What is Global Privacy Control, and do you have to honour it

Global Privacy Control is a signal your visitor's browser sends on every request, saying do not sell or share my personal data. It is not a preference you get to weigh up. In most US states that have a comprehensive privacy law, California included, honouring it is legally binding, and ignoring it has already drawn enforcement.

What the signal actually is

Global Privacy Control is an open technical standard rather than a product. A visitor turns it on once, in a browser that supports it or through an extension, and from then on every site they visit is told the same thing automatically.

It arrives two ways at once. Each request carries a Sec-GPC: 1 header, and the page can read navigator.globalPrivacyControl, which returns true. Brave, Firefox and DuckDuckGo ship it, Chrome and Safari do not, and extensions cover the rest. On your side, publishing /.well-known/gpc.json is how you declare that you honour it.

The detail that matters most is the one glossaries leave out: the signal is already there before your banner has rendered anything. Nobody clicked. There is no dialogue to interpret and no interaction to wait for. Your consent layer either looks for it at the start of the page or never sees it at all.

denied by the opt outmay continue

Do you have to honour it

In the United States, usually yes. California has treated universal opt out mechanisms as binding since January 2023, and Colorado, Connecticut, Texas, Oregon, Montana and Delaware followed as their laws came into force. A minority of states with comprehensive privacy laws, Virginia and Utah among them, do not require it. That list keeps moving, which is a good argument for honouring the signal everywhere rather than maintaining a map of where you may safely ignore it.

It is not theoretical. California's Attorney General has brought enforcement actions that turned on businesses failing to process opt out signals, and the fact pattern is easy to prove from the outside: send the signal, watch the advertising requests leave anyway.

In the EU and UK the answer is different, because the legal model is. GDPR needs prior opt in consent, so a browser signal expressing refusal cannot supply the permission you still have to ask for. Honouring GPC there is good practice rather than an obligation, and it changes nothing about whether you need a banner in the first place.

Where GPC and your banner disagree

This is the part that quietly breaks in production. A visitor accepted everything last month, so your consent layer has a stored record saying yes. Today they arrive with the signal switched on. Which instruction wins?

Under the California rules, the opt out does, for sale and sharing. The signal is the fresher instruction and it has to be treated as a valid request from the person, not as advice competing with your own cookie. Plenty of implementations get this backwards: they read their stored consent state first, find a decision, and never look at the header. Nothing errors, the banner behaves normally, and the site keeps sharing data for a visitor who has told it not to.

How to check whether your own site honours it

1. Switch the signal on in a browser

   Brave, Firefox and DuckDuckGo can send Global Privacy Control natively, and an extension adds it to the rest. Turn it on in one browser and keep a second browser without it, so you always have a control to compare against.

2. Confirm the signal is actually leaving the browser

   In the console, navigator.globalPrivacyControl should return true. In the network panel, the document request should carry a Sec-GPC: 1 header. Check this before you judge your site: a setting that looks enabled but sends nothing has wasted plenty of afternoons.

3. Watch what your consent layer does with it

   Load the page with the signal on and read the consent state your tags receive. The advertising signals should already be denied on the very first page view, before anyone touches the dialogue. If your consent layer only reacts to clicks, it never saw the header at all.

4. Test the conflict case, which is where it usually breaks

   Accept everything, then reload with the signal on. In California the fresher instruction wins for sale and sharing, so a stored acceptance from last month must not override an opt out arriving today. Consent layers that read their own cookie first and never re check the header fail exactly here, silently.

5. Check the disclosure as well as the behaviour

   Publish /.well-known/gpc.json so the signal can be confirmed programmatically, and say in your privacy notice that you honour universal opt out mechanisms. Honouring it without saying so leaves you explaining an implementation detail to a regulator instead of pointing at a page.

What the opt out costs your measurement, and what it does not

Here is where most coverage of GPC stops, and it is the half our clients actually ask about. A rejection in Europe and an opt out in California are not the same event, and treating them identically throws away data you were never asked to give up.

A GPC opt out is scoped to the sale and sharing of personal data for targeted advertising. Mapped onto Consent Mode v2, that means ad_storage, ad_user_data and ad_personalization go to denied, while analytics_storage can stay granted, depending on how your own analytics is characterised under the applicable state law. So the loss lands on remarketing audiences, enhanced conversions and advertising attribution. Your traffic reporting largely survives, which is not true of a European reject all.

Two failure modes come out of getting that scope wrong, and we see both. The first is the blunt one: a consent layer maps the signal onto a blanket denial, and analytics that was never in question goes dark for a slice of US traffic nobody can identify afterwards. The second is worse, because it looks fine: the dialogue honours the signal in its own interface, the preference centre shows opted out, and the advertising tags were never wired to the consent state, so they keep sending regardless. The only way to tell those apart is to watch the requests, which is step three above.

The short version

Treat it as a valid opt out, read it before your banner decides anything, let it override a stored acceptance, and map it to the advertising signals rather than to everything you measure. That is the whole obligation, and it is a smaller change than the legal framing suggests.

Velo reads the signal at the top of the page, before the dialogue is drawn, maps it onto the v2 consent signals, and records that it was honoured, which is the part you will want on hand if anyone ever asks. If you are still working out which of these jobs belongs to your consent tooling at all, our explainer on what a consent management platform actually does is the place to start.

Common questions