Global Privacy Control (GPC)

GPC operates as a persistent HTTP header or JavaScript property (navigator.globalPrivacyControl) sent with every request. Once a user enables the setting in a supported browser or extension, the signal is always on, communicating a universal opt-out preference without requiring per-site interaction. This shifts the burden from the user to the data controller, who must detect and respect the signal.

A Consent Management Platform (CMP) must detect the GPC signal and propagate the opt-out status to downstream vendors. The standard interaction model dictates:

• If GPC is active, the CMP should suppress the sale of data by default.
• The CMP should not display a full consent wall if the user has already signaled a universal opt-out.
• The signal overrides conflicting legacy cookie preferences.

Websites detect GPC through two primary methods:

1. Server-Side: Checking for the Sec-GPC: 1 HTTP header on incoming requests.
2. Client-Side: Reading the navigator.globalPrivacyControl boolean property via JavaScript. The specification requires that the signal be sent at the top-level page load and to all embedded third-party iframes, ensuring ad-tech scripts also receive the opt-out.

Unlike the failed Do Not Track (DNT) header, which was a voluntary advisory signal with no legal weight, GPC is backed by regulatory enforcement. DNT was a binary DNT: 1 header that advertisers ignored. GPC is a legally defined mechanism within modern privacy legislation, making it a mandatory compliance vector rather than a polite request.

When a GPC signal is active, deterministic and probabilistic cross-device identity resolution must be suspended for the purpose of selling or sharing data. The signal does not necessarily break essential first-party operations (like fraud prevention), but it strictly prohibits the transfer of the user's behavioral profile to external ad-tech networks, directly limiting the scope of a Customer Data Platform (CDP) activation.

The deprecated predecessor to GPC. DNT was an HTTP header (DNT: 1) that expressed a user's tracking preference but lacked legal enforcement. GPC improves upon DNT by being legally recognized under CCPA and transmitted as a browser-level setting that cannot be overridden by individual sites, solving the voluntary compliance problem that doomed DNT.

The legal term of art used in regulations like the CCPA to describe a technical standard that allows a consumer to exercise opt-out rights with all businesses automatically, rather than on a site-by-site basis. GPC is the leading technical implementation of a UOOM, satisfying the requirement for a signal that is persistent, unambiguous, and consumer-controlled.