Last updated: March 16, 2026

The Global Privacy Control (GPC) header represents a significant advancement in user privacy signaling on the web. Unlike its predecessor Do Not Track (DNT), GPC carries legal weight under several privacy regulations, making it a more practical tool for privacy-conscious users and developers alike.

What Is Global Privacy Control?

Global Privacy Control is an HTTP header that browsers send to indicate a user’s preference to opt out of data selling and targeted advertising. Unlike DNT, which was purely advisory, GPC has regulatory backing:

This legal recognition distinguishes GNC from earlier privacy headers and makes compliance more straightforward for businesses.

How the GPC Header Works

When a user enables privacy protections in their browser, every HTTP request includes the GPC header. The header value is straightforward:

Sec-GPC - 1

The Sec- prefix indicates this is a fetch metadata header, providing additional security context about the request.

Detecting GPC in JavaScript

You can check for GPC support using the navigator.globalPrivacyControl property:

if (navigator.globalPrivacyControl === true) {
  console.log('User has enabled Global Privacy Control');
  // Adjust tracking/personalization accordingly
}

This property returns true when the user has opted out, false when they haven’t, and undefined when the browser doesn’t support GPC.

Server-Side Detection

On the server, you can detect the GPC header in your request processing:

Node.js/Express:

app.get('/api/content', (req, res) => {
  const gpcValue = req.headers['sec-gpc'];

  if (gpcValue === '1') {
    // User has opted out of data sale
    // Disable analytics, personalization, and third-party sharing
    disableTracking(req.userId);
    disablePersonalization(req.sessionId);
  }

  res.json({ /* content */ });
});

Python/Flask:

@app.route('/api/content')
def get_content():
    gpc_header = request.headers.get('Sec-GPC')

    if gpc_header == '1':
        # Respect user's privacy preference
        disable_tracking()
        disable_personalization()

    return jsonify({ /* content */ })

PHP:

<?php
$gpc_value = $_SERVER['HTTP_SEC_GPC'] ?? null;

if ($gpc_value === '1') {
    // Respect privacy preference
    disable_analytics();
    disable_ad_tracking();
}
?>

Respecting GPC in Cookie Consent

If you manage cookies through a consent platform, GPC should override consent preferences:

function shouldBlockTracking() {
  // GPC takes precedence over cookie consent
  if (navigator.globalPrivacyControl === true) {
    return true;
  }

  // Fall back to cookie consent check
  return !hasCookieConsent();
}

Browser Support for Global Privacy Control

GPC support varies across browsers. Here’s the current space:

Desktop Browsers

Mobile Browsers

Browser Implementation Details

Users typically find GPC settings in:

Who Supports GPC? Companies and Platforms

The list of companies honoring GPC signals has grown significantly:

Major Platforms

Ad Networks and Trackers

Tools and Frameworks

Most modern consent management platforms (CMPs) respect GPC:

Implementing GPC on Your Website

If you run a website, here’s how to properly handle GPC:

Step 1 - Detect the Signal

Add server-side logic to check for the Sec-GPC header on incoming requests.

Step 2 - Disable Tracking

When GPC is detected, ensure you:

Step 3 - Communicate Compliance

Add a notice in your privacy policy acknowledging GPC support:

“We respect the Global Privacy Control (GPC) signal. When detected, we automatically disable all tracking, personalization, and data sharing that would constitute a sale under applicable privacy laws.”

Limitations of GPC

GPC isn’t a complete privacy solution. Be aware of these constraints:

  1. Geographic limitations: Legal requirements apply only in specific jurisdictions
  2. First-party tracking: GPC doesn’t block all tracking, just cross-site sharing
  3. Implementation gaps: Some companies still ignore GPC despite legal requirements
  4. No fingerprinting protection: GPC doesn’t prevent browser fingerprinting

Testing GPC Implementation

Verify your GPC handling works correctly:

Test with curl
curl -H "Sec-GPC - 1" https://yourwebsite.com

Check response headers for proper processing
Verify no tracking cookies are set

Browser developer tools also show the GPC header in the Network tab when making requests.

Frequently Asked Questions

Who is this article written for?

This article is written for developers, technical professionals, and power users who want practical guidance. Whether you are evaluating options or implementing a solution, the information here focuses on real-world applicability rather than theoretical overviews.

How current is the information in this article?

We update articles regularly to reflect the latest changes. However, tools and platforms evolve quickly. Always verify specific feature availability and pricing directly on the official website before making purchasing decisions.

Are there free alternatives available?

Free alternatives exist for most tool categories, though they typically come with limitations on features, usage volume, or support. Open-source options can fill some gaps if you are willing to handle setup and maintenance yourself. Evaluate whether the time savings from a paid tool justify the cost for your situation.

Can I trust these tools with sensitive data?

Review each tool’s privacy policy, data handling practices, and security certifications before using it with sensitive data. Look for SOC 2 compliance, encryption in transit and at rest, and clear data retention policies. Enterprise tiers often include stronger privacy guarantees.

What is the learning curve like?

Most tools discussed here can be used productively within a few hours. Mastering advanced features takes 1-2 weeks of regular use. Focus on the 20% of features that cover 80% of your needs first, then explore advanced capabilities as specific needs arise.

Related Articles