Privacy choices often repeat from site to site. One page asks whether personal information may be sold or shared, another hides the choice behind several menus, and a third uses different terminology. Global Privacy Control, usually shortened to GPC, is designed to carry one user-selected preference through the browser.
GPC is not an invisibility mode and does not block trackers by itself. It sends a request: do not sell or share my personal information with third parties. Websites are then responsible for interpreting and honoring that signal under the rules that apply to them.
What Global Privacy Control sends
When GPC is enabled, a supporting browser or extension can include the HTTP request header Sec-GPC: 1. Client-side code can also read the corresponding navigator.globalPrivacyControl value. The W3C Global Privacy Control draft defines both channels so a preference can reach the server with a request and remain available to the page.
The value 1 means the person has expressed the relevant do-not-sell-or-share preference. If the header is absent, the specification does not require the browser to send a zero. Absence can mean the user has not made a choice, the feature is unsupported, or the signal is not enabled. It should not be treated as enthusiastic consent.
Why a browser-level signal helps
A privacy preference is more useful when it travels consistently. Without a browser signal, people may have to locate and repeat an opt-out on every site. Cookies used to remember those choices can be cleared, partitioned, or unavailable on a new device.
GPC lets the user agent maintain the preference and present it automatically. The receiving site can process it as an active request rather than relying on a banner that many people dismiss without reading. This makes the choice easier to express at scale and less dependent on each site's interface.
GPC is not the old Do Not Track signal
Do Not Track, or DNT, also attempted to communicate a browser preference. Its central weakness was not the syntax; websites lacked a widely accepted obligation and common interpretation. Many services simply ignored it.
GPC is more narrowly framed around requests not to sell or share personal information and is designed to interact with privacy laws. The W3C work builds on lessons from DNT while specifying a modern header and JavaScript property. That does not make GPC universally binding everywhere, but it gives regulators and businesses a clearer technical signal to recognize.
Does a website have to honor GPC?
The answer depends on jurisdiction, the organization, and the processing involved. The technical specification does not create law. It defines how the preference is expressed and leaves legal effect to applicable frameworks.
In California, the Attorney General has described GPC as a browser setting or extension that automatically sends do-not-sell requests and has encouraged consumers to use it. The California Department of Justice guidance is one example of a regulator treating the signal as relevant to statutory opt-out rights. Other regions may use different definitions, thresholds, and enforcement rules.
Users should avoid reading the browser toggle as a promise that every site has complied. A signal can be transmitted correctly while a recipient mishandles it. Legal rights and remedies also differ across locations.
What GPC does not do
It does not stop network requests
GPC communicates a preference; it is not a content blocker. Analytics scripts, ad resources, and social widgets may still attempt to load. Tracker blocking works at a different layer by preventing known requests from reaching their destinations. Our guide to browser tracker blocking explains that distinction.
It does not erase existing data
The signal does not automatically delete account records, purchase history, messages, or data a business must retain for permitted purposes. Deletion and access requests are separate rights and may require a verified process.
It does not make you anonymous
Websites still receive an IP address and ordinary request metadata. Signed-in services know which account is active. Browser characteristics may contribute to fingerprinting, as covered in our browser fingerprinting guide. GPC addresses how data may be sold or shared; it does not conceal every identifier.
How websites can respond responsibly
A site can detect the header at the server before generating the response. It can then apply the preference across relevant advertising, sharing, and downstream processing systems. If scripts need the state, the browser-side property provides a consistent value for the active page.
Good implementation also includes a clear confirmation, durable internal records, and controls that do not pressure users to reverse the choice. Businesses should avoid claiming that a generic cookie banner overrides a browser-level signal where applicable law says otherwise. The exact compliance design needs qualified legal review for the regions in which the organization operates.
How to check your browser
Browser support and settings differ, so look in the browser's privacy section or official documentation for Global Privacy Control. MDN currently marks the Sec-GPC header as having limited availability across widely used browsers. If you use an extension, review its permissions and developer reputation before installing it.
A test page can show whether the signal is visible, but it cannot prove that every company will honor it throughout its systems. Keep the browser updated, combine the preference with request-level protections, and use site-specific privacy controls when a sensitive service needs a direct instruction.
A scalable expression of intent
GPC turns a repetitive privacy choice into a browser-level signal. Its strength is clarity and consistency: one affirmative preference can accompany visits instead of depending on dozens of separate interfaces. Its limits are equally important. It does not block tracking, erase data, or create universal legal rights. Used alongside tracker blocking, careful permissions, and accurate privacy information, it gives people a more practical way to state what they want.
Browse with more intention
Noorani brings prayer times, Qibla, tracker blocking, and privacy into one calm desktop browser built for how Muslims live online.