Summarize this article with
Global Privacy Control is a browser signal that tells a business to stop selling or sharing a person's data, and it has been legally binding in California since 2023. Colorado has required it since 2024, and the CPPA voted in August 2026 to name GPC explicitly in the CCPA regulations.
The Global Privacy Control (GPC) specification offers a seamless way for users to opt out of data collection via browser settings. Enhancing user privacy, improving website transparency, and simplifying compliance with regulations like GDPR and CCPA, GPC is becoming essential for businesses. Let's explore GPC’s benefits, its regulatory impact, and practical steps for implementation.
What is global privacy control?
Global Privacy Control (GPC) is a technical specification that allows users to opt out of data collection via browser settings. Enhancing privacy, transparency, and compliance with laws like GDPR and CCPA, GPC sends universal opt-out signals, making it easier for individuals to protect their personal data across multiple websites.
With GPC, individual people can seamlessly opt out of every data collection request through their preset browser settings. GPC provides multiple advantages in data privacy control, such as:
- Empowering user privacy rights, with greater control over personal data
- Improving website transparency for visitors
- Streamlining compliance by minimizing the risks of policy loopholes
The Global Privacy Control standard empowers users to assert their rights based on various data protection regulations, such as the General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA). A growing coalition of privacy-focused organizations has supported the GPC initiative, including DuckDuckGo and The Washington Post.
What states require global privacy control?
California requires businesses to honor Global Privacy Control (GPC) signals under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA). Colorado has required businesses to honor GPC as a universal opt-out mechanism under the Colorado Privacy Act since July 2024. On August 6 and 7, 2026, the California Privacy Protection Agency (CPPA) voted unanimously to begin formal rulemaking that would name GPC explicitly inside the CCPA regulations, a move regulatory advisors expect will make GPC easier to recognize across the other states that already require some form of universal opt-out signal. For the full enforcement record behind that shift, see who actually honors Global Privacy Control today.
California Consumer Privacy Act: raising awareness for GPC compliance
The California Consumer Privacy Act (CCPA) was passed in 2020 and has remained a cornerstone for organizational privacy practices toward safeguarding consumer privacy rights. Failure to meet the regulations outlined by CCPA and CPRA regulations can lead to costly penalties, along with scrutiny of your company’s operations.
In 2022, the California General Attorney announced a settlement with French cosmetic retail brand Sephora due to the company's lack of disclosure in selling their customers’ personal information. Notably, the Sephora ruling is the first time a modern regulatory body has penalized a business for failing to enforce Global Privacy Control signals in their customer base.
Sephora Global Privacy Control
A third-party standard like GPC can help reduce a company’s risks of privacy violations by automatically conveying a user's opt-out consent signals to websites, providing seamless control over personal data. In this case, the California General Attorney issued Sephora a 30-day window period to resolve the violations, on top of $1.2 million in penalties.
The California Attorney General continues to issue warning letters to companies that fail to meet the CCPA’s strict requirement of providing a clear “Do Not Sell or Share My Personal Information” mechanism for data opt-out processes. Recently affected businesses include companies running mobile apps that appear to have violated CCPA clauses and the California Privacy Rights Act (CPRA), which branches from CCPA regulations.
The GPC team has collaborated closely with California's General Attorney office to make the technical specification legally binding based on CCPA regulations, going one step further than optional DNT plugins. Notably, Sephora's settlement addressed the brand’s lack of mechanisms for supporting user-enabled opt-outs, pointing to tools such as the GPC. The legal outcome of Sephora’s settlement shows that the GPC continues to gain attention as an essential privacy standard for modern governance practices.
Sephora set the template, but the largest CCPA settlement in California history builds directly on it. In February 2026, Disney agreed to pay $2.75 million after California's Attorney General found that Disney had honored GPC signals on the device where they arrived but kept sharing the same consumer's data through third-party ad tech embedded in its other apps and services.
The settlement requires Disney to honor an opt-out account-wide, across every service tied to a consumer's account, not just the browser or app where the signal was first detected. That's the standard every business now has to plan around: if you can link a person's devices or profiles by any reasonable means, the opt-out has to follow them everywhere, not just where it showed up.
Read the full technical breakdown of what failed in the Disney settlement.
Global Privacy Control signal instructions for consumers
Individual consumers can start using Global Privacy Control by downloading a web extension or browser compatible with the GPC signal. GPC directly integrates with Firefox, Brave, Abine, and DuckDuckGo privacy browsers and offers manual downloads of browser extensions. The manual option enables online users of other browsers, such as Safari, to quickly apply and benefit from the privacy protection provided by GPC. At a glance, compatibility with the most common browsers is as follows:
- Global Privacy Control Safari: No native integration. Download an extension to enable GPC.
- Global Privacy Control Chrome: No native integration. Download an extension to enable GPC.
- Global Privacy Control Firefox: GPC is directly integrated with Firefox. Get instructions here to enable.
You can check your browser's GPC status by visiting globalprivacycontrol.org, via an indicator at the top of the page that detects GPC activity.
When downloaded, GPC transmits its unique signal to participating websites so you can immediately opt out of any data sharing or selling request. With GPC activated, online users no longer need to manually consent to data opt-outs via individual website links. As such, GPC leads to a more secure, frictionless browsing experience.
Over 40 million users have used browsers or extensions with GPC support, resulting in an increasing number of websites and major publishers recognizing GPC as a legitimate opt-out signal.
Many individuals choose to leverage privacy-focused search engine extensions to protect their data online. One example of this is Privacy Badger, popular privacy extension that includes GPC signaling in their privacy controls for individual consumers.
How to implement Global Privacy Control compliance
Complying with Global Privacy Control (GPC) is essential for businesses aiming to respect user privacy and adhere to regulations like the CCPA and CPRA. By recognizing GPC signals, updating data management systems, and regularly reviewing privacy policies, companies can effectively manage opt-out requests and ensure robust data protection.
How to comply with global privacy control?
To comply with Global Privacy Control (GPC), businesses should:
- Update websites to recognize GPC signals from browsers.
- Ensure data management systems automatically process opt-out requests.
- Regularly review and adjust privacy policies to align with GPC and relevant laws.
This ensures seamless handling of user preferences and compliance with privacy regulations.
For instance, Ketch is a Data Permissioning programmatic privacy platform that can help you and your team enforce GPC implementation. The Ketch platform can enable you to enforce users’ Global Privacy Control choices in your downstream data systems and applications.
With Ketch in your corner, you can look forward to simplified privacy management that drives uncompromised data governance. The one-stop accessibility and advanced capabilities of the Ketch programmatic platform support privacy orchestration. Orchestration enables you to consistently maintain your company’s privacy posture across every touchpoint, online interaction, and jurisdiction without exception.
Begin your Ketch Demo to discover how you can structure your consent collection and enforcement processes to respect Global Privacy Control signals across your entire data ecosystem.
Read further: The 5 questions that expose fake privacy integrations
