Global Privacy Control (GPC): What It Is and How to Honor It
The browser-level opt-out signal a growing number of US states require businesses to detect and respect automatically.
6 min read
The Global Privacy Control (GPC) is a browser-level signal that lets a person opt out of the sale and sharing of their data automatically, once, for every site they visit, rather than clicking a "Do Not Sell or Share" link on each one. For businesses, GPC is not optional where the law requires it: a growing number of US state privacy laws treat a GPC signal as a valid opt-out request you must detect and honor.
What GPC Is
GPC is a setting a person enables in their browser or a privacy extension. When they visit a site, their browser sends a signal indicating they are opting out of sale and sharing. It is the modern successor to the old "Do Not Track" idea, with one crucial difference: several state laws give GPC legal force, so ignoring it can be a violation.
Which Laws Require Honoring It
California enforces GPC as a valid opt-out, and a growing number of other state privacy laws either require honoring an opt-out preference signal or are moving that way. Because the list keeps expanding, the safe posture is to honor GPC across the board rather than trying to detect it only in the states that currently mandate it. Confirm the current requirements for the states you operate in.
How to Honor It Correctly
- Detect the signal on page load, before trackers that depend on consent fire.
- Treat it as an opt-out of sale and sharing, applying it to the data flows the law covers.
- Reflect it back to the user where appropriate, so the experience shows their choice was received.
The failure mode is the same as with any opt-out: detecting the signal but letting the tracking fire anyway. Honoring GPC means changing behavior, not just logging a preference.
How Concord Fits
Concord Privacy detects and honors the Global Privacy Control automatically, applying it to real-time tracker blocking so an opt-out signal actually stops the data flows it covers. As more states adopt opt-out-signal requirements, honoring GPC everywhere is handled by the platform rather than a per-state change.