Global Privacy Control
A signal your visitors send before they say a word.
GPC is a setting in the browser. When it is on, every site the visitor opens is told they want out of the sale and sharing of their data. Twelve US states now treat that signal as a valid opt-out request. ConsentBit reads it and applies it, with nothing for the visitor to click.
Google-certified CMP · IAB Europe registered CMP (ID 502) · Webflow, Framer, WordPress and any website builder
First visit to your site
We value your privacy
We use necessary cookies to run this site. With your permission, we’d also like to measure traffic and show relevant ads.
Until they choose, only necessary cookies run. The floating icon reopens their settings any time.
The signal is read the moment the page loads.
The opt-out applies before the trackers run.
Not a law of its own, but the law stands behind it.
GPC is a technical specification, not a statute. Its weight comes from the state privacy laws that require businesses to honour an opt-out preference signal sent from a browser or device. California’s regulations go furthest: they spell out what counts as a valid signal and the duties that follow when one arrives
States requiring an opt-out signal
12
California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon and Texas, with Louisiana following in January 2027 and Vermont in January 2028.
California's rules name an HTTP header field and a JavaScript object as examples of an acceptable format
From 1 January 2027, browsers sold in California must include a setting that sends the signal
Five things the rules expect when the signal arrives
These come from the California privacy regulations on opt-out preference signals, the most detailed set written so far.
What the rules requires
Treat the signal as a valid request to stop the sale and sharing of personal information
How ConsentBit handles it
ConsentBit reads the GPC signal and applies it as an opt-out.
What the rules requires
Accept it in a format businesses commonly recognise, such as a JavaScript object
How ConsentBit handles it
ConsentBit reads the property the browser sets on the page. Nothing to configure on your side
What the rules requires
Ask nothing of the visitor first: no form, no account, no verification
How ConsentBit handles it
Nothing is asked. The signal is read as the page loads and the opt-out applies.
What the rules requires
Offer more than one way out if you sell or share data
How ConsentBit handles it
GPC is one. Reject all on the banner is the other, on the same page.
What the rules requires
Keep a record of the opt-out
How ConsentBit handles it
Every choice goes into the consent log with the date and time.
Two duties stay with you rather than the banner. California gives businesses fifteen business days to comply with an opt-out, and requires that any third parties you sold or shared the data with in the meantime are told to stop as well.
What a visitor sees, step by step
The point of GPC is that the visitor has already decided. The site is told, not asked.
They turn the setting on, once
In Firefox, Brave or DuckDuckGo it is a checkbox in the privacy settings. In other browsers it comes from an extension. The visitor does this once, not per site.
They land on your site
ConsentBit reads the signal as the page loads, before any optional script has a chance to run.
The opt-out applies
Selling and sharing stop for that browser. Analytics and Marketing scripts stay blocked.
It holds on every page
The signal is there on every page, so the opt-out does not depend on the visitor remembering anything.
WHAT GPC IS, AND WHAT IT ISN’T
A signal with teeth, unlike the last one.
Do Not Track asked politely and had no law behind it, so most sites ignored it. GPC is different. The California Attorney General calls it a valid consumer request that covered businesses must honour, and the state’s first CCPA settlement turned on a company failing to do exactly that.
Using a consent platform does not transfer the duty. In May 2025 the California Privacy Protection Agency fined a retailer $345,178 after its privacy portal was misconfigured and opt-out requests went unprocessed for forty days. The agency’s head of enforcement put it plainly: using a consent management platform does not get you off the hook for compliance.
Read on arrival, not after the fact
A GPC visitor never has to find your banner. Here is what loads for them.
Nothing waits for a click
The signal is there as soon as the page loads, so the opt-out does not depend on the visitor reading the banner, finding a link or filling anything in. That is the whole point of a universal signal.
The banner still has a job
GPC covers the visitors who have turned it on. Everyone else still needs the choice put in front of them, and California expects a second opt-out route in any case. The banner and the signal work together.
Want the full California picture? See what the CCPA requires →
Honour the signal automatically. Start free.
Records
A record of every opt-out, with the date it took effect
Every choice is recorded with when it was made and which categories the visitor accepted or rejected. You can export the log as a CSV file whenever you need it.
The visitor opted out, so advertising scripts were blocked.
The visitor didn’t opt out, so scripts ran as normal.
Consent log
Fifteen business days is the California deadline for acting on an opt-out. A log with dates is how you show you were nowhere near it.
GPC is a setting in a browser or extension that tells every website the visitor opens that they want to opt out of the sale and sharing of their personal information. It is sent automatically with each request, so the visitor sets it once instead of clicking an opt-out link on every site.
In the states that require businesses to recognise an opt-out preference signal, yes. California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon and Texas all do, with Louisiana following in January 2027 and Vermont in January 2028. The California Attorney General describes GPC as a valid consumer request that covered businesses must honour.
Do Not Track was a request with no legal backing, and sites were free to ignore it. GPC is named in California’s privacy regulations, which say what counts as a valid signal and what a business must do when it arrives. The difference is enforcement, not technology.
The California Attorney General’s own guidance names Firefox, DuckDuckGo and Brave, or a browser extension for browsers without it built in. From 1 January 2027, California’s Opt Me Out Act requires browsers sold in the state to include a setting that sends the signal, which will widen support considerably.
Yes. GPC only covers visitors who have turned it on, and it does not give anyone notice of what you collect. California also expects businesses that sell or share data to offer at least two opt-out methods, so the signal and a banner control sit alongside each other.
Not as a legal requirement. GDPR and the ePrivacy rules ask for consent before non-essential tracking, which is a stricter standard than an opt-out signal. A European visitor should be asked first either way.
See what GDPR requires →
Enforcement action. California’s first CCPA settlement, with Sephora in 2022, cost $1.2 million and turned on unprocessed GPC opt-outs. In September 2025 the California, Colorado and Connecticut Attorneys General ran a coordinated sweep of businesses failing to honour the signal, and the California Privacy Protection Agency has fined companies over broken opt-out flows since.
Yes. ConsentBit has a free plan, and every paid plan comes with a 14-day free trial. See pricing for what each plan includes. See pricing →
Catch the signal, before the trackers load
ConsentBit reads the GPC signal, applies the opt-out without a click, and keeps the record with the date it took effect.
This page is a general overview of the Global Privacy Control and the state rules that require businesses to honour it, not legal advice. Those laws cover far more than opt-out signals, and the list of states requiring one is still growing.