Global Privacy Control: how to honor the GPC signal on your site

Global Privacy Control (GPC) is a browser setting that tells every website a visitor goes to: do not sell or share my personal information. Under the California Consumer Privacy Act (CCPA) and laws in states such as Colorado, a covered business must treat this signal as a valid opt-out request, which means marketing tags have to stop for that visitor without any click on your site.

This guide explains how the GPC signal reaches your website, which laws require you to honor it, and how to connect it to Google Tag Manager so pixels and ad tags actually react. This article is not legal advice.

What is the GPC signal?

The GPC signal is a simple yes flag that the browser sends with every request. It is defined in a specification developed in the W3C Privacy Working Group. When a visitor turns the setting on, the browser adds the HTTP header Sec-GPC with the value 1 to each request, and JavaScript on the page can read the property navigator.globalPrivacyControl, which then returns true.

The signal says nothing about which tags you use or which banner you show. It is a general opt-out preference signal, in the language of the CCPA regulations, that applies to every site the visitor opens. That is the main difference from a cookie banner choice: the visitor decides once in the browser, and your site has to pick it up automatically.

Which laws require you to honor Global Privacy Control?

California was first. The CCPA regulations require businesses that sell or share personal information to treat an opt-out preference signal as a valid request, and the California Attorney General names GPC as an example. Colorado followed: the Colorado Attorney General recognized GPC as the first universal opt-out mechanism under the Colorado Privacy Act, required from July 1, 2024.

Other state privacy laws, for example in Connecticut, Texas and Oregon, also require businesses to respect universal opt-out signals for targeted advertising and sale of data. In October 2025 California went one step further: the California Opt Me Out Act requires browsers to offer an opt-out preference signal setting from January 1, 2027. The practical result for website owners is the same everywhere: if your site runs ad tracking, plan for GPC now.

→ Cookie banner with Consent Mode v2: compliant, with no monthly license

How GPC reaches your site and where to read it

Your site can read GPC in two places: on the server through the Sec-GPC header, or in the browser through navigator.globalPrivacyControl. For tag management the browser property is the practical choice, because Google Tag Manager runs in the browser and can read it with a small custom JavaScript variable that returns true or false.

Timing matters more than the method. Marketing tags often fire on the first page view, so the GPC check has to run before them, not after the page has finished loading. Store the result as well: if the visitor later turns the setting off, the stored opt-out still applies until the visitor actively opts back in. Some businesses also apply the signal to logged-in customer accounts, so the opt-out follows the person across devices where that is technically possible.

• Custom JavaScript variable in Google Tag Manager that returns navigator.globalPrivacyControl === true
• Consent update early on every page, before marketing tags fire
• Stored opt-out state so the result also applies when a later request lacks the signal
• Visible note for the visitor that the opt-out was received

How to make Google Tag Manager respect GPC

Google Tag Manager respects GPC most reliably through Google Consent Mode. Fire a consent update on the Consent Initialization trigger: if the GPC variable is true, set ad_storage, ad_user_data and ad_personalization to denied. Google tags such as Google Ads and the Google tag for GA4 follow that state on their own. Analytics storage can stay granted if analytics is used only for your own measurement.

Tags from other platforms do not read Google Consent Mode automatically. For the Meta Pixel, the TikTok Pixel, the LinkedIn Insight Tag and similar tags, add an exception trigger or a consent check so they do not fire while the GPC variable is true. The Meta Pixel also offers Limited Data Use for US privacy laws, and Google Ads offers restricted data processing. A consent tool that supports GPC can do the detection for you, but you still need to test that every tag listens to it.

→ Setting up Google Consent Mode v2 correctly: no warning in Tag Assistant

How to test your GPC setup

Testing GPC needs a browser that sends the signal. Open your site in Brave, or in Firefox with the setting turned on, and check in the developer console that navigator.globalPrivacyControl returns true. Then open Google Tag Manager preview mode, load a page and look at the consent state on the Consent Initialization event: the three advertising values should be denied.

Finally, watch the network tab while you click through a few pages. A typical case: an agency managing a client's lead generation site in Denver found that the Google Ads tag followed the consent state, but a LinkedIn Insight Tag added directly in the theme kept firing for GPC visitors. Moving the tag into Google Tag Manager with a consent check fixed it. Repeat the test after every new tag or plugin.

Get a clear picture of what loads

Before you add GPC logic, it helps to know which tags your site loads at all. The free Trackum check at trackum.app/check opens your homepage in a real browser three times, with the banner unanswered, rejected and accepted, plus two subpages, and lists the tags and cookies that load in each state, without sign-up. If you want help, Trackum sets up Google Tag Manager, GA4 and Consent Mode v2 at a fixed €150 one-time, each ad platform with conversion tracking for €50, tested with and without consent before anything goes live. Prices plus VAT.