What Is Global Privacy Control (GPC)?

Global Privacy Control (GPC) is a browser or device signal described in a current W3C Working Draft. It communicates a do-not-sell-or-share preference and, where applicable, an opt-out of cross-context targeted advertising. When supported, it is transmitted as an HTTP header (Sec-GPC: 1) and exposed through the JavaScript property navigator.globalPrivacyControl. GPC is not designed to exercise every privacy right; its legal effect depends on the applicable jurisdiction, business, signal, and purpose.

Firefox supports GPC through its privacy settings. Brave enables GPC by default on desktop and Android; Brave documents JavaScript-only GPC on iOS. DuckDuckGo browsers and extensions enable GPC by default, although some site exceptions can apply. DuckDuckGo documents GPC support in its Chrome and Edge extension, and Privacy Badger sends GPC on its supported browsers. Safari support is not universal, and Privacy Badger’s current compatibility guidance does not list Safari.

Recognition depends on the jurisdiction, covered business, signal configuration, and purpose of the opt-out. Current official materials in California, Colorado, Connecticut, Oregon, New Hampshire, and New Jersey address opt-out preference signals or universal opt-out mechanisms; Colorado’s public list specifically names GPC, while the other materials may use broader terminology. Check the current regulator or statute for the state and request at issue; this page does not treat a fixed state list as permanent.

California regulators have used enforcement actions to address failures involving opt-out preference signals and opt-out rights. An enforcement action is evidence about the facts and law in that matter; it is not a universal result for every business or signal. Read the current California Privacy Protection Agency materials and the applicable statute before drawing a legal conclusion.

No. GPC is not designed to exercise deletion rights. It communicates a do-not-sell-or-share preference and, where applicable, an opt-out of cross-context targeted advertising; it does not by itself delete data already held or change a public or other source record. To request deletion from a broker, use a separate request under the applicable law and provider process, such as CCPA § 1798.105 where it applies.

Mobile support is platform-specific. Brave documents GPC as enabled by default on Android and as a JavaScript-only signal on iOS. DuckDuckGo documents GPC in its iPhone/iPad and Android apps, with JavaScript sent broadly and HTTP-header support limited by platform constraints. Native iOS or Android apps that are not browsers do not automatically receive a browser GPC signal; their app-level tracking controls are separate.

Visit globalprivacycontrol.org, the page detects and displays your current GPC status ("GPC signal detected" or "not detected"). Alternatively, in browser dev tools console, type: navigator.globalPrivacyControl. A return value of true means GPC is active.

GPC has its clearest legal role in US state privacy frameworks that address opt-out preference signals or universal opt-out mechanisms. In the EU/EEA and UK, GDPR or UK GDPR rights remain context-specific: Article 21 provides a direct right to object to direct marketing and certain processing, while the W3C GPC draft describes GPC in other jurisdictions as a general request rather than a universal substitute for a direct request or consent choice.