What is Global Privacy Control, and how does it reach the ad chain?
Part of US and Canada targeting
The short answer
Global Privacy Control (GPC) is a browser setting or extension that tells every website a person visits that they do not want their personal information sold or shared. It travels as the Sec-GPC HTTP header and a JavaScript property. Laws in California, Colorado, Connecticut, Texas and Oregon make such signals a valid opt-out for covered businesses.
Key takeaways
- GPC is defined in a W3C Privacy Working Group draft: a Sec-GPC header with the value 1 and a read-only navigator.globalPrivacyControl property.
- The signal has legal force only where state law makes it a valid opt-out: sale and sharing in California, sale and targeted advertising in Colorado, Connecticut, Texas and Oregon.
- In programmatic buying the publisher's page reads the signal and passes it on, for example in the Gpc field of a Global Privacy Platform string in the bid request.
- Connecticut's definition of targeted advertising excludes ads based on the context of the current visit, so contextual and profile-based buys raise different GPC questions.
What exactly does the Global Privacy Control signal say?
The Global Privacy Control specification (opens in a new tab) is a W3C Working Draft from the Privacy Working Group, on the Recommendation track; the version checked is dated September 24, 2026. It defines a signal, sent over HTTP and through the DOM, that asks websites not to sell or share a person's personal information. The project site (opens in a new tab) says GPC was introduced at the W3C Privacy Community Group in April 2020 and became a Privacy Working Group work item in November 2024.
Definition
- Global Privacy Control (GPC)
- A browser, extension or device setting that attaches one preference to every request a person makes: do not sell or share my personal information. It carries no identity and no reason.
| Part | What the specification defines | Who reads it |
|---|---|---|
| Sec-GPC request header | One header with the value 1, sent only when the preference is on; any other value is ignored | The web server |
| navigator.globalPrivacyControl | A read-only true or false property showing whether the header would be sent for the top-level document | Scripts on the page, such as a consent tool |
| /.well-known/gpc.json | An optional file; gpc true means the site intends to honor GPC at least as far as the law requires, dated by lastUpdate | Anyone checking the site |
The specification also says what GPC is not. It does not trigger deletion rights or limit how the chosen site uses data within that same context, and its legal effect depends on where the person is and the scope of the applicable law. The project site lists browsers that support GPC natively, some on by default, plus extensions.
Which US states require businesses to honor GPC?
The W3C draft says at least four states have specifically identified GPC as a valid means to exercise legal opt-out rights. State laws speak of a universal opt-out mechanism or an opt-out preference signal. The table covers five states whose official text was opened; it is not a complete list.
| State | Date the duty applied | Right the signal exercises | What the official source says |
|---|---|---|---|
| California | Required by the CCPA regulations; current text effective January 1, 2026 | Opt-out of sale and sharing | A business that sells or shares personal information shall process a qualifying opt-out preference signal as a valid request; an HTTP header field or JavaScript object is given as the example format (CCPA regulations, section 7025 (opens in a new tab)) |
| Colorado | July 1, 2024 | Opt-out of sale and of targeted advertising | Businesses within the act's thresholds must let consumers opt out using GPC; GPC is currently the only mechanism the Department of Law considers valid (Colorado Attorney General (opens in a new tab)) |
| Connecticut | January 1, 2025 | Opt-out of targeted advertising and sale | As of January 1, 2025, businesses covered under the CTDPA must honor universal opt out preference signals sent by Connecticut residents (Connecticut Attorney General (opens in a new tab)) |
| Texas | January 1, 2025, for section 541.055(e) | Opt-out of targeted advertising and sale | A consumer may designate an authorized agent through an Internet browser setting or extension, or a global device setting; the statute lists four cases in which a controller need not comply (HB 4, enrolled (opens in a new tab)) |
| Oregon | January 1, 2026 | Opt-out of sale and targeted advertising | Businesses and nonprofits that meet the OCPA thresholds must honor opt-out preference signals as a valid opt-out request; GPC is named as one example (Oregon DOJ (opens in a new tab)) |
On September 9, 2025 the California Privacy Protection Agency announced a joint investigative sweep (opens in a new tab) with the Attorneys General of California, Colorado and Connecticut, contacting businesses that may not be processing GPC opt-out requests. In August 2022 a California Attorney General settlement (opens in a new tab) set $1.2 million in penalties over opt-outs sent through global privacy controls that were allegedly not processed.
How does a GPC signal travel to ad platforms?
The browser sends the signal to the website, not to the advertiser. In programmatic buying the page's consent tool can read the header or the JavaScript property and writes the result into a privacy string that travels with the bid request.
The carrier is the IAB Tech Lab Global Privacy Platform (opens in a new tab). Its state sections, such as the California section (opens in a new tab), include a GPC subsection with one Gpc field, 0 for false and 1 for true, and tell entities creating GPP strings to pass along the value they find. OpenRTB 2.6 (opens in a new tab) carries the string in the Regs object: gpp holds it and gpp_sid lists the sections that apply.
| Point in the chain | Field or artifact | What it proves | What it does not prove |
|---|---|---|---|
| Browser request | Sec-GPC: 1 | The person's browser sent the preference | That the site read it |
| Page script | navigator.globalPrivacyControl | The page could read the preference | That the consent tool used it |
| Privacy string | Gpc field in a GPP section | The publisher's tool recorded the preference | That every downstream party changed its processing |
| Bid request | regs.gpp and regs.gpp_sid | The string reached the exchange and bidders | That the bidder declined to use personal data |
California's regulations show how fast the chain must react. In section 7026 an illustrative business sells and shares personal information through real-time bidding; because it can restrict the transfer instantaneously, it must stop immediately rather than take the 15 business days allowed, and must notify third parties that received the data in between.
