You reject the cookie banner on one site, tick “Do Not Sell My Personal Information” on the next, then run the same routine on the one after that. Global Privacy Control folds that whole chore into one browser setting you switch on a single time.
Global Privacy Control (GPC) is a browser setting that automatically tells every website you visit not to sell or share your personal data. Brave and DuckDuckGo send it by default; Firefox has a toggle; Chrome needs an extension. As of 2026, twelve US states legally require businesses to honor it.
What is Global Privacy Control?
Global Privacy Control is a signal your browser sends to tell every website you load not to sell or share your personal data. You set it once, and the browser repeats the request on every site you visit after that, with no pop-up and no per-site toggle to hunt for.
A coalition of privacy companies and groups, including Brave, DuckDuckGo, Mozilla, Abine, and the Electronic Frontier Foundation, published the first version in 2020. The specification advanced to W3C standardization in November 2024, and California’s privacy law now names GPC as a valid way to exercise your opt-out rights.
The value is leverage. One setting stands in for the thousands of individual opt-out clicks you would start and never finish. Instead of arguing with each cookie wall, you state your preference at the browser and let the browser make the case on every page.
How does the Global Privacy Control signal work?
Your browser attaches a short header to every request it sends. When GPC is on, each page load carries the HTTP header Sec-GPC: 1. The 1 means one thing: this person opts out of the sale or sharing of their data.
A site can read the same preference from JavaScript through the navigator.globalPrivacyControl property, which returns true when the signal is active, as Mozilla’s developer docs describe. Sites that honor the signal often publish a small file at /.well-known/gpc.json declaring that they respect it.
You never see any of this. The header rides along on the first byte of every request, before a cookie banner even finishes rendering. The website receives your opt-out at the same moment it receives your visit.
Which browsers support Global Privacy Control?
Three browsers send GPC without an add-on; the rest need an extension until 2027. Here is where each one stands as of 2026.
| Browser | GPC support | What you do |
|---|---|---|
| Brave | Built in, on by default | Nothing; confirm it in Settings |
| DuckDuckGo (browser + extensions) | Built in, on by default | Nothing |
| Firefox | Built in, off by default | Flip one toggle in Settings |
| Google Chrome | None natively | Install an extension |
| Microsoft Edge | None natively | Install an extension |
| Safari | None natively | Install an extension |
Bottom line: if you already run Brave or DuckDuckGo, you are covered without lifting a finger. Firefox users need one click. Chrome, Edge, and Safari users need an extension for now, though that gap closes in 2027 when a new California law forces every browser to include the signal.
How do I turn on Global Privacy Control?
Switching GPC on takes seconds, and the steps depend only on which browser you use.
- Brave. It is already on. To confirm, open Settings, go to Privacy and security, and check that Global Privacy Control is enabled.
- DuckDuckGo. It is on by default in the DuckDuckGo browser and its extensions. There is nothing to change.
- Firefox. Open Settings, choose Privacy and Security, scroll to the Website Privacy Preferences section, and tick “Tell websites not to sell or share my data.”
- Chrome, Edge, or Safari. Install a GPC extension. The EFF’s Privacy Badger, OptMeowt, and DuckDuckGo’s add-on all send the signal. Add one, and your browser starts opting you out.
Once GPC is active, your browser attaches Sec-GPC: 1 to every request without another prompt. In the states that recognize it, that single flag now carries the weight of a formal opt-out request.
Is Global Privacy Control legally binding?
In a dozen US states, yes. A business that ignores your GPC signal in those states breaks the law. As of January 1, 2026, twelve states require businesses to honor universal opt-out signals: California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, and Texas. California, Colorado, and Connecticut have explicitly confirmed that GPC qualifies.
Enforcement is not theoretical. In 2022, California’s Attorney General reached a $1.2 million settlement with Sephora, the state’s first public CCPA enforcement, partly because the retailer failed to process opt-outs sent through user-enabled global privacy controls. The settlement forced Sephora to start honoring GPC going forward.
The signal is about to get harder to ignore. California’s Opt Me Out Act, signed in October 2025, requires every browser offered to state residents to include the opt-out signal from January 1, 2027, the first browser mandate of its kind. For the wider wave of 2026 privacy rules, see the new privacy laws taking effect this year.
This is a plain-language explainer, not legal advice. If a business ignores your opt-out and you want to act on it, check your state regulator or a lawyer in your jurisdiction.
How is GPC different from Do Not Track?
GPC is enforceable; Do Not Track never was. Do Not Track, which browsers rolled out around 2009, was a voluntary request that a site could read and then ignore with no consequence. Most sites ignored it, the industry never agreed on what honoring it meant, and the W3C eventually stopped work on the standard.
GPC carries the same idea with a spine. Several state privacy laws treat a GPC signal as a binding opt-out request, so a business subject to those laws cannot legally shrug it off. The difference is not the technology, which is nearly as simple as Do Not Track was. The difference is that a regulator can now fine a company for disregarding it.
Does Global Privacy Control unsubscribe me from emails?
No. GPC governs what websites do with your data, not what lands in your inbox. It cannot remove you from a mailing list, silence a newsletter, or cancel a subscription. It tells sites not to sell or share your personal information, which targets the data-broker economy this blog mapped in how marketers track you beyond the pixel, not the senders crowding your mail.
Email opt-out runs on a separate track with its own rules, which vary by where you live. Those are the CAN-SPAM and GDPR-style regimes covered in unsubscribe laws by country. GPC and email unsubscribing solve two different problems, and turning one on does nothing for the other.
To clear the email flood you still have to leave each list. Email Unsubscriber scans your Gmail or Outlook in your own browser, lists every sender still mailing you, and fires the real one-click opt-out where the sender supports it. The scan runs on your device, and we never read, analyze, or monetize your email content. It is a one-off payment, with nothing to cancel. Switch on GPC for the web, and clear your inbox separately. Together they cover both halves of the same instinct: keep your data yours.
