Global Privacy Control (GPC)

GPC operates as a single, persistent HTTP header (Sec-GPC: 1) or a JavaScript DOM property (navigator.globalPrivacyControl). When enabled, it transmits a binary 'Do Not Sell or Share' preference to all websites. This eliminates the need for users to manually navigate individual consent banners, providing a frictionless, machine-readable assertion of their privacy rights under laws like the California Consumer Privacy Act (CCPA).

Unlike its predecessor 'Do Not Track', GPC carries regulatory weight. The California Attorney General has clarified that GPC constitutes a valid opt-out preference signal under the CCPA. This mandates that businesses subject to the law must detect and honor the signal as a legally binding request to stop selling or sharing personal data, transforming a browser setting into a compliance requirement.

The core logic of GPC—a universal objection to data sharing—is being extended to the AI training context. Advocates argue that a GPC signal should automatically instruct compliant web crawlers and foundation model trainers to exclude the user's data from training corpora. This positions GPC as a potential technical standard for enforcing Training Data Opt-Out at scale, bypassing the need for separate robots.txt negotiations.

GPC is not a third-party plugin; it is integrated directly into the browser engine. Leading browsers like Firefox and Brave offer native toggles, while others support it via extensions. This deep integration ensures the signal is sent at the network request level before a page loads, preventing race conditions where tracking scripts execute before consent is registered.

Enterprise Consent Management Platforms (CMPs) must now ingest and respect the GPC signal. When a CMP detects the Sec-GPC header, it should automatically suppress the firing of marketing tags, analytics scripts, and data-sharing pixels without displaying a consent banner. This creates a zero-touch compliance workflow, where the user's pre-configured preference overrides the site's default data collection logic.

While robots.txt governs crawler behavior for indexing and TDM, GPC governs data rights for individuals. A robots.txt disallow blocks a bot from accessing a path; GPC signals that even if data is accessed, it cannot be sold, shared, or used for training. They are complementary layers: robots.txt for site-wide asset protection, GPC for user-specific rights enforcement.

A standardized digital indicator—such as a browser setting, HTTP header, or account toggle—that communicates a user's consent choice regarding data usage to automated systems. GPC is the most prominent example of a preference signal for privacy, automatically broadcasting a 'Do Not Sell or Share' directive. Unlike one-off cookie banners, preference signals persist across sessions and domains, eliminating consent fatigue. The signal's legal weight depends on the regulatory framework; under CCPA, a GPC signal must be honored as a valid opt-out, while under GDPR, it can serve as an automated objection to processing.

A conceptual technical signal analogous to the deprecated 'Do Not Track' header, expressing a content owner's objection to automated data extraction for AI training. Unlike GPC—which focuses on personal data sales and sharing—Do Not Scrape targets web scraping bots that harvest publicly accessible content for foundation model pre-training. Currently, this signal lacks a universally enforced legal or technical standard. Implementation proposals include extending robots.txt with AI-specific directives or creating a new HTTP header that compliant crawlers would voluntarily respect, though adoption remains fragmented.

A legal provision under Article 21 of GDPR granting individuals the absolute right to object to the processing of their personal data for direct marketing or purposes based on legitimate interests. When invoked against AI training, this right compels data controllers to cease using personal data in model corpora unless they can demonstrate compelling legitimate grounds that override the individual's interests. GPC can serve as an automated, technical manifestation of this right, allowing users to exercise their objection at scale without submitting individual requests to every data controller.

A specific data subject right under GDPR Article 22 allowing individuals to refuse to be subject to solely automated processing—including AI profiling—that produces legal or similarly significant effects. This right is distinct from GPC's focus on data sales; it targets the output of AI systems rather than the input of training data. When combined with GPC, users can simultaneously opt out of having their data sold for training and refuse to be subject to the resulting automated decisions, creating a comprehensive privacy posture.

A centralized software interface that allows enterprises to capture, manage, and syndicate user consent preferences across digital properties. Modern CMPs are evolving to ingest GPC signals alongside traditional cookie consent, ensuring that AI training opt-outs are respected throughout the data supply chain. Key capabilities include:

• Signal ingestion: Detecting and honoring GPC headers
• Consent syndication: Propagating opt-out preferences to downstream data processors
• Audit logging: Maintaining immutable records of consent transactions for regulatory compliance

A legally binding contract between a data controller and a data processor that stipulates the specific scope, purpose, and security measures for data handling. Modern DPAs increasingly include explicit prohibitions on secondary AI training—preventing processors from using enterprise data to fine-tune their own foundation models. GPC signals add a technical enforcement layer: DPAs can mandate that processors must honor GPC opt-out preferences transmitted by end-users, converting a browser-level signal into a contractual obligation with financial penalties for non-compliance.