Global Privacy Control in 2026: Why a Browser Switch Is Now a Legally Binding Opt-Out, What Sec-GPC and Opt-Out Preference Signals Require Your Website to Do, and How to Test Whether Your Ad Tags Actually Stop
- Equipo de Internet Pros
- October 29, 2026
- Diseño Web
Este artículo está disponible solo en inglés.
For years, the "Do Not Track" setting in your browser did nothing. Websites could ignore it, and almost all of them did. Its successor, Global Privacy Control (GPC), looks the same: a single on/off switch that sends a signal with every page request. The difference is that a growing list of US state privacy laws now treats that signal as a legally binding opt-out. If your website runs ad pixels, retargeting tags or any third-party tracking, ignoring GPC in 2026 is a compliance risk that regulators are actively checking for, not just bad manners.
What GPC Actually Is
GPC is a small technical standard. When a visitor turns it on, the browser does two things:
- Every HTTP request carries the header
Sec-GPC: 1, so your server can see the preference before it sends anything back. - JavaScript on the page can read
navigator.globalPrivacyControl, which returnstrue, so tag managers and consent tools can react in the browser.
The signal means one thing: do not sell or share my personal information. Brave, DuckDuckGo and Firefox support it. Chrome, Edge and Safari do not have a native switch yet. It applies to every site the person visits, so they do not have to hunt for a "Do Not Sell" link on each one.
Do Not Track failed because no law required anyone to honour it. GPC is spreading because several laws now do. The protocol is almost the same; what changed is the legal weight behind it.
Why a Browser Signal Became a Legal Obligation
California went first. Regulations under the California Consumer Privacy Act (CCPA) require businesses to treat an "opt-out preference signal" as a valid request to opt out of the sale or sharing of personal data. In 2022 the California Attorney General settled with the retailer Sephora for $1.2 million. One of the main allegations was that the site ignored GPC while sending shopper data to advertising partners. That case made clear that the switch counts.
Other states followed. Colorado has required businesses to honour a recognised universal opt-out mechanism since July 2024 and officially recognises GPC. Connecticut, Texas, Oregon, Montana, New Jersey and others have similar rules in their consumer privacy laws, with effective dates spread across 2025 and 2026. California has also passed a law requiring browsers themselves to offer an opt-out preference setting by 2027. Once that takes effect, the share of visitors sending the signal will jump, because people will no longer need a niche browser to send it.
Enforcement has moved beyond warning letters. California's privacy agency and Attorney General have announced settlements over broken opt-out flows, cookie banners that did not actually stop tracking, and sites that made opting out harder than opting in. GPC handling is one of the first things an investigator can test: turn the switch on, load the page, and check whether the ad tags still fire.
What "Honouring GPC" Requires in Practice
| Requirement | What it means for your site | Common failure |
|---|---|---|
| Treat it as an opt-out | Stop selling or sharing that visitor’s data, including for cross-context behavioural advertising | The consent banner is updated but the ad tags still load |
| No extra friction | Do not ask the visitor to confirm, log in or fill in a form before applying the signal | A pop-up asking "Are you sure?" that resets the choice |
| Apply it on page load | Check the signal before any third-party script runs | Pixels fire first and the opt-out only applies on the next page |
| Link it to known accounts | If the visitor is logged in, apply the opt-out to their account, not just the browser | The opt-out is lost when the visitor switches devices |
| Show that it worked | Some states, including California, expect a visible confirmation such as "Opt-out request honoured" | The visitor cannot tell whether the signal was received |
Where Small Business Websites Usually Break
Most small and mid-sized sites do not sell data in the everyday sense. Under these laws, however, "sharing" for targeted advertising usually counts, and the tools that do it are already on the site: a Meta Pixel, a Google Ads remarketing tag, a TikTok pixel, an embedded chat widget, or a heatmap tool that sends session data to its vendor. These are the usual gaps:
- The consent tool is installed but not configured. Many consent management platforms support GPC, but the option is off by default or only switched on for EU visitors.
- Tags are hard-coded. A pixel pasted straight into the page template runs before the consent tool loads, so it never gets the chance to block it.
- Server-side tracking ignores the header. Moving tags to a server container does not remove the obligation. The
Sec-GPCheader reaches your server too, and the forwarding rules must check it. - The privacy policy says nothing. Several states expect your notice to explain how you process opt-out preference signals.
A Five-Minute GPC Self-Test
- Install Firefox or Brave and turn on Global Privacy Control in the privacy settings.
- Open the developer tools, go to the Console tab and type
navigator.globalPrivacyControl. It should returntrue. - Load your home page with the Network tab open and filter for facebook, doubleclick, googleadservices and tiktok.
- If any of those requests fire, your site is not honouring the signal.
- Repeat on a product page, the checkout or contact form, and the thank-you page, where conversion pixels usually live.
How to Fix It
The cleanest approach is to make the signal a gate, not an afterthought. In your tag manager, create a variable that reads navigator.globalPrivacyControl and add it as a blocking condition on every advertising and data-sharing tag. If you use a consent platform, turn on its GPC option for all US visitors, then repeat the self-test to confirm the tags actually stop. On the server, log the Sec-GPC header and exclude flagged sessions from any data sent to ad platforms through conversion APIs.
Analytics used only for your own measurement is generally treated differently from advertising sharing. Even so, review what your analytics vendor is allowed to do with the data. If its terms allow it to use your visitors’ data for its own purposes, regulators may treat that as sharing.
Finally, write it down. Add a short paragraph to your privacy policy that says you recognise GPC, explains what it does on your site, and gives a contact for questions. Keep a record of when you tested and what you found. If a regulator or a demand letter ever arrives, a dated test log is much stronger than "we thought the plugin handled it."
En resumen
Global Privacy Control turns privacy compliance from a link in the footer into a signal that arrives with every request. It costs almost nothing to honour and is easy for a regulator to test, so ignoring it is a poor risk to take. If your website runs advertising tags and you have never switched GPC on and watched what happens, now is a good time to try it.
Internet Pros builds and maintains websites with privacy built into the tag setup from the start. If you want your site checked for GPC handling, consent banner behaviour and stray tracking pixels, contact our team for a privacy and tracking review.