Does GPC affect contextual advertising?
GPC opts a person out of specific uses of personal information, so its effect depends on what the ad decision relied on. Connecticut's statute says targeted advertising does not include ads based on the context of a consumer's current search query or visit to a website or app. California's CCPA statute (opens in a new tab) defines cross-context behavioral advertising as targeting based on activity across businesses and sites other than the one the consumer intentionally interacts with.
| Ad decision | What it relies on | Relation to the opt-out right |
|---|---|---|
| Ad chosen for the page's topic | The content of the current page | Connecticut excludes ads based on the context of the current visit from targeted advertising; California treats nonpersonalized ads in the current interaction as a business purpose if the data is not passed on or profiled |
| Retargeting a past visitor | Activity on another site | Matches California's cross-context behavioral advertising definition |
| Third-party audience segment | Data gathered over time across sites | Within targeted advertising as the states define it |
| Frequency and reach reports | Identifiers used to measure | Connecticut excludes processing solely to measure frequency, performance or reach; sale or sharing is a separate question |
A contextual placement is chosen from the page, not from a profile, so the decision itself does not depend on the signal. The impression can still carry identifiers, cookies or pixels from the page and its partners, and those flows are what the opt-out governs. A contextual plan narrows the GPC question; it does not remove it.
How can a buyer check that GPC is honored on a publisher?
These checks use a browser with GPC switched on, its developer tools and a test profile with no history. They complement the opt-out trace on the CCPA cross-context behavioral advertising page, which follows a request through the integration owners.
Five publisher-side GPC checks
- Confirm the browser is sending it. Type navigator.globalPrivacyControl in the console on any page; true means the header is being sent for that document.
- Read the site's statement. Open the site's /.well-known/gpc.json and note the gpc value and the lastUpdate date; a missing file means support is unknown, not refused.
- Look for the California status message. Section 7025(c)(6) requires a business to display on its website whether it processed the signal, for example with "Opt-Out Request Honored" or a toggle showing the opt-out.
- Watch the outgoing calls. In the network panel, find the ad calls and check whether a GPP string is present and whether its applicable section carries Gpc set to 1.
- Read the privacy policy. Colorado requires the policy to explain how opt-out mechanism requests are processed; record the passage and the date checked.
Fictional example. Unnamed brand, no results implied.
A Texas barbecue smoker maker checks its cooking publishers
An unnamed maker of barbecue smokers and grilling accessories in Texas plans display ads beside barbecue recipes, pitmaster interviews and smoker cooking guides, with an inclusion list of about forty publishers and no audience segments. Its site runs a measurement pixel, so its privacy lead asks the agency to document publisher GPC handling before launch.
The planner runs the five checks. The other publishers on the list publish gpc.json and pass a GPP string with Gpc set. Three have no file and send no string; the planner records them as unknown, not failures, and sends the evidence to the privacy lead with a dated note per site.
Which signals can a contextual site list rely on without personal data?
PlacementGraph builds lists from page content.
Frequently asked questions
Is Global Privacy Control the same as Do Not Track?
Do Not Track was an earlier browser header, and the GPC specification credits that earlier work. GPC asks for one specific thing, no sale or sharing of personal information, and laws in states such as California, Colorado and Connecticut give that request legal effect for covered businesses.
Does a GPC signal apply to every device a person owns?
The Colorado Attorney General tells consumers that if they have multiple devices or browsers, they need to turn GPC on for each one separately. California's regulation applies the signal to that browser or device and any profile associated with it, and also to the consumer if the business knows who they are.
Can a website ask a GPC user to opt back in?
Under California's regulation, if the signal conflicts with a business-specific setting that allows sale or sharing, the business must process the opt-out but may tell the consumer about the conflict and offer a chance to consent. Connecticut's statute similarly addresses conflicts with existing settings and loyalty programs.
Does GPC affect ads in Canada?
The state laws on this page protect residents of those states. The specification says other regulators may decide how the signal applies in their jurisdictions, and the Canadian regulator sources checked for this page did not name GPC. Canadian consent rules are covered on the cluster's PIPEDA and Law 25 pages.
Sources
- Global Privacy Control (GPC), W3C Working Draft, 24 September 2026 (opens in a new tab)W3C Privacy Working Group
- Global Privacy Control (opens in a new tab)Global Privacy Control project
- California Consumer Privacy Act Regulations, effective January 1, 2026 (sections 7025 and 7026) (opens in a new tab)California Privacy Protection Agency
- California Consumer Privacy Act statute, effective January 1, 2026 (opens in a new tab)California Privacy Protection Agency
- California Privacy Protection Agency Announces Joint Investigative Privacy Sweep (September 9, 2025) (opens in a new tab)California Privacy Protection Agency
- Universal Opt-Out Mechanism (opens in a new tab)Colorado Attorney General
- The Connecticut Data Privacy Act (opens in a new tab)Connecticut Attorney General
- H.B. No. 4, Texas Data Privacy and Security Act, enrolled version (opens in a new tab)Texas Legislature
- Privacy: Oregon Consumer Privacy Act (opens in a new tab)Oregon Department of Justice
- Attorney General Bonta Announces Settlement with Sephora as Part of Ongoing Enforcement of CCPA (August 24, 2022) (opens in a new tab)California Attorney General
- GPP Extension: California Privacy Technical Specification (opens in a new tab)IAB Tech Lab
- OpenRTB 2.6 specification (Regs object) (opens in a new tab)IAB Tech Lab
Researched and written by PlacementGraph Research. Read how we research, source and update these pages. Corrections: diana@placementgraph.com.