Chapter navigation
Global Privacy Control (GPC)
opt-outRole & classification
Global Privacy Control (GPC) has a dual identity: natively the Sec-GPC request header (value 1, or the header omitted entirely; the official spec defines no 0) and navigator.globalPrivacyControl (true/false), expressible without the Global Privacy Platform (GPP) container; within GPP it is the first officially listed Reusable Subsection (SubsectionType Int(2)=1, payload a single Boolean), attachable to any section. It carries legal effect in California and elsewhere.
- Carriage
- Sec-GPC · navigator.globalPrivacyControl · GPP subsection
- GPP section
- Reusable Subsection (SubsectionType=1)
String & field layout
GPC is the user's opt-out signal that they do not wish their personal information to be sold or shared with third parties, transmitted over two paths — an HTTP header and the DOM (a JS property); it can be expressed independently of the GPP container, and within GPP it attaches to a section as a Reusable Subsection.
| Layer | Field / carrier | Value | Note |
|---|---|---|---|
| HTTP layer | Sec-GPC | value 1, or the header omitted entirely (no 0 is defined) | A forbidden request header (Sec- prefix); the browser attaches it to all requests it makes when GPC is enabled. |
| JS layer | navigator.globalPrivacyControl | boolean (true when the user has enabled GPC) | WorkerNavigator.globalPrivacyControl is also available; the spec does not define how a site grants or withdraws consent from it. |
| GPP layer | Reusable Subsection（SubsectionType Int(2)=1） | payload is a single Boolean | The first officially listed Reusable Subsection, attachable to any section; this site's decoder does not yet parse this subsection. |
Carriage & access
GPC=1 (the user has opted out) should correspond, in the Multi-State Privacy Agreement (MSPA) family, to the 'opted out' value of three-valued Int(2) fields such as SaleOptOut / SharingOptOut; the exact per-field mapping follows each state's section specification, and this chapter does not fix a value in place of the per-state chapters.
Version deltas
The World Wide Web Consortium (W3C) Privacy Working Group published the first public working draft of the GPC specification on 2024-11-21, aiming to make the opt-out request legally enforceable alongside current and future legal frameworks. The California Consumer Privacy Act (CCPA), its amendment the California Privacy Rights Act (CPRA), and Colorado law require sites to honour the opt-out expressed via GPC; the effect in other jurisdictions varies.
Invalid forms
- A Sec-GPC header value other than 1 (the spec defines only 1, or the header omitted; there is no 0)
- Conflating GPC with the deprecated, legally inert Do Not Track (DNT)
- Assuming every jurisdiction must honour GPC (legal effect varies by jurisdiction)