Global Privacy Control: What It Is and How to Turn It On

Global Privacy Control (GPC) is a setting in your browser that sends a signal to every website you visit saying you don’t want your personal information sold or shared. In some US states, including California, businesses covered by the state privacy law must treat that signal as a valid opt-out request, the same as if you’d clicked their “Do Not Sell or Share” link. It’s free, it takes a minute to switch on, and it works across every site without you filling in a single form.

It also has real limits. It’s an opt-out, not a deletion request, it only has legal force where a law says so, and it doesn’t reach data brokers that already hold your information. This guide explains what global privacy controls do, how to turn GPC on, and where it fits in a wider privacy cleanup.

What Global Privacy Control is

GPC is a technical standard, developed by a group of privacy researchers, publishers and browser makers. When it’s switched on, your browser adds a small signal to each web request and exposes a matching setting that a site’s code can read. In plain terms, every site you visit gets the same message: this person opts out of the sale or sharing of their data.

The idea is to replace dozens of separate opt-out clicks with one browser-level preference. Instead of finding the privacy link on every retailer, news site and app, you state your choice once.

How it differs from Do Not Track

If you remember the older “Do Not Track” browser setting, GPC can look similar. The difference is legal backing. Do Not Track was voluntary, and most sites ignored it. GPC was designed to line up with state privacy laws that give consumers a right to opt out, so in those states ignoring it can be a compliance problem for the business.

Where the law requires businesses to honor it

GPC’s force comes from state privacy law, not from the signal itself.

• California. Regulations under the California Consumer Privacy Act, as amended by the CPRA, require covered businesses to treat an opt-out preference signal such as GPC as a valid request to opt out of the sale or sharing of personal information. The California Attorney General’s 2022 settlement with Sephora included allegations that the company failed to process GPC signals, which made clear the state treats this seriously.
• Other states. Several other state privacy laws require businesses to recognize “universal opt-out mechanisms” for sales or targeted advertising, and Colorado has formally recognized GPC as one. The details, start dates and which businesses are covered vary by state.
• States without a privacy law. A business may still choose to honor GPC, but it generally isn’t required to.

Covered businesses are usually those above certain size or data-volume thresholds set by each law, so a small local shop may not be covered at all. Our guide to “do not sell my personal information” explains the opt-out right that GPC automates.

Which browsers and extensions support it

Support changes over time, so check your browser’s current settings, but the general picture looks like this:

Type	How GPC usually works
Privacy-focused browsers	Some send GPC by default, with no setup needed
Mainstream browsers with a built-in setting	Firefox, for example, offers a privacy setting that tells websites not to sell or share your data; you switch it on yourself
Browsers without built-in support	A privacy extension that sends GPC can add it
Mobile browsers and apps	Support is more patchy; apps outside the browser usually don’t see the signal at all

A number of well-known privacy and tracker-blocking extensions include a GPC option. Install extensions only from your browser’s official store, and read what else they do, since some change how sites load.

How to turn on global privacy controls

1. Open your browser’s privacy settings. Look for a setting about telling websites not to sell or share your data, or one labeled Global Privacy Control.
2. Switch it on. If your browser has no such setting, install a reputable privacy extension that offers GPC and enable that option.
3. Check it’s working. The GPC project’s website has a check that shows whether your browser is sending the signal. Some privacy extensions also show it.
4. Repeat on every browser and device you use. The signal is set per browser, so your phone, work laptop and home computer each need it.
5. Opt out while logged in, too. If a site knows who you are because you’re signed in, the California rules expect the business to apply the opt-out to you as a known customer, not just to the browser. It’s still worth using the site’s own opt-out link for accounts that matter to you.

What GPC doesn’t do

Knowing the limits stops you relying on it for things it was never meant to handle.

• It doesn’t delete anything. GPC asks businesses to stop selling or sharing your data going forward. Data already collected stays with the business unless you send a deletion request.
• It doesn’t reach data brokers you never visit. People-search sites and brokers build profiles from public records and purchased lists. They never see your browser signal unless you visit them, and even then the signal isn’t a deletion request.
• It doesn’t block tracking by itself. GPC is a request, not a blocker. Sites can still load trackers; covered businesses are just not supposed to sell or share the data in ways the law restricts. Tracker-blocking tools are a separate layer.
• It only has legal force in some places. Outside states that require it, honoring GPC is voluntary.
• It doesn’t cover apps, smart TVs or offline data. Loyalty cards, in-store purchases and most apps don’t use your browser’s signal.
• It doesn’t touch search results. Nothing already published about you, such as a people-search page, an article or a post, changes because of GPC.

Where GPC fits in a privacy cleanup

Think of GPC as the “stop new leaks” step. It reduces how much fresh data flows from websites into the ad and broker economy. Cleaning up what’s already out there takes other steps:

1. Turn on GPC in every browser you use.
2. Opt out of the major people-search sites. Our guide to removing yourself from people-search sites walks through the main ones.
3. Use a state deletion route where one exists. Californians can use the state’s DROP platform to send one deletion request to registered data brokers.
4. Check Google for what remains and use Google’s removal tools for personal contact details.
5. Re-check every few months, because broker listings often come back.

If you’d rather have someone else handle the broker side, our guide to data broker removal services explains what they do and don’t cover.

A worked example

This is an illustrative scenario, not a real client.

Callum lives in California and notices that after shopping online for a stroller, ads for baby products follow him everywhere. He wants less of his browsing sold on, and he’s also worried his address is on people-search sites.

1. He switches on the “don’t sell or share” setting in his laptop browser and installs a privacy extension with GPC on his work browser.
2. He checks both on the GPC project’s test page and confirms the signal is being sent.
3. For the three retailers where he has accounts, he also submits their own opt-out forms while logged in.
4. Because GPC doesn’t remove existing profiles, he submits a request through DROP and opts out of the two people-search sites showing his address.
5. A few months later he re-checks the people-search sites. One has relisted him, so he opts out again.

He still sees ads, because GPC doesn’t block advertising. What changes is how much covered businesses are allowed to pass his data along.

Common mistakes

• Thinking GPC deletes your data. It’s an opt-out of sale and sharing, not erasure.
• Setting it on one device only. Every browser needs it separately.
• Assuming every site must obey it. Legal requirements depend on your state and whether the business is covered.
• Stopping there. GPC does nothing about listings that already exist on people-search sites or in search results.
• Installing unknown extensions to get it. Stick to reputable extensions from official stores.

When to get help

For most people, GPC is a five-minute job and needs no help at all. Help becomes useful when your concern is what’s already visible: your address on broker sites, an old article, or search results for your name that you’d rather people didn’t see. Our content removal service handles the removals that can realistically be made and tells you honestly which ones can’t.

Frequently asked questions

What is Global Privacy Control?

Global Privacy Control is a browser setting that sends a signal to websites saying you opt out of the sale or sharing of your personal information. In states such as California, covered businesses must treat it as a valid opt-out request.

Is Global Privacy Control legally binding?

It depends on where you live. California’s privacy regulations require covered businesses to honor it as an opt-out of sale or sharing, and several other states require businesses to recognize universal opt-out signals. Elsewhere, honoring it is voluntary.

Does GPC stop ads and tracking?

Not directly. GPC is a request not to sell or share your data, not a tracker blocker. You may still see ads, and sites can still load trackers. A separate tracker-blocking tool reduces tracking itself.

Does Global Privacy Control delete my data?

No. It stops covered businesses from selling or sharing your information going forward. To remove data a business already holds, send a deletion request under your state’s privacy law or the company’s own process.