ConsentXDPDPA is being phased in. Scan your site to see where you stand. Scan now
ConsentXGPC is a browser setting that automatically tells websites: "Do not sell or share my personal data."
Under the CCPA, businesses covered by the law must treat a GPC signal as a valid opt-out request. This matters for any website that runs ads, retargeting or third-party trackers.
GPC is not a cookie banner and it does not block trackers by itself. A consent management platform is what turns the signal into real action.
Without GPC, protecting your privacy online means visiting each website, finding its privacy settings and opting out one site at a time. This is slow, and most people never do it.
With GPC, you turn the setting on once in a supported browser or privacy extension. From then on, your browser sends your opt-out choice to every participating website automatically. The website detects the signal and applies your choice.
GPC covers the sale or sharing of your personal data and, where the law applies, cross-context behavioral advertising. It is not a "delete my data" button and it does not block all tracking. Websites still need to match the signal to the right rights under each law, as described in the W3C specification.