Global Privacy Control states: requirements and dates

Global Privacy Control (GPC) is recognized in at least a dozen US states, where covered businesses must honor qualifying universal opt-out signals. The requirements differ by state, including when they took effect, which businesses they cover and how a website must respond.

What is GPC (Sec-GPC: 1 and navigator.globalPrivacyControl)?

Global Privacy Control is a browser signal that communicates a visitor's request to stop certain uses of personal information. Websites can detect GPC through an HTTP request header or a JavaScript property defined in the W3C Global Privacy Control specification.

When GPC is enabled, the browser sends this HTTP header:

Sec-GPC: 1

The value must be exactly 1. Under the W3C specification, servers must ignore a Sec-GPC header containing any other value.

JavaScript can also read navigator.globalPrivacyControl. The specification defines this as a read-only boolean property on Navigator and WorkerNavigator. It returns true when the browser would send the GPC header and false otherwise.

For example, you can check the property in your browser console:

// Illustrative GPC detection
const gpcEnabled = navigator.globalPrivacyControl === true;

console.log("GPC enabled:", gpcEnabled);

The comparison returns false if the property is unavailable. That result does not establish that the visitor has agreed to tracking or data sharing.

As of September 24, 2026, the W3C specification is a Working Draft. Its technical requirements may change before the standard is finalized.

The signal's legal meaning depends on the applicable law. California treats GPC as a request to opt out of selling or sharing personal information. Colorado and several other states use universal opt-out mechanisms for targeted advertising and the sale of personal data.

GPC does not automatically request deletion of personal information or prohibit every form of advertising. Your site's response must follow the rights and processing activities covered by the applicable law.

Which US states require honoring universal opt-out signals?

The California Privacy Protection Agency's August 6, 2026 overview identifies at least a dozen states requiring businesses to honor opt-out preference signals or universal opt-out mechanisms such as GPC.

The table shows when each state's requirement became applicable.

State	Requirement applies from	Source
California	In force; current rules in 11 CCR §7025	CPPA overview
Colorado	July 1, 2024	Colorado Attorney General
Connecticut	January 1, 2025	Connecticut statutes
Montana	January 1, 2025	Montana statute
New Hampshire	January 1, 2025	New Hampshire statute
Texas	January 1, 2025	Texas HB 4
Nebraska	January 1, 2025	Nebraska statute
New Jersey	July 15, 2025	New Jersey privacy FAQ
Minnesota	July 31, 2025	Minnesota statute
Maryland	October 1, 2025	Maryland statute
Delaware	January 1, 2026	Delaware statute
Oregon	January 1, 2026	Oregon DOJ

The statutes differ. Texas and Nebraska describe browser settings and similar technology as ways to designate an authorized agent, subject to verification rules and exceptions. Maryland's statute lists an opt-out preference signal as one of the methods a controller may use to provide opt-out rights. Minnesota accepts signals approved under other states' laws or regulations.

Some other state privacy laws contain no express universal opt-out signal requirement.

Being in a listed state does not make every business subject to its law. Each law has its own applicability thresholds and exemptions. This guide is not legal advice; ask a privacy lawyer to assess which requirements apply to your business.

What must a site do when it sees GPC?

A website receiving GPC must apply the opt-out rights required by the laws governing its processing activities. California and Colorado provide useful starting points, but their requirements are different.

Under California's 11 CCR §7025, covered businesses must recognize an opt-out preference signal in a commonly used format, including an HTTP header or JavaScript object. GPC meets that standard.

When California's requirements apply, the business must:

1. Stop selling or sharing personal information associated with the browser or device sending the signal.
2. Apply the opt-out to associated profiles, including pseudonymous profiles, and to the consumer when their identity is known.
3. Apply the opt-out to the consumer's account information when they are logged in.
4. Process the request as soon as feasibly possible, no later than 15 business days after receipt under §7026(f)(1).
5. Honor the signal when it conflicts with a business-specific privacy setting. The business may explain the conflict and offer a separate consent choice without dark patterns.
6. Display whether the signal was processed, as required by §7025(c)(6). The CPPA's overview gives "Opt-Out Preference Signal Honored" or an appropriately set toggle as examples.

Colorado has its own requirements. Since July 1, 2024, covered controllers must recognize mechanisms on the Attorney General's approved list. GPC is currently the only recognized universal opt-out mechanism.

Colorado Rule 5.08 requires controllers to recognize the opt-out for the browser or device, and for the consumer when known. The opt-out covers targeted advertising and/or sale of personal data.

Across state laws, a qualifying signal may need to reflect an affirmative consumer choice, use an accessible mechanism and meet residency or verification conditions. Exceptions and handling of conflicting preferences vary. Check the statute before applying one state's rules to every visitor.

Check your implementation

You can test GPC handling with these steps:

1. Enable GPC in a supporting browser. Open a fresh session and inspect the Network panel. Expected: applicable browser requests contain Sec-GPC: 1.
2. Open the JavaScript console and read navigator.globalPrivacyControl. Expected: true when the browser is sending GPC.
3. Inspect tracking requests and the systems that sell, share or process personal data for targeted advertising. Expected: processing covered by the applicable opt-out stops, including relevant server-side activity. The pre-consent cookie guide shows how to find tracking requests in the Network panel.
4. Repeat while logged in and while browsing anonymously. Expected: the opt-out reaches the browser, associated profiles and account data to the extent required by applicable law.
5. Inspect the visitor-facing preference controls. Expected: an acknowledgment that the signal was processed where California requires one.

A banner indicator alone cannot establish that every relevant data flow stopped. Review tracking scripts, advertising integrations and server-side systems separately.

The CPPA's August 2026 overview identifies GPC enforcement involving Sephora (2022), Healthline Media (2025), Disney, Tractor Supply and PlayOn Sports. The CPPA fined Tractor Supply $1,350,000 in September 2025, partly for ineffective opt-out mechanisms. In September 2025, the CPPA and the attorneys general of California, Colorado and Connecticut announced a coordinated GPC enforcement sweep.

For websites using CookieConsentHQ in regions configured with the US opt-out model, receiving GPC automatically turns off the marketing category without asking the visitor. CookieConsentHQ stores the automatic opt-out in the consent log and displays a note in the preference center confirming that the browser's Global Privacy Control signal was honored.

GPC honoring is enabled by default and can be configured per region. In opt-in regions, such as the EU, GPC does not override a visitor's explicit opt-in.

You get GPC on every plan, including Free.

CookieYes lists GPC beginning with its $25 per month Pro plan on its pricing page. See CookieYes charges $25/mo for GPC for the comparison.

What changes in 2027?

California's Opt Me Out Act, AB 566, takes effect on January 1, 2027. The CPPA's October 8, 2025 announcement explains that browsers operating in California must offer easy-to-use opt-out preference signals. AB 566 places a requirement on browsers. It does not replace the existing obligation for covered California businesses to honor qualifying signals.

Louisiana also joins the states requiring opt-out preference signals beginning in January 2027, according to the CPPA's August 2026 overview.

Vermont follows on January 1, 2028. Its Act 145 (S.71) requires covered controllers to allow consumers to opt out of targeted advertising and the sale of personal data through qualifying opt-out preference signals. The act specifies January 1, 2028 as its effective date.

More browser support makes it useful to test GPC handling before these dates.

Check that your site reads the GPC signal, records the applicable opt-out and applies it across relevant tracking and data systems. Confirm that visitors can see the signal was honored wherever California's regulations require that acknowledgment.