Global Privacy Control (GPC)

GPC operates as an HTTP header (Sec-GPC: 1) or a JavaScript DOM property (navigator.globalPrivacyControl). When enabled, the browser sends this signal with every outgoing request, eliminating the need for users to manually opt out on each individual website. This represents a shift from site-by-site consent management to a universal, set-and-forget privacy posture.

GPC introduces a precedence conflict with traditional Consent Management Platforms (CMPs). When a user has both a GPC signal enabled and a prior CMP consent record, the GPC signal should override any conflicting consent. Technical implementations must:

• Detect the GPC signal before firing consent-gated tags
• Suppress data sharing even if a CMP previously recorded 'consent granted'
• Log the GPC signal as a consent audit trail event for compliance documentation

Websites detect GPC through two primary methods:

Server-Side Detection:

• Inspect the Sec-GPC HTTP header on incoming requests
• Apply opt-out logic before any data processing occurs

Client-Side Detection:

• Query navigator.globalPrivacyControl via JavaScript
• If the value is true, disable all third-party tracking scripts and data sale APIs

Both methods should be implemented redundantly to ensure robust detection across all browser implementations.

GPC is the legally enforceable successor to the failed Do Not Track (DNT) header. Critical differences:

• DNT: Voluntary compliance; largely ignored by industry
• GPC: Mandatory compliance under CCPA/CPRA; backed by regulatory enforcement
• DNT: Used the DNT: 1 header with no legal weight
• GPC: Uses Sec-GPC: 1 and is recognized as a valid consumer request

This legal distinction transforms GPC from an advisory signal into a binding data subject right.

The deprecated predecessor to GPC. DNT was an HTTP header (DNT: 1) that expressed a user's tracking preference but lacked legal enforcement. GPC solves DNT's fatal flaw by being explicitly recognized in CCPA/CPRA regulations as a valid opt-out mechanism.

• DNT: Voluntary compliance, widely ignored by advertisers
• GPC: Legally binding signal under California law
• Both use browser-level signaling, but GPC adds a DOM property for script-based detection

The legal term used in CCPA § 1798.135 for a signal sent by a platform, technology, or mechanism that communicates a consumer's choice to opt out of the sale and sharing of personal data. GPC is the technical implementation of this legal concept.

• Must be in a format commonly used and recognized by businesses
• Must be persistent across sessions and websites
• Businesses must honor it as a valid consumer request without additional verification

A formal request by an individual to access, rectify, or delete their personal data. While GPC handles real-time opt-out signaling, DSARs address retrospective data rights. Both are pillars of data subject rights automation.

• GPC: Prevents future data sale/sharing automatically
• DSAR: Requires manual or automated fulfillment of access/deletion requests
• Privacy platforms often unify both workflows under a single identity graph

An immutable, time-stamped log recording the full history of a user's consent actions. When GPC is enabled, the audit trail must capture the exact timestamp the signal was received and the specific notice presented at that moment.

• Logs the Sec-GPC: 1 header receipt event
• Records the CMP's interpretation and downstream propagation
• Provides proof of compliance for regulators during enforcement actions