirmation display mandatory; Delaware, Oregon and further state requirements take effect
  • 12 February 2026: Disney settles with California for $2.75 million over opt-out failures
  • March 2026: webXray audit finds 55 percent of sampled California sites ignoring the signal
  • 5 May 2026: Computer Law & Security Review publishes an assessment of GPC under EU law
  • 11 June 2026: W3C publishes the current GPC Working Draft
  • 18 June 2026: EU Council position drops proposed Article 88b GDPR

Summary

Who: Drafted by editors from Wesleyan University, Brave Software, Consumer Reports and The Washington Post within the W3C Privacy Working Group, backed by the Electronic Frontier Foundation, Mozilla, DuckDuckGo and major publishers. Honoured, in varying degrees, by publishers, consent management platforms, Google's advertising products and a small number of demand-side platforms.

What: A single-value HTTP request header, Sec-GPC: 1, mirrored by a navigator.globalPrivacyControl DOM property, expressing a request not to have personal information sold, shared with third parties, or used for cross-context advertising targeting.

When: Proposed in April 2020, legally binding in California from January 2021, adopted as a W3C work item in November 2024, and published as a Working Draft on 11 June 2026. A California mandate requiring browsers to offer the setting takes effect on 1 January 2027.

Where: Enforceable across roughly a dozen US states, with California, Colorado and Connecticut running coordinated enforcement. Its status under the GDPR and ePrivacy Directive remains unsettled after the EU Council dropped the proposed Article 88b in June 2026.

Why: Site-by-site opt-out is unworkable at web scale, and consent banners have proven a poor instrument for capturing what people actually want. GPC moves the choice to the browser, where it is expressed once and transmitted everywhere, and attaches it to statutory rights so that ignoring it carries a penalty.