Global Privacy Control is a single browser setting that tells every website you visit not to sell or share your personal data, and in a growing number of states, businesses are legally required to honor it. Turn it on once and the preference goes out automatically with every page you load, replacing the endless click-through of individual opt-out links. Enforcement is real: California has already collected a seven-figure settlement from a retailer that ignored the signal.
What GPC Actually Does
Under state privacy laws that recognize it, receiving the signal means a business must stop transferring your browsing data to advertisers, data brokers, and analytics companies.1State of California – Department of Justice – Office of the Attorney General. California Consumer Privacy Act (CCPA) That is the whole job. It is not a wall against tracking; it is a legally enforceable request that specific data flows stop.
Two boundaries matter before you rely on it.
First, GPC does not restrict what a website does with your data internally. A retailer can still track what you browse on its own site, remember your cart, and personalize your experience with first-party data. The signal is not intended to limit a first party’s use of personal information within the first-party context.2W3C (World Wide Web Consortium). Global Privacy Control (GPC) Explainer
Second, GPC is not cookie blocking. Browser features that block third-party cookies physically prevent tracking mechanisms from being stored on your device. GPC is a legal signal, not a technical barrier. If a site ignores it and you have no other protection enabled, your data still flows. Turning on both GPC and your browser’s built-in tracker blocking gives you the stronger position: one covers the law, the other covers the wire.
Which States Require Businesses to Honor It
There is no federal law behind GPC. Every requirement comes from a state statute, and the list has grown quickly.
California
California gave GPC legal force first. Under the California Consumer Privacy Act as amended by the California Privacy Rights Act, covered businesses must honor GPC as a valid consumer request to stop the sale or sharing of personal information.1State of California – Department of Justice – Office of the Attorney General. California Consumer Privacy Act (CCPA) Fines run up to $2,500 per unintentional violation and $7,500 per intentional violation, subject to annual inflation adjustments.3California Legislative Information. Cal Civ Code 1798.155 The California Privacy Protection Agency set the adjusted figures at $2,663 and $7,988 effective in 2025.4California Privacy Protection Agency. California Privacy Protection Agency Announces 2025 Increases for Administrative Fines
Colorado
Colorado’s privacy act directs the attorney general to establish technical specifications for universal opt-out mechanisms that communicate a consumer’s choice to opt out of targeted advertising and data sales.5Justia. Colorado Code 6-1-1313 – Rules – Opt-Out Mechanism Businesses must honor them, with enforcement through the Colorado Consumer Protection Act and fines of up to $20,000 per violation.
Connecticut
Since January 1, 2025, all businesses subject to the Connecticut Data Privacy Act must honor opt-out preference signals such as GPC. If a GPC signal conflicts with a prior consent (say, a loyalty program you joined), the business must still comply with the opt-out but may ask you to confirm your choice.6CT.gov. The Connecticut Data Privacy Act
Delaware, New Jersey, Oregon, Texas, and Montana
Oregon requires controllers to accept opt-out requests through universal opt-out mechanisms starting January 1, 2026.7Oregon Department of Justice. Privacy Law FAQs for Businesses Delaware’s Personal Data Privacy Act imposes the same requirement on the same date, and specifies that the mechanism must be consumer-friendly, require an affirmative choice, and let the business reasonably determine that the consumer is a Delaware resident.8Delaware Code. Chapter 12D – Delaware Personal Data Privacy Act New Jersey required controllers to honor universal opt-out mechanisms by July 15, 2025, naming Global Privacy Control by name as an example.9NJ Consumer Affairs. New Jersey Data Privacy Law FAQs Texas has recognized universal opt-out mechanisms since January 2025, and Montana’s provision took effect the same year.
More states are on the way as additional privacy laws take effect through 2026 and beyond.
Enforcement Is Not Theoretical
California’s attorney general brought the first major GPC enforcement action against Sephora in 2022, resulting in a $1.2 million settlement. Investigators found that activating GPC had no effect when consumers visited Sephora’s website: data continued flowing to third-party advertising and analytics companies because the site was not configured to detect or respond to the signal. After being notified of the violations, Sephora failed to cure them within the 30-day window the law provides, which triggered the formal action. The settlement required Sephora to honor GPC going forward and report its compliance efforts to the attorney general.
Turning On GPC in Your Browser
Which browser you use decides whether this is a two-second job, a menu dig, or an extension install.
Brave and DuckDuckGo: Nothing to Do
Brave was the first browser to ship native GPC support, and it is enabled by default for every user from the moment you install it.10Brave. Global Privacy Control, a New Privacy Standard Proposal DuckDuckGo does the same in both its mobile browser and its desktop extension.11DuckDuckGo Help Pages. Global Privacy Control (GPC) in DuckDuckGo
Firefox: One Checkbox
Firefox added GPC support in version 120 for desktop and version 122 for Android, but does not enable it by default in regular browsing.12Mozilla Support. Global Privacy Control On desktop, open Settings, go to Privacy & Security, scroll to Website Privacy Preferences, and check the box labeled “Tell websites not to sell or share my data.”
On Firefox for Android, tap Settings, then Privacy and Security, then Enhanced Tracking Protection, and toggle on “Tell websites not to share & sell data.” In private browsing on Android it activates automatically; in standard browsing you have to turn it on yourself.13Mozilla Support. Global Privacy Control in Firefox for Android
Chrome and Safari: You Need an Extension
As of early 2026, Google Chrome does not natively support GPC. Chrome’s development tracker shows the feature in active prototyping with an estimated target of 2026, and notes that California’s AB 3048 obligates browsers to provide GPC capability before 2027.14Chrome Platform Status. Global Privacy Control Safari does not appear to offer native GPC support either; Apple has not publicly committed to implementing the specification.
For both, install Privacy Badger from the Electronic Frontier Foundation. It sends the GPC signal by default to every site you visit and also blocks trackers it detects ignoring your preferences.15Electronic Frontier Foundation. Privacy Badger Once installed, no further configuration is needed.
iOS users have the fewest options. Safari on iPhone does not natively support GPC, and Apple’s restrictions on browser engines mean most iOS browsers run Safari’s rendering engine underneath. Using the DuckDuckGo browser or a Safari extension that supports GPC are the main workarounds.
Confirming the Signal Is Going Out
After you enable GPC, visit the official test page at globalprivacycontrol.org. It runs a diagnostic that checks whether your browser is sending the signal correctly. A positive result confirms your setup is working and that participating websites will receive your opt-out preference. If the test fails, check that your browser is updated to a version that supports GPC and that the setting or extension is actually enabled.