Global Privacy Control (GPC)

What is Global Privacy Control?

Global Privacy Control (GPC) is a browser setting that tells every website you visit not to sell or share your personal information. You turn it on once, instead of clicking an opt-out link on each site. Your browser then sends the signal as a header with each request, and websites can read it on their servers or in the page.

As of October 2026, Brave and DuckDuckGo turn it on by default, Firefox offers it in settings, and extensions add it to other browsers.

Under California's CCPA, GPC is not optional for businesses that sell or share personal information. They must treat it as a valid request to opt out of sale or sharing. The California Privacy Protection Agency says they must stop within 15 business days, cannot charge a fee or show pop-ups in response, and must apply it even when it conflicts with an earlier setting. Since January 2026, the regulations also require businesses to show whether they processed the signal.

California's Opt Me Out Act (AB 566) goes further. From January 1, 2027, browsers must offer a built-in opt-out signal, so more people will send one.

Why it matters to you

• A vendor that ignores GPC may be breaking the law. California's Attorney General fined Sephora $1.2 million in 2022, partly for not processing GPC opt-outs. In September 2025, California, Colorado and Connecticut regulators announced a joint investigation into businesses not honoring these signals.
• Your own site. If you run ad tracking pixels on your website, the same duty can apply to you.
• Your team's data. GPC is one of the few ways your employees can stop vendor sites from passing their data to ad partners.

What to check

• Search the vendor's privacy policy for "Global Privacy Control," "opt-out preference signal" or "GPC." The regulations require it to explain how signals are processed.
• Treat a policy that says the vendor ignores browser signals as a warning sign if it sells or shares data.
• Check whether the opt-out reaches logged-in accounts, not just one browser.
• Check whether your own website honors GPC before adding vendor pixels used for targeted advertising.

Do Not Track

Do Not Track (DNT) is an older browser setting that asked websites not to track you. It was created in 2009, but websites were never required to obey it, and few did.

The W3C group writing the standard closed its work in January 2019. Its final note says there had "not been sufficient deployment" to go further. Apple removed DNT from Safari in version 12.1, released in March 2019, saying the setting could be used to fingerprint, or identify, individual browsers.

DNT still shows up in privacy policies because of a California law. CalOPPA, the California Online Privacy Protection Act, requires a site that tracks visitors across other sites to disclose how it responds to DNT signals. It does not require honoring them, so a policy may simply say it does not respond.

GPC is different because the CCPA gives it legal force.

How Venpo helps

Venpo watches your vendors' privacy and cookie policies, and emails you a plain-English alert when language about opt-out signals, sale or sharing changes. The Fine Print Scan also answers whether each vendor sells your data or uses it for ads.