The Global Privacy Control (GPC) is both an initiative and a technical specification. Developed by a diverse group of privacy advocates, GPC promotes online privacy by creating a universal opt-out signal.
This signal, also known as GPC, is a browser-based standard supported by organizations like the Electronic Frontier Foundation and Mozilla. Some browsers, like Firefox, Brave, and DuckDuckGo, have built-in GPC functionality. Other browsers, like Chrome, can support GPC through browser extensions.
Usercentrics CMP supports the GPC signal for a number of regulatory frameworks and helps automate consent signaling.
How does Global Privacy Control work?
Global Privacy Control is a browser setting or extension/plugin that enables users to communicate their privacy preferences for the collection, sharing, sale, or other uses of their personal data (like targeted advertising or profiling) to third parties.
GPC can function as a one-stop solution for end users to manage their privacy settings, eliminating the need to repeatedly adjust preferences on different websites or online services, as is often required with cookie banners and similar tools.
Users can set their preferences to opt in or opt out of data sharing, cookie usage, and targeted advertising. When consent is needed, and for what, varies among data privacy regulations.
These consent preferences can be broad — full acceptance of data access and use, or basic refusal of all data access — to granular permissions for specific uses, e.g. yes to analytics cookie use, no to marketing cookies and data sales.
While not legally binding in all jurisdictions, GPC is enforceable in regions with relevant data privacy laws, such as California and Connecticut. In other areas, GPC relies on voluntary compliance from websites and online services.
However, GPC faces certain limitations. Not all browsers have built-in GPC functionality, some websites and apps may not be compatible with it, and compliance requirements are not the same in all jurisdictions.
What does Global Privacy Control mean for businesses?
The GPC universal opt-out mechanism signifies a shift in online data privacy, even if it’s not yet required globally.
It impacts standards and user expectations, influencing trust, brand reputation, and competitive differentiation. Businesses that collect and use personal data online should be mindful of the GPC and user preferences, not only for compliance with privacy regulations but also as a sign of respect for users’ rights and personal data.
Acknowledging the GPC signal fosters transparency and accountability, leading to stronger customer relationships and streamlined privacy operations.
The universal GPC aligns with best practices and requirements of a number of data privacy laws, with the potential to become an international standard. Recognizing it can aid legal compliance efforts and demonstrate a commitment to best practices.
Moreover, using the GPC contributes to a broader global standard for privacy protection, simplifying adoption and accelerating innovation.
Respecting user privacy and data usage through clear information and user-friendly tools is a competitive advantage for growing companies, helping to enhance brand reputation to boost user engagement and long-term customer relationships.
How Usercentrics supports the Global Privacy Control signal
The GPC signal is recognized by default when any of these US regulatory frameworks is in use:
California (CCPA/CPRA)
Virginia (VCDPA)
Colorado (CPA)
Connecticut (CTDPA)
Utah (UCPA)
When Usercentrics CMP receives a browser signal that GPC is in use, this logic is followed:
- If the user has not previously seen or interacted with the cookie banner (prior implicit consent), the GPC signal is honored
- If the GPC signal is honored, the user will still be able to make manual changes to their consent preferences in the cookie banner (via the privacy button or link) and then those manual choices will prevail over the previous GPC signal
- If the user has previously provided explicit consent choices by interacting with the cookie banner, the GPC signal is ignored in favor of the direct consent choices the user provided
- Once the CMP recognizes the GPC signal, the user is automatically opted out of consent for personal data collection and use and the message “The GPC signal is honored” will be displayed in the CMP
International privacy regulations and frameworks and Global Privacy Control
As noted, GPC support is not legally required nor a standard yet worldwide. We look at major international privacy regulations and frameworks and see if they require GPC support and how.
United States
As of early 2025, 21 state-level data privacy laws have been passed in the United States, and the country does not have a federal data privacy law. References to the GPC or other universal opt-out signal requirements remain inconsistent.
These states’ privacy laws reference a requirement to respect the GPC specifically, or a universal opt-out mechanism (UOOM):
- California (GPC)
- Colorado (GPC)
- Connecticut (GPC)
- Delaware (UOOM)
- Maryland (UOOM)
- Minnesota (UOOM)
- Montana (UOOM)
- Nebraska (UOOM)
- New Hampshire (UOOM)
- New Jersey (UOOM)
- Oregon (UOOM)
- Texas (UOOM)
These states’ privacy laws do not include any requirement to respect the GPC:
- Florida
- Indiana
- Iowa
- Kentucky
- Nevada
- Rhode Island
- Tennessee
- Virginia
- Utah
Even in the states where GPC support is not a requirement, consumers’ rights include opting out of data use for sale, sharing, targeted advertising, or profiling, depending on each law’s specifics.
So the GPC does support enabling this right, and may be included in future updates to these laws, which are already in the works in a number of states.
In early 2023, California’s Attorney General announced increased privacy compliance scrutiny and enforcement, particularly for mobile platforms, and specifically recommended respecting the GPC. The signal has also been referenced regarding penalties for CCPA violations, including against beauty retailer Sephora.
The United States has more than 20 data privacy laws. Knowing what you need to protect your business is complex, especially if you do business around the country. We have everything you need to know in our US State Privacy Laws overview.
European Union and other countries
Major privacy regulations and frameworks in the EU all came into effect before the GPC initiative, so none explicitly reference or require GPC support.
These include the General Data Protection Regulation (GDPR), ePrivacy Directive, and Transparency & Consent Framework (TCF v2.2).
These laws and frameworks all have similar goals for data privacy and user control, but cover it from different angles, e.g. electronic communications vs. cookie use on the web and in apps, and digital advertising.
Like in the EU, data privacy laws in Brazil, South Africa, China, Japan, and other countries were drafted (and in some cases enacted) before the GPC initiative was launched, so they do not explicitly reference the GPC or UOOM.
With legal cases centered around privacy violations, and new laws in the works in countries like the United Kingdom, however, support for the initiative may change. As it is, all the data privacy laws in these countries do support the goals of the GPC in giving users control over their data and privacy and standardizing compliance methods.
Global Privacy Control, Usercentrics, and privacy best practices
New privacy laws are being passed regularly, and existing ones are evolving as technologies and consumers’ expectations change.
Prominent advocates in the data privacy sphere who have been influential in the development of the Global Privacy Control initiative also continue to work on awareness, adoption, and standardization, so their efforts may influence future legislation.
The average individual online continues to grow more savvy about online privacy and the use of their data. People care about what happens to it and what their rights are. Increasingly, they also won’t do business with companies they don’t trust.
At the same time, many people are also experiencing consent fatigue from having to make frequent consent choices every time they use a browser. A single standard that enables “set it and forget it” and makes the “cookie banner flood” go away, as German regulators termed it, makes sense and could solve a real need.
The GPC initiative also helps encourage compliance with data privacy regulations, even if the GPC is not legally binding everywhere today.
At the same time, however, there are concerns about whether use of the GPC can be considered to enable valid consent in some jurisdictions. This sticking point may become a strong driver for further study and change.
As technology continues to evolve, universal opt-out signals will evolve as well, enabling even more streamlined, user-friendly, and powerful tools to help protect users’ data privacy online and help companies achieve and maintain regulatory compliance.
Ideally, relevant parties, technology partners, and regulators can collaborate to make the smartest, most comprehensive, and most secure privacy tools available.
