Global Privacy Control (GPC) explained: browsers and state laws
What the Global Privacy Control signal is, which browsers send it, and which US states require sites to honor it, with the Sephora case and AB 566.
Global Privacy Control (GPC) is a browser setting or extension that sends a "do not sell or share my personal information" signal to every website you visit, so you do not have to opt out site by site. In California, Colorado, Connecticut and other states, covered businesses must treat that signal as a valid opt-out request. Firefox, Brave and DuckDuckGo send it natively. Chrome and Safari do not, according to the GPC project and Wikipedia as of late October 2026, so Chrome users need an extension such as Privacy Badger.
What Global Privacy Control does
GPC is a technical specification published at globalprivacycontrol.org. A browser with GPC switched on adds a signal to each request it makes. A site that sees the signal is meant to stop selling your data or sharing it for advertising across sites.
The project describes the signal as a request to opt out of sale or sharing under the California Consumer Privacy Act (CCPA) and similar state laws. In November 2024 it became an official work item of the W3C Privacy Working Group, so it is moving toward a formal standard but is not one yet.
Two limits are worth knowing:
- GPC is not a tracker blocker. It asks sites to change what they do with your data; it does not stop scripts from loading. Pair it with a blocker if you want technical enforcement.
- It applies to the browser or device where it is switched on, so you need it on each browser you use.
Which browsers send GPC
As of late October 2026, the GPC project lists these built-in and extension options.
Native support
- Brave: built-in support.
- DuckDuckGo Privacy Browser: built-in support, on by default.
- Firefox: available as a setting in the privacy options. You switch it on yourself.
Extensions
The GPC project names Disconnect, OptMeowt, Privacy Badger and lockrMail. Privacy Badger comes from the Electronic Frontier Foundation, and we cover privacy tools and rules in our Privacy section.
Chrome and Safari
The Wikipedia entry on GPC says Chrome (and Edge) have never supported GPC as a built-in setting, so Chrome users need an extension such as Privacy Badger. The same entry says Safari offered an optional setting only in prerelease versions and remains unsupported. Privacy Badger does not cover Safari, so on Apple devices the practical options are a browser that sends GPC, such as Firefox, Brave or DuckDuckGo. Vendors can change this with an update, so check your browser's current release notes.
How to check that GPC is on
- Turn the setting on. In Firefox, open Settings, go to Privacy and Security and look for the option that tells websites not to sell or share your data.
- Use a GPC test page. The GPC project's site reports whether your browser is sending the signal.
- Look at the privacy settings or cookie banner of a site you use. Some sites show a note that an opt-out signal was honored, but many do not.
If you use an extension, confirm it is enabled in every profile, and in private windows if you want the signal there too.
Which US states require businesses to honor it
No federal law requires GPC. The obligation comes from state privacy laws. The states below are the ones we checked against an official source or a reference summary in late October 2026; other states have passed similar provisions, so check the statute that applies to a given business.
- California: the Attorney General's CCPA page says covered businesses must honor a user-enabled global privacy control as a valid request to stop the sale or sharing of personal information.
- Colorado: the Colorado Attorney General lists a universal opt-out mechanism requirement effective July 1, 2024, and GPC is on its approved list.
- Connecticut: the Connecticut Attorney General states that controllers must honor opt-out preference signals under the Connecticut Data Privacy Act, effective January 1, 2025. The signal covers targeted advertising and sales of personal data, and civil penalties can reach $5,000 per violation.
- New Jersey and Oregon: a Wikipedia summary gives July 15, 2025 for New Jersey and January 1, 2026 for Oregon. Treat these as secondary-source dates and confirm them with each state's regulator.
The IAPP keeps a members-only state privacy legislation tracker that is a reasonable cross-check, since new laws and amendments appear every year. For the wider policy picture, see our Regulation section.
What businesses must do with the signal
The details differ by state. Connecticut adds a specific rule: if the signal conflicts with a consumer's earlier choice or loyalty program membership, the business must still honor the signal, but may ask the person to confirm what they want.
California AB 566: browsers must offer the setting from 2027
California's AB 566, known as the Opt Me Out Act, targets browser makers rather than websites. According to the Wikipedia summary, from January 1, 2027, businesses that develop or maintain a browser must include a setting that lets users send an opt-out preference signal. The article says this effectively requires GPC in browsers available to California residents.
That would matter most for Chrome and Safari, which have no released built-in setting. We could not retrieve the bill text from the Legislature's site, so read the chaptered bill for the exact scope and definitions before relying on this summary. Separately, the California Privacy Protection Agency lists opt-out preference signals as a preliminary rulemaking topic; its comment period closed on April 6, 2026, and its regulations page shows no final rule in late October 2026.
Enforcement: the Sephora case
The clearest GPC enforcement example is California's case against Sephora. On August 24, 2022, the California Attorney General announced a $1.2 million settlement. The office alleged that Sephora did not process opt-out requests sent through user-enabled global privacy controls and did not fix the problem within the CCPA's 30-day cure period.
The Attorney General's enforcement examples page describes other GPC-related cases without naming the companies, including online retailers and an electronics seller that did not process GPC opt-outs until they received a notice.
GPC versus other ways to opt out
GPC handles the sale and sharing of data when you browse. It does not delete data a company already holds, and it does not reach data brokers that never see your browser. California residents can use the state's deletion platform for that, covered in our guide to California DROP.
Frequently asked questions
Does Chrome support Global Privacy Control?
Not natively, as of late October 2026. Chrome users can send the signal by installing an extension such as Privacy Badger.
Does Safari support Global Privacy Control?
Safari has no released GPC setting, according to the Wikipedia entry on the specification. Privacy Badger does not run in Safari, so use Firefox, Brave or DuckDuckGo if you want the signal on a Mac or iPhone.
Does Firefox have GPC turned on by default?
Firefox offers GPC as a setting you enable yourself, according to the GPC project. DuckDuckGo sends it by default, and Brave includes built-in support.
Is a GPC signal legally binding?
In states such as California, Colorado and Connecticut, covered businesses must treat it as a valid opt-out request. Where no state law applies to a business, honoring it is voluntary.
What is an opt-out preference signal?
It is the legal term for a browser-sent signal, such as GPC, that tells a business you opt out of the sale or sharing of your personal data. GPC is the best-known example.