Global Privacy Control: The Signal Your Banner Cannot Ignore

Global Privacy Control is a browser setting that tells every website you visit not to sell or share your personal information, and in California, Colorado, and Connecticut, the law treats that signal as a valid opt-out. Your banner cannot ignore it. If a visitor arrives with the signal on, the advertising tags stay blocked, whether or not they ever see your banner.

The signal your banner cannot see

Global Privacy Control is a browser setting that tells every website you visit not to sell or share your personal information. When it is on, the browser adds the HTTP header Sec-GPC: 1 to each request and sets navigator.globalPrivacyControl to true for scripts on the page. Firefox, Brave, and DuckDuckGo support it, and extensions add it elsewhere. It is the best-known opt-out preference signal, the general term the California regulations use for this kind of browser-level opt-out.

In California, Colorado, Connecticut, and a growing list of US states, the law treats the GPC signal as a valid request to opt out of the sale or sharing of personal data and of targeted advertising. Websites covered by those laws must honour it automatically, without asking the visitor to click anything. That is the part most banners get wrong: the banner is a tool for collecting a choice, and the signal is a choice that has already been made. A banner that waits for a click before it honours the signal is a banner that has already failed.

What honouring it actually requires

Once a business receives a GPC signal, three obligations follow. Stop selling and sharing as soon as feasibly possible, and no later than 15 business days. Honour it beyond new collection, so the opt-out reaches data already collected and already flowing to third parties, not just the tap going forward. And honour it beyond the device it arrived on, whether or not the person is logged in, when the business can associate a browser, device, or profile with a person by any reasonable means.

Since the updated regulations took effect on January 1, 2026, the business must also show on its website whether it has processed the signal, for example with an Opt-Out Request Honored message. The California Privacy Protection Agency's own suggested example is a simple message shown to anyone browsing with GPC enabled. That is a small change, and it is the one that proves the signal was honoured, not just received.

The enforcement is no longer theoretical

Ketch's own research found that 40 percent of trackers ignore consumer opt-outs, and the California Privacy Protection Agency voted in August 2026 to begin formal rulemaking expressly recognising GPC in the CCPA regulations, and to tighten how opt-out signals must be honoured across devices, including for people who never log in. In February 2026, California Attorney General Rob Bonta announced a 2.75 million dollar settlement with Disney, the largest CCPA settlement in state history, and the final judgment requires Disney to honour an opt-out across every service tied to a consumer's account once that person is logged in.

The pressure will grow. California's Opt Me Out Act, AB 566, signed in October 2025, requires browsers to offer a built-in opt-out preference signal setting from January 1, 2027, so the share of Californians sending GPC will rise. A site that does not honour the signal today is a site that will be honouring it for more visitors next year, and the fix is the same either way.

The fix, in plain terms

Technically, honouring GPC means your banner script checks the signal before loading any advertising tag, and if it is present, keeps those tags blocked and records the opt-out. That is three lines of code: check navigator.globalPrivacyControl, check the Sec-GPC header, and if either is set, do not load the tags. Then show the Opt-Out Request Honored message, and log the opt-out so you can prove it happened.

Test it the way a visitor would: open the site in Firefox with GPC on, and watch the network tab. If an advertising tag fires before you click anything, the site is not honouring the signal, and the banner is decoration. If nothing fires, and the message appears, the site is honouring it, and the banner is doing its job.

Frequently asked questions

Do I have to honour Global Privacy Control?

Yes, in California, Colorado, Connecticut, and a growing list of US states. California's CCPA regulations, section 7025, require businesses that sell or share personal information to treat the GPC signal as a valid opt-out for that browser or device, and for any profile linked to it. Since January 1, 2026, the business must also show whether it has processed the signal.

How does GPC work technically?

The browser adds the HTTP header Sec-GPC: 1 to each request and sets navigator.globalPrivacyControl to true for scripts on the page. Firefox, Brave, and DuckDuckGo support it, and extensions add it elsewhere. California's Opt Me Out Act, signed in October 2025, requires browsers to offer a built-in opt-out preference signal setting from January 1, 2027.

Is a cookie banner enough to honour GPC?

No. A cookie banner or cookie control tool, by itself, is not an acceptable way to process an opt-out of sale or sharing, under 11 California Code of Regulations section 7026(a)(4). The signal has to be honoured automatically, without asking the visitor to click anything.

How do I honour GPC on my site?

Check the signal before loading any advertising tag, and if it is present, keep those tags blocked and record the opt-out. Show a short Opt-Out Request Honored message, which the California Privacy Protection Agency cites as a compliant method. Do not ask the visitor to confirm: the signal is the confirmation.