Global Privacy Control: the setting that quietly disables it

On this page

1. GPC is a request your server sees before your banner loads
2. California treats it as a real opt-out, and has fined for ignoring it
3. AB 566 turns GPC from a niche signal into a default one
4. The failure is usually a toggle, not an architecture
5. The signal has to survive past the consent layer
6. Do not fix this by gating everyone
7. Checking yours takes about a minute
8. What to do this quarter

Short answer: Global Privacy Control is a browser signal that California treats as a valid opt-out of the sale and sharing of personal information, so honouring it isn't a nice-to-have. Most consent platforms support it, and support is usually a per-banner toggle rather than an account-wide one — which means it can be on for the banner you tested and off for the banner that matters. Check the setting on every geo rule you run, not the dashboard summary. And check it soon: under AB 566, every web browser sold in California must ship an opt-out preference signal by 1 January 2027, so the number of visitors sending one stops being a rounding error.

GPC is a request your server sees before your banner loads

It arrives two ways, and both are set before any consent UI renders.

The first is an HTTP request header, Sec-GPC: 1, sent with the page request itself. The second is a JavaScript property, navigator.globalPrivacyControl, readable as true once the document exists.

That's the whole mechanism. There's no handshake, no callback, no vendor in the middle. A visitor with the setting enabled announces their choice on the way in, and every request after that carries it.

Which is exactly why it's awkward for a consent stack built around a banner. The banner's job is to collect a choice. GPC means the choice arrived before the banner did, and the banner's job is now to reflect a decision already made rather than ask for one.

California treats it as a real opt-out, and has fined for ignoring it

The California Attorney General's own guidance is direct: for businesses that collect personal information online, "one acceptable method for consumers to opt-out of sales or sharing is via a user-enabled global privacy control, like the GPC."

The regulations behind that are at 11 CCR § 7025, which defines an opt-out preference signal and describes what it does — it lets a consumer "opt-out of sale and sharing of their personal information with all businesses they interact with online without having to make individualized requests with each business."

This has teeth. The first CCPA enforcement action, announced on 24 August 2022, was a $1.2 million settlement with Sephora, and failure to process opt-out requests submitted via GPC was central to it. The same announcement disclosed notices sent to other businesses on the same grounds. Enforcement didn't stop there: the California Privacy Protection Agency's September 2025 announcement lists its decision requiring Todd Snyder to change practices and pay a $345,178 fine.

Worth being precise about scope, because this gets over-generalised. GPC carries this legal weight in California and in a handful of other US states with comparable opt-out statutes. It is not a GDPR mechanism, and honouring it in the EU does not substitute for a lawful basis there. If someone tells you GPC handles your European obligations, they are describing a different law.

AB 566 turns GPC from a niche signal into a default one

Here's the part that changes the maths on whether this is worth your afternoon.

In 2025 the Governor signed the California Opt Me Out Act, AB 566, sponsored by the California Privacy Protection Agency. CalPrivacy describes it as "the first law in the nation to require web browsers to include a built-in feature" that tells every site not to sell or share personal information. The deadline is stated plainly: "No later than January 1, 2027, all web browsers, whether accessed on a desktop or mobile device, must include OOPS."

Today, GPC mostly reaches you from people who sought it out — a privacy-focused browser, or an extension they installed deliberately. That's a small and unrepresentative slice of traffic, which is why a broken GPC implementation has been survivable.

From 2027 the setting ships in the browser your California visitors already use. Whatever share of them switch it on, it will not be a rounding error, and it will not be the technically-minded minority it is now. Any suppression logic that has never really been exercised is about to be.

The failure is usually a toggle, not an architecture

Most consent platforms support GPC. The configuration detail that matters is where the support lives: in many of them it's a property of the banner, not of the account. Run one banner for California and another for the rest of the US — which is the normal way to serve an opt-in and an opt-out experience side by side — and you have two independent GPC settings.

Internally these platforms tend to gate the signal on something equivalent to "GPC support is enabled" and "the browser is sending it". With the first half false, the second half never gets evaluated. No error, no warning, no visible difference. The banner renders, the geo rule fires, everything on the page behaves.

The signal has to survive past the consent layer

Getting the toggle right gets the CMP to register an opt-out. That is the start of the work, not the end of it.

The visitor's choice has to reach every place the data actually goes: the web container, the server container if you run one, the Conversions API, and any customer-list or audience export that leaves on a schedule rather than on a pageview. A suppression that holds in the browser and fails in a nightly upload is not a suppression.

Server-side setups deserve particular attention, because the request that reaches your server container has already lost the browser context unless you deliberately forwarded the consent state with it. If you're running one, what server-side tagging actually recovers covers what does and doesn't carry across that boundary.

Consent Mode is a related but separate mechanism, and it's worth not conflating them. It governs how Google's own tags behave once they know a consent state; GPC is one of the things that determines what that state is. Running Advanced Consent Mode does not honour GPC on its own, and honouring GPC does not configure Consent Mode — the difference between Basic and Advanced is a separate decision you still have to make.

Do not fix this by gating everyone

The failure mode on the other side is real, and it's expensive.

Under an opt-out model, the default is that data flows. Suppression applies to visitors who have opted out and visitors sending GPC — and nobody else. A setup that withholds data from everyone until they interact with a banner isn't a cautious reading of an opt-out law; it's an opt-in implementation wearing an opt-out label, and it will cost you conversion coverage across your entire California audience for no legal benefit.

That distinction is worth writing down before anyone starts changing settings, because "make it more private" is an instruction that quietly turns into "gate everything" unless someone specifies otherwise. If your Google Ads reporting matters to you, conversion tracking under consent is the other half of this conversation.

Checking yours takes about a minute

Do it in a fresh private window each time — a stored consent record from a previous visit will suppress the banner and hand you a false pass.

1. Turn GPC on. In Firefox, set privacy.globalPrivacyControl.enabled in about:config. Brave and DuckDuckGo's browser have it in privacy settings. CalPrivacy also points to extensions for browsers that don't yet ship it.
2. Load the page from the geography you care about. If you serve different banners by region, a test from the wrong region tells you about the wrong banner. This is the step most people skip, and it's the step that hides the fault above.
3. Read the consent state, not the banner. Most CMPs expose one in the console. You want the advertising and analytics categories showing as denied, and the opt-out control showing as already applied.
4. Then watch the network. Filter for your tag endpoints and confirm what stops. If the categories say denied and the requests still fire, the CMP registered the opt-out and nothing downstream acted on it — which is the scenario in the section above.
5. Repeat for every geo rule you run. One pass per banner. The whole point is that these settings are independent.

What to do this quarter

Find every banner your CMP serves, not just the default one, and confirm the GPC setting on each. Then test one from the region each banner targets, because a pass on the wrong banner is worse than no test — it's a false negative you'll trust.

After that, follow the signal past the CMP. Web container, server container, CAPI, scheduled exports. The question is never "did the platform record the opt-out", it's "did anything downstream change behaviour because of it".

And keep the scope honest in both directions. Suppress for opted-out and GPC visitors. Keep forwarding for everyone else. Over-gating is a defect with a cost, and it is the easier mistake to make once someone has been told to take privacy seriously.

If you'd like the per-banner check done properly across an estate, with the downstream path followed rather than assumed, that's the work we do.

Sources

1. 1.California Attorney General — Global Privacy Control (GPC) under the CCPA · Checked 2026-09-16
2. 2.Cal. Code Regs. Tit. 11, § 7025 — Opt-Out Preference Signals · Checked 2026-09-16
3. 3.California Attorney General — Settlement with Sephora, Inc. (first CCPA enforcement action) · 24 August 2022
4. 4.CalPrivacy — California's Opt Me Out Act (AB 566) · 15 January 2026
5. 5.California Legislature — AB 566 (Lowenthal), California Opt Me Out Act · Checked 2026-09-16
6. 6.California Privacy Protection Agency — enforcement announcements, including the Todd Snyder decision · 9 September 2025
7. 7.Global Privacy Control — specification and browser support · Checked 2026-09-16