Does your website honor Global Privacy Control?
A growing number of visitors arrive with a browser setting that says "don't sell or share my data." Several US states require websites to treat it as an opt-out, and regulators have started checking. Here's how to tell whether your site actually responds to it.
The short answer
Global Privacy Control (GPC) is a signal the visitor's browser sends to every site. Where state law requires it, your site should treat it as an opt-out of selling or sharing data and of targeted advertising, without the visitor clicking anything. In practice, that means your advertising tags shouldn't fire, or should run in their restricted mode. Test it with GPC turned on in your browser and watch which tags still send data.
On this page
What GPC is
GPC is a privacy setting in the browser, not on your site. When it's on, the browser sends a Sec-GPC: 1 header with each request and exposes navigator.globalPrivacyControl to the page, so your consent banner can read it.
Brave and the DuckDuckGo browser send it by default. Firefox lets people turn it on, and extensions add it to other browsers. Chrome, Safari and Edge don't build it in yet, but California's Opt Me Out Act (AB 566) requires browsers to offer an opt-out signal like this by January 1, 2027. Expect many more of your visitors to send it next year.
Where it's required
As of November 2026, at least 12 states expect businesses covered by their privacy laws to honor opt-out signals like GPC: California, Colorado, Connecticut, Texas, Montana, New Hampshire, Nebraska, New Jersey, Minnesota, Maryland, Delaware and Oregon. More are scheduled for 2027. Each law has its own thresholds for which businesses it covers.
Regulators are looking. In September 2025, the California Privacy Protection Agency and the attorneys general of California, Colorado and Connecticut announced a joint sweep of websites that may not be honoring GPC.
Whether these laws apply to your business, and what your opt-out has to cover, are questions for your counsel. I handle the technical side: whether the site does what you've decided it should.
What honoring it looks like on the site
When a visitor arrives with GPC on, and the law applies:
- Advertising tags respect it. The Meta pixel, Google Ads remarketing, TikTok and similar tags don't fire, or fire in their restricted mode.
- Google Consent Mode reflects it. The advertising settings,
ad_storage,ad_user_dataandad_personalization, are set to denied. - The visitor doesn't have to click. The banner can show that the opt-out was applied, but the signal itself is the request.
- Server-side tags respect it too. If purchases go to Meta through the Conversions API or through a server-side container, those need to check the same opt-out. A blocked pixel doesn't stop a server from sending.
How your analytics tags should behave depends on how they're set up and what your counsel decides.
Where it usually breaks
The banner says the right thing, but the tags don't follow. The common causes:
- The CMP setting is off. GPC support is often a separate setting, a regional rule or a higher plan. Across the platforms I've set up for clients, including Termly, Cookiebot, Osano, CookieYes, Usercentrics, OneTrust and Kukie, the setting lives somewhere different in each one. Test the result rather than trusting the toggle.
- Tags don't wait for consent. In Google Tag Manager, tags without consent checks fire regardless of what the banner decided.
- Tags live outside Tag Manager. Hard-coded pixels and Shopify or WordPress apps can load on their own and ignore the banner.
- Only California is covered. The rule is set for one state while visitors arrive from others that also require it.
- The server keeps sending. The browser pixel stops, but Conversions API or server-side events carry on.
How to test your site
- Turn GPC on. Use Brave, or turn on GPC in Firefox's privacy settings.
- Confirm the signal. Open the browser console on your site and type
navigator.globalPrivacyControl. It should returntrue. - Load the site fresh, in a private window, and don't touch the banner.
- Check Consent Mode in Google Tag Assistant. The advertising settings should be denied.
- Watch the network. In the browser's developer tools, filter for advertising requests such as
facebook.com/tr,doubleclick.net,googleadservices.comandanalytics.tiktok.com. With GPC on and the law applying, they shouldn't send identifiable data. - Complete a test conversion, such as a form fill or purchase, and check whether Meta Events Manager or Google Ads received it from the server side.
- Turn GPC off and repeat, so you can see the difference.
| Check | What you should see |
|---|---|
navigator.globalPrivacyControl in the console | true |
| Consent banner | Opt-out applied without a click |
| Google Consent Mode | ad_storage, ad_user_data and ad_personalization denied |
| Browser advertising requests | Not sent, or sent in restricted mode |
| Server-side and Conversions API events | Held back for this visitor |
