Global Privacy Control (GPC) is a browser-level signal that automatically tells every website the visitor wants to opt out of data sale, sharing, and targeted advertising. Developed by an EFF-led consortium in 2020, it replaces clicking "Do Not Sell" on every site. Under CCPA/CPRA, businesses must honor GPC as a valid opt-out. Sephora's $1.2 million settlement (2022) was the first major enforcement for ignoring it. Colorado, Connecticut, and other states require the same. Brave and Firefox ship it by default; Chrome and Safari don't. The EU hasn't formally recognized GPC as consent.