What Is Global Privacy Control (GPC), and Why Should You Care?

You click through endless cookie pop-ups, tweak your privacy settings, and install an ad blocker. You try to do all the "right" things to protect your online privacy, but you worry that your data is still being collected and shared.

Global Privacy Control (GPC) is one of the first tools to advocate for your privacy. It lets your browser do the work for you automatically. GPC tells websites that you don't want your data sold or shared. And here's what really matters to everyday internet users: It's legally enforceable in over 10 U.S. states.

Keep reading to learn more about GPC and how you can start using it today.

What is Global Privacy Control?

Global Privacy Control (GPC) alerts every website you visit that you don't want to sell or share your personal data. It's like hanging a "do not disturb" sign on your internet traffic. Once you put up the sign, everyone knows your data is off-limits.

You can enable GPC in supporting web browsers or by installing an extension. Once turned on, your browser will share a small signal in either the HTTP header or the DOM. The signal tells visited websites that you're opting out of data selling and sharing. It works in the background, so you don't have to worry about doing this manually for every site.

Websites that recognize GPC, or are legally required to do so, will honor the request. They will not share or sell personal information with third parties. They also won't use the data for cross-context targeted advertising.

GPC was created by a coalition of privacy-focused organizations, including the Electronic Frontier Foundation, Mozilla, Brave, and DuckDuckGo, as well as major publishers, like the New York Times and Washington Post.

How is GPC different from “Do Not Track”?

The biggest difference between GPC and "Do Not Track" (DNT) notifications is the legal compliance. Websites were never forced to honor DNT requests. GPC changes enforcement.

As of 2026, 11 states now legally require businesses to honor universal opt-out signals like GPC, with California, Colorado, Connecticut, and New Jersey explicitly naming GPC.

Eight states enforce data privacy laws regarding the mandatory inclusion of opt-out mechanisms for consumers: New Hampshire, Delaware, Iowa, Nebraska, New Jersey, Tennessee, Minnesota, and Maryland.

These privacy laws change the landscape from general requests to real-life consequences.

Another notable difference is that GPC works in the background. Once you turn on the GPC signal, all sites you visit are notified that you are opting out of tracking and data sharing. It doesn't matter whether the site asks for your permission to track you. GPC will let them know, so you never have to think twice about it.

DNT works differently. Because it was never enforced, many websites simply never asked. It left you without the opportunity to opt out. GPC was created to fix that problem.

	Do Not Track (DNT)	Global Privacy Control (GPC)
What it does	Vague request to not get tracked	Specific request to not sell or share data, and not to use it for targeted ads
Legal enforcement	Not supported by major privacy laws. Sites aren't required to honor requests.	Referenced in several modern privacy laws. Covered sites are required to honor requests.
Real‑world effect	Mostly ignored	Actually triggers opt‑outs where the law applies
Adoption & history	Old standard that never gained popularity	New standard gaining legal recognition

Why does GPC matter now?

GPC is gaining traction within the legal world. As of 2026, 4 U.S. states (California, Colorado, Connecticut, and New Jersey) have issued guidance that GPC is legally binding. Other U.S. states also support GPC because consumers are entitled to opt out under state-level privacy laws.

And it's not just pretty words with no real meaning. Companies have already faced legal consequences:

• Healthline Media: In July 2025, Healthline paid a $1.55 million settlement to California after its opt-out mechanisms, which include GPC signals, were found to be misconfigured, allowing consumer data to continue flowing to advertising partners even after users had opted out.[1]
• Tractor Supply Company: In September 2025, the California Privacy Protection Agency issued Tractor Supply Co. a $1.35 million fine after finding the company’s website had not recognized or honored GPC signals at all until July 2024, and that its opt-out webform also failed to stop data sharing through third-party tracking technologies.[2]
• Disney: In February 2026, Disney paid a $2.75 million settlement — the largest CCPA penalty ever — after California found that its GPC opt-outs applied only to the specific device that sent the signal, not to the user's account across all their devices and streaming services.[3]

In addition to holding companies accountable, California is also raising the bar for browsers themselves. In October 2025, Governor Newsom signed the Opt Me Out Act (AB 566), which requires web browsers operating in California to offer a built-in, easy-to-use opt-out preference signal — effectively mandating that tools like GPC become standard features in every major browser. The law takes effect in January 2027.

What does GPC actually do (and what doesn’t it do)?

GPC is a genuinely useful tool, but it doesn't cover everything related to user privacy. Here's a quick look at what it does:

GPC does:

• Tell websites not to sell or share your personal data with third parties.
• Opt you out of cross-context targeted advertising.
• Carry legal weight in 4 U.S. states. (though 8 states have laws entitling consumers to opt out via universal opt-out mechanisms, but haven't specifically named GPC)

GPC doesn't:

• Opt you out of all non-essential cookies
• Delete data that was collected previously
• Replace other privacy tools, such as virtual private networks (VPNs) or ad blockers
• Apply to every U.S. state or get recognized internationally
• Apply under GDPR — Europe's privacy framework requires opt-in consent, not opt-out, so GPC has no guaranteed legal force in the EU

How to enable Global Privacy Control

You can enable GPC by using a supported browser or downloading an extension.

Private browsers with built-in GPC tools include Brave, DuckDuckGo, and Firefox. Brave and DuckDuckGo have GPC enabled by default. If you want to use GPC in Firefox, you'll need to enable it. You can do that by:

• Go to Settings.
• Choose Privacy & Security.
• Enable "Tell websites not to sell or share my data."

Chrome, Edge, and Safari don't support GPC. You'll need to download a privacy browser extension like DuckDuckGo Privacy Essentials or EFF’s Privacy Badger. Learn more about these privacy extensions in our reviews:

• DuckDuckGo review
• Privacy Badger review

Bottom line

GPC is a great privacy tool to protect you from companies that want to harvest your data and share it with third parties. It's free and easy to use with supported browsers like Brave, DuckDuckGo, and Mozilla Firefox.

Using a GPC-native browser is the easiest way to start protecting your data today. You can also download browser extensions such as DuckDuckGo Privacy Essentials or Privacy Badger to enable GPC in your preferred browser.

While not legally enforced nationally, GPC is a growing trend in user privacy laws. It doesn't solve every privacy problem, but it's a good step forward. As more states adopt and enforce privacy laws, GPC will matter more to users and companies in the future.

FAQs