Global Privacy Control (GPC) Test |
Global Privacy Control (GPC) is a browser privacy signal specified by the W3C that
automatically communicates a Do Not Sell or Share preference to every website a user
visits. When enabled, the browser sets navigator.globalPrivacyControl to
true and attaches a Sec-GPC: 1 header to every HTTP request.
Unlike Do Not Track (DNT), abandoned by the W3C in 2019 after universal industry
non-compliance, GPC is legally enforceable — businesses subject to the CCPA must honor
the signal as a valid opt-out of data sales, a position reinforced by a $1.2 million
enforcement action in 2022.
The GPC test runs automatically when this page loads — no form submission or input is required. It reads the Sec-GPC header your browser sent and navigator.globalPrivacyControl, the JavaScript property set when GPC is active.
The test reads navigator.globalPrivacyControl directly from your browser
and returns one of three distinct results. The JavaScript property mirrors the
Sec-GPC header value exactly — when the property is true,
the header is being sent; when it is false or undefined,
it is not.
| Status | navigator.globalPrivacyControl | Sec-GPC: 1 Header | What It Means |
|---|---|---|---|
| ✅ ACTIVE | true |
Sent | GPC is broadcasting. Covered businesses under CCPA and US state laws must treat you as opted out of data sales. |
| ⚠️ INACTIVE | false |
Not sent | The browser implements the GPC API but GPC is disabled. Enable GPC in your browser settings or via an extension. |
| 🚫 NOT SUPPORTED | undefined |
Not sent | The browser does not implement the GPC API. Switch to Brave, DuckDuckGo, or Firefox 120+, or install a GPC extension. |
GPC operates through two simultaneous signals transmitted on every HTTP request from the browser, as defined in the W3C GPC specification (w3.org/TR/gpc):
Sec-GPC: 1 — detectable
server-side by website scripts and consent management platforms (CMPs). The value
1 is the only permitted value per the specification; no extension
mechanism exists by design.
navigator.globalPrivacyControl === true
— readable by client-side scripts on any page. This test reads this property directly.
The two signals always agree: when the property is true, the header
is being sent, and vice versa.
Websites that honor the GPC signal may publish a machine-readable compliance declaration
at /.well-known/gpc.json per the W3C specification. This file signals
to clients that the site processes the opt-out. Checking this file is separate from
checking whether your browser sends the signal — this tool covers the latter.
| Feature | GPC (Global Privacy Control) | DNT (Do Not Track) |
|---|---|---|
| Launched | 2020 | 2009 |
| W3C status | Active draft specification (2025) | Abandoned 2019 |
| HTTP signal | Sec-GPC: 1 |
DNT: 1 |
| JavaScript property | navigator.globalPrivacyControl |
navigator.doNotTrack |
| Legal enforcement | Required under CCPA/CPRA, Colorado, Connecticut and several other US state laws | None — voluntary compliance only |
| Brave (default on) | Yes | No |
| DuckDuckGo (default on) | Yes | No |
| Firefox native support | Yes (v120+, opt-in) | Yes (settings, rarely used) |
| Browser | GPC Support | How to Enable |
|---|---|---|
| Brave | Native — on by default | GPC is active automatically. Confirm via Settings > Privacy and Security > "Send a «Do Not Sell My Personal Information» request with every browsing request". |
| DuckDuckGo | Native — on by default | GPC sends automatically on all platforms (desktop and mobile). No configuration needed. |
| Firefox 120+ | Native — opt-in | Settings > Privacy and Security > Website Privacy Preferences > Enable "Tell websites not to sell or share my data". |
| Chrome / Edge | Extension only (2026) | Install a GPC extension from globalprivacycontrol.org/implementations. Built-in support required by January 1, 2027 under California AB 566. |
| Safari | Extension only (2026) | No native GPC toggle. Install a GPC-compatible extension. Built-in support required by January 1, 2027 under California AB 566. |
California's AB 566 (the Opt Me Out Act), signed by Governor Newsom in October 2025, requires all browsers distributed in California to include built-in GPC functionality by January 1, 2027. Industry observers expect Chrome and Safari to ship native GPC settings globally rather than California-only, given the regulatory direction.
Verifying a CCPA complaint. A Brave user in California suspects a
retail website is tracking her despite her browser's opt-out signal. Before filing a
complaint with the California Attorney General under CCPA, she uses this test to
confirm her browser was actively sending Sec-GPC: 1 during her visit —
documenting that the signal was present and the site's failure to honor it was the issue,
not a misconfigured browser.
Cross-browser compliance testing. A developer implementing CCPA compliance on an e-commerce site opens this test in Brave, Firefox, and Chrome side-by-side. The results show ACTIVE in Brave and Firefox, and NOT SUPPORTED in Chrome without an extension. She uses this confirmation to document that her consent management platform (CMP) will only receive the signal from 2 of the 3 major browsers her users run, shaping her fallback consent strategy.
Corporate browser rollout verification. An IT administrator at a
California-based company is deploying Brave as the standard employee browser following
AB 566. She adds this GPC test to the browser configuration checklist to confirm
Sec-GPC: 1 is broadcasting correctly on each device before sign-off,
ensuring employees are covered by California's opt-out protections on company machines.