The short answer
Global Privacy Control (GPC) is a yes/no signal a browser sends with every page: "don't sell or share my personal information". About a dozen US states require businesses to treat it as a valid opt-out. Honouring it means reading it on the first page load and stopping advertising tags before they fire, without asking the visitor to click anything.
What it is
GPC is a setting built into some browsers (like Firefox, Brave and DuckDuckGo) and available as an extension in others. When it's on, the browser adds a header to every request, Sec-GPC: 1, and exposes the same signal to scripts as navigator.globalPrivacyControl.
It means one thing: this person doesn't want their data sold or shared. It's not a cookie banner answer and it doesn't cover everything. It's an opt-out from sale and sharing, which in practice covers most advertising and cross-site tracking.
Who has to honour it
California was first. Its regulators treat GPC as a valid request to opt out of sale and sharing, and its first enforcement action under the state privacy law, against Sephora in 2022, was partly about ignoring it. Sephora paid $1.2 million.
Since then, more states have followed. Colorado made universal opt-out signals mandatory from July 2024, and trackers of state laws count about twelve states requiring them as of 2026, including California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon and Texas.
In other US states, honouring GPC is good practice rather than a clear legal requirement.
Why it will matter much more in 2027
Today, few visitors have GPC on. That's about to change. A California law signed in October 2025 requires browsers to offer an opt-out preference signal from 1 January 2027. When mainstream browsers ship the setting, the share of visitors sending GPC will grow, and so will the cost of ignoring it.
What "honouring" means in practice
The signal has to be respected before anything that counts as sale or sharing happens. That rules out reading it after your tags have already fired.
- Read it first. Check
navigator.globalPrivacyControlin a script that runs before Tag Manager, at the top of<head>. - Treat it as an opt-out. For that visitor, advertising tags should not fire, and Google's Consent Mode signals for ads should be
denied. - Don't ask them to confirm. A GPC visitor already said no. Showing a popup that nudges them to opt back in defeats the purpose.
- Tell them it worked. A small confirmation like "Opt-out request honored" is increasingly expected.
- Record it. Keep a record that this visitor's browser sent GPC and what you did about it.
Doing it with Google Tag Manager
Tag Manager has no built-in GPC switch. The usual approach:
// At the very top of <head>, before the Tag Manager snippet
window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}
if (navigator.globalPrivacyControl === true) {
gtag('consent', 'default', {
ad_storage: 'denied',
ad_user_data: 'denied',
ad_personalization: 'denied'
});
}
Then, for non-Google tags like the Meta Pixel or TikTok, add a trigger condition so they only fire when advertising consent is granted. Google's tags read Consent Mode by themselves; other vendors' tags don't.
The hard part is not the snippet. It's making sure it runs in the right states, for the right visitors, before everything else, and keeps working when someone adds a new pixel next month.
Common mistakes
| Mistake | Why it matters |
|---|---|
| Reading GPC inside a Tag Manager tag | Other tags may already have fired |
| Only handling Google's tags | Meta, TikTok and others ignore Consent Mode |
| Showing a "please reconsider" popup | Undermines the opt-out and annoys the visitor |
| Forgetting pixels outside Tag Manager | A Meta Pixel pasted into your theme ignores your GTM logic |
| No record | You can't show you honoured it |
Enforcement is real
Beyond Sephora, California regulators have kept going. Disney paid a record $2.75 million in February 2026 for not fully honouring opt-outs and preference signals. The direction is clear: regulators test sites with GPC switched on.
How TagSentry handles GPC
TagSentry reads GPC before anything fires. In California and the 11 GPC states it applies (Colorado, Connecticut, Texas, Montana, New Hampshire, New Jersey, Minnesota, Oregon, Delaware, Nebraska and Maryland), a GPC browser is treated as opted out, advertising and analytics trackers are held, the visitor sees "Opt-out request honored", and the signal is kept in the consent record.