Global Privacy Control
GPC signal / universal opt-out mechanism / browser opt-out signal
Global Privacy Control is a signal a web browser sends to every site a person visits, saying they do not want their personal information sold or shared. California's CCPA counts it as a valid opt-out request, and Colorado recognizes it as a universal opt-out, so covered businesses must honor it automatically.
Global Privacy Control is a setting or extension in a browser. Once it is on, the browser sends the signal to every website the person visits. The project's own site says the signal is meant to communicate a Do Not Sell or Share request under the California Consumer Privacy Act and similar state laws.
California treats it as a real request. The Attorney General's CCPA page lists opting out of sale or sharing, including via a user-enabled global privacy control, among consumer rights. After a business receives an opt-out request, it cannot sell or share that person's personal information unless they later authorize it again.
Colorado goes further in naming it. Under the Colorado Privacy Act, consumers can opt out of the sale of their personal data or its use for targeted advertising through a universal opt-out mechanism. The Colorado Attorney General says GPC was the first such mechanism recognized and is currently the only one it considers valid.
The difference from a Do Not Sell or Share link is scale. A link works one site at a time. The signal reaches every participating site at once, without the visitor clicking anything.
In practice
A furniture store covered by the CCPA runs advertising pixels that share visitor data with ad platforms. A visitor arrives with Global Privacy Control switched on in their browser. The site has to treat that visit as an opt-out request, which means the sharing that request covers stops for that visitor without them touching the store's opt-out link.
Not the same as
- Do Not Sell or Share link
- The link asks a visitor to opt out on one site by hand. Global Privacy Control sends that request automatically to every participating site the browser visits.
Why it matters to you
A site can have a correct Do Not Sell or Share link and still ignore opt-outs arriving as a browser signal. For a covered business running ad tracking, honoring the signal belongs in the website's code or consent tool. Ask whoever built the site whether it reads the signal and what changes when it does.
What to ask or check
- 01Does the website detect the Global Privacy Control signal, and what stops when it arrives?
- 02Does the consent or cookie tool treat the signal as an opt-out of sale and sharing?
- 03Is the business covered by the CCPA or the Colorado Privacy Act in the first place?
What people get wrong
That an opt-out only counts when someone clicks the Do Not Sell or Share link. The California Attorney General lists a user-enabled global privacy control as a way to request that businesses stop selling or sharing personal information.