Global Privacy Control

Global Privacy Control (GPC) is a set of web technologies that can be used to inform websites of the user's wish to have their information not be sold or used by ad trackers.^[1] Unlike the now-deprecated Do Not Track header, which was unsuccessful as it was ignored by third parties, GPC is intended to have legal force under privacy laws,^[2][3]

Global Privacy Control project logo

GPC was developed in 2020 by privacy technology researchers including Wesleyan University professor Sebastian Zimmeck and former Chief Technologist of the Federal Trade Commission Ashkan Soltani, as well as a group of privacy-focused companies including the Electronic Frontier Foundation, Automattic (owner of Tumblr and WordPress), and more.^[4]

Implementation

GPC has three implementations, two of which allow browsers to communicate preferences to web servers and web content, and the third allowing website operators to signal information about GPC compliance to the rest of the Internet.

The first is an HTTP header with the form

Sec-GPC: 1

The character '1' is the only allowed value for the header.^[5] There is deliberately no mechanism for extensibility; the creators of the standard have stated that they will create new headers if extension becomes necessary.^[6]

The GPC preference may also be signalled by the browser setting the gpcAtNavigation property of the top-level browsing context of loaded pages to the value true.^[7]

Finally, websites can optionally host a JSON-formatted file at the well-known URI .well-known/gpc.json to indicate how they respond to the GPC signal.

Adoption

GPC has been implemented by Mozilla Firefox,^[8] Brave,^[9] and DuckDuckGo Private Browser.^[10][9] GPC is not yet supported by Google Chrome^[11] or Microsoft Edge,^[9] despite Chrome still allowing users to enable the Do Not Track header.^[12] However, there are third-party extensions available for Chrome that enable sending the GPC header during HTTP requests, including the EFF's Privacy Badger extension^[13] and the DuckDuckGo Privacy Essentials add-on^[14] amongst others.

The New York Times and Washington Post have both implemented the signal.^[10] The GPC is supported by Firefox creator Mozilla^[15] as well as the California Attorney General.^[16]

Legal status

Unlike the Do Not Track header, GPC is a valid do-not-sell-my-personal-information signal according to the California Consumer Privacy Act (CCPA), which stipulates that websites are legally required to respect a signal sent by users who want to opt-out of having their personal data sold.^[16] In July 2021, the California Attorney General clarified through an FAQ that under law, the Global Privacy Control signal must be honored.^[16]

On August 24, 2022, the California Attorney General announced Sephora paid a $1.2 million settlement for allegedly failing to process opt-out requests via a user-enabled global privacy control signal.^[17]