# Global Privacy Control: what it is and how to honour it

The browser signal that says don't sell or share my data: who sends it, which US states require you to respect it, and how to handle it in Tag Manager.

_The TagSentry team · September 15, 2026 · https://tagsentry.ai/blog/global-privacy-control-explained_

> **The short answer:** Global Privacy Control (GPC) is a yes/no signal a browser sends with every page: "don't sell or share my personal information". About a dozen US states require businesses to treat it as a valid opt-out. To honour it, you read it on the first page load and stop advertising tags before they fire. The visitor shouldn't have to click anything.

> **Not legal advice** State laws change and differ in detail. Check the current statutes, or ask a lawyer, before relying on any list here.

## What it is

GPC is a setting built into some browsers (like Firefox, Brave and DuckDuckGo) and available as an extension in others. When it's on, the browser adds a header to every request, `Sec-GPC: 1`, and exposes the same signal to scripts as `navigator.globalPrivacyControl`.

The signal says this person doesn't want their data sold or shared. That's narrower than a [cookie banner](/blog/do-i-need-a-cookie-banner-us) answer and doesn't cover everything, but an opt-out from sale and sharing does cover most advertising and cross-site tracking in practice.

## Who has to honour it

California was first. Its regulators treat GPC as a valid request to opt out of sale and sharing, and its first enforcement action under the state privacy law, against Sephora in 2022, was partly about ignoring it. Sephora paid $1.2 million.

Other states followed. Colorado made universal opt-out signals mandatory from July 2024, and sites that track state laws count about twelve states requiring them as of 2026, including California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon and Texas.

In other US states, honouring GPC is good practice rather than a clear legal requirement.

## Why it will matter much more in 2027

Few visitors have GPC on today. A California law signed in October 2025 requires browsers to offer an opt-out preference signal from 1 January 2027. Once mainstream browsers ship the setting, more visitors will send GPC, and ignoring it will cost more.

## What "honouring" means in practice

You have to respect the signal before anything that counts as sale or sharing happens, so reading it after your tags have fired is too late.

1. **Read it first.** Check `navigator.globalPrivacyControl` in a script that runs before Tag Manager, at the top of `<head>`.
2. **Treat it as an opt-out.** For that visitor, advertising tags should not fire, and [Google's Consent Mode signals](/blog/google-consent-mode-v2-explained) for ads should be `denied`.
3. **Don't ask them to confirm.** A GPC visitor already said no. A popup nudging them to opt back in defeats the point.
4. **Tell them it worked.** More and more, people expect a small confirmation like "Opt-out request honored".
5. **Record it.** Keep a record that this visitor's browser sent GPC and what you did about it.

## Doing it in Tag Manager

Tag Manager has no built-in GPC switch. Most people do it like this:

```js
// At the very top of <head>, before the Tag Manager snippet
window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}
if (navigator.globalPrivacyControl === true) {
  gtag('consent', 'default', {
    ad_storage: 'denied',
    ad_user_data: 'denied',
    ad_personalization: 'denied'
  });
}
```

Then, for non-Google tags like the Meta Pixel or TikTok, add a trigger condition so they only fire when advertising consent is granted. Google's tags read Consent Mode by themselves. Other vendors' tags don't.

The snippet is the easy bit. Getting it to run in the right states, for the right visitors, before everything else, is harder, and so is keeping it working when someone adds a new pixel next month.

## Common mistakes

| Mistake | Why it matters |
|---|---|
| Reading GPC inside a Tag Manager tag | Other tags may already have fired |
| Only handling Google's tags | Meta, TikTok and others ignore Consent Mode |
| Showing a "please reconsider" popup | Undermines the opt-out and annoys the visitor |
| Forgetting pixels outside Tag Manager | A Meta Pixel pasted into your theme ignores your GTM logic |
| No record | You can't show you honoured it |

## Enforcement

California regulators didn't stop at Sephora. Disney paid a record $2.75 million in February 2026 for not fully honouring opt-outs and preference signals. Regulators test sites with GPC switched on.

## How TagSentry handles GPC

TagSentry [reads GPC before anything fires](/docs/how-consent-works). It applies GPC in California and 11 more states: Colorado, Connecticut, Texas, Montana, New Hampshire, New Jersey, Minnesota, Oregon, Delaware, Nebraska and Maryland.

In those places a GPC browser counts as opted out. We hold advertising and analytics trackers, show the visitor "Opt-out request honored", and keep the signal in the consent record.

## Sources

- [California AG: Sephora settlement over Global Privacy Control](https://oag.ca.gov/news/press-releases/attorney-general-bonta-announces-settlement-sephora-part-ongoing-enforcement)
- [CookieScript: Universal opt-out mechanisms by US state](https://cookie-script.com/privacy-laws/universal-opt-out-mechanisms-in-us-privacy-laws-gpc-requirements-by-state)
- [privacyterms.io: Universal opt-out mechanisms adoption in 2026](https://privacyterms.io/universal-opt-out-mechanisms-adoption-2026)
- [IAPP: California requires an in-browser opt-out preference signal](https://iapp.org/news/a/california-governor-signs-new-law-requiring-in-browser-opt-out-preference-signal)
- [Hunton: California AG record settlement with Disney](https://www.hunton.com/privacy-and-cybersecurity-law-blog/california-ag-reaches-record-2-75-million-settlement-with-disney-for-violating-ccpas-opt-out-rights)