Glossary
Global Privacy Control (GPC)
Global Privacy Control (GPC) is a browser-level signal (a header and JavaScript property sent with every request) that tells websites the visitor opts out of the sale or sharing of their personal information. Under the CCPA, businesses subject to the law must treat GPC as a valid opt-out: California's first CCPA enforcement action (In re Sephora, $1.2M) named ignoring the signal as a violation.
How it works
A visitor enables GPC once in a supporting browser or extension (Firefox, Brave, DuckDuckGo's extension, and others); the browser then sends 'Sec-GPC: 1' with every request and exposes navigator.globalPrivacyControl to page scripts. A compliant site detects the signal and suppresses data sale/sharing for that visitor (typically by switching ad and analytics tags into restricted modes) without requiring any clicks.
The legal weight comes from regulation: the CCPA regulations require honoring opt-out preference signals, and Colorado's CPA has recognized GPC as a universal opt-out mechanism. It is not a courtesy header; in covered states it is the opt-out, delivered mechanically.
Why most sites silently fail
Honoring GPC requires wiring nobody installs by default: the consent platform or tag manager must read the signal and actually change tracker behavior. Sites usually deploy tags first and consent tooling second, so the common state is a site that receives 'Sec-GPC: 1' and changes nothing: exactly the configuration the Sephora settlement punished. Because the failure is mechanical, it is also mechanically testable from outside.
How Complidar checks this
Complidar sends the GPC signal during scans and observes whether the site's tracking behavior changes, reporting a finding when trackers that constitute selling or sharing keep firing, with the Sephora settlement attached as the comparable case.
Related questions
Is honoring GPC legally required?
For businesses subject to the CCPA, yes: California's regulations require treating opt-out preference signals as valid requests, and the AG's Sephora action enforced exactly that. Colorado recognizes it too. Whether the statutes reach your business is a counsel question; what your site does with the signal is a test.
How do I check if my website honors GPC?
Enable GPC in a supporting browser, load your site, and inspect whether ad and analytics requests change, or run a scan that does it instrumentally. Complidar's check sends the signal and diffs the observed tracker behavior, which is the same evidence a regulator would look at.
Is GPC the same as Do Not Track?
Mechanically similar, legally opposite. Do Not Track never acquired legal force and was widely ignored; GPC was designed after the CCPA created a duty to honor opt-out signals, so in covered states ignoring it is a violation, not a choice. That difference is the whole point of GPC.
22 checks · up to 120 pages · no card
Last updated 2026-06-11 · Informational, not legal advice