Opt-out signals
Global Privacy Control for WordPress
Global Privacy Control (GPC) is a setting in a visitor’s browser that tells every site they visit: don’t sell or share my personal information. A growing list of US states requires websites to treat it as an opt-out.
At a glance
- Sent by the browser on every visit, with no click on your site
- A valid opt-out of sale, sharing and targeted advertising in the states listed below
- Applies to that browser, and to the person’s account when they’re signed in
What GPC is
GPC is a proposed specification for letting people tell businesses their privacy preference once, in the browser, instead of on every site. It was introduced at the W3C Privacy Community Group in 2020. Brave, DuckDuckGo’s browser and Firefox support it, as do extensions such as Privacy Badger and Disconnect.
Technically, the browser sends a Sec-GPC: 1 header with each request and exposes navigator.globalPrivacyControl to scripts on the page, so a site can honor it on the server and in the browser.
Which states require it
These state privacy laws require businesses they cover to honor a universal opt-out signal such as GPC. Each links to its plain-English page.
| State | Law | Honor GPC from |
|---|---|---|
| California | California Consumer Privacy Act (CCPA/CPRA) | Aug 14, 2020 |
| Colorado | Colorado Privacy Act | Jul 1, 2024 |
| Connecticut | Connecticut Data Privacy Act | Jan 1, 2025 |
| Texas | Texas Data Privacy and Security Act | Jan 1, 2025 |
| Montana | Montana Consumer Data Privacy Act | Jan 1, 2025 |
| New Hampshire | New Hampshire Privacy Act | Jan 1, 2025 |
| New Jersey | New Jersey Data Privacy Act | Jul 15, 2025 |
| Minnesota | Minnesota Consumer Data Privacy Act | Jul 31, 2025 |
| Maryland | Maryland Online Data Privacy Act | Oct 1, 2025 |
| Oregon | Oregon Consumer Privacy Act | Jan 1, 2026 |
| Delaware | Delaware Personal Data Privacy Act | Jan 1, 2026 |
| Vermont | Vermont Data Privacy and Online Surveillance Act (Act 145) | Jan 1, 2028 Starts soon |
What honoring GPC means
When a covered business receives the signal, it treats it as a request to opt out of the sale and sharing of personal information, and of targeted advertising where the state’s law covers it. In California that applies to the browser or device, to any profile tied to it, and to the person’s account if the business knows who they are (11 CCR § 7025).
In practice that means advertising pixels and tags should not run for that visitor, and any data already tied to them should not be sold or shared.
Enforcement
In August 2022 California’s Attorney General announced a $1.2 million settlement with Sephora, which had failed to process opt-out requests sent through user-enabled global privacy controls.
How GoConsent handles it
A plain-English guide, last reviewed October 26, 2026. It isn’t legal advice. Read the sources below and talk to a lawyer about your situation.
FAQ
Questions, answered
Is Global Privacy Control the same as Do Not Track?
No. Do Not Track is an older browser setting that the state laws above don’t treat as an opt-out. GPC is the signal they recognize.
Does GPC turn off Google Analytics?
GPC is an opt-out of sale, sharing and targeted advertising. GoConsent keeps advertising off for GPC visitors; whether analytics runs follows your analytics setting and the visitor’s choice.
How can I test GPC on my site?
Visit your site in Brave or DuckDuckGo’s browser, or in Firefox with GPC turned on in its privacy settings. GoConsent shows a GPC notice on the banner when the signal arrives.
Set up privacy the right way today
Install GoConsent free from WordPress.org. No account, no visit limits, and nothing about your visitors leaves your site.
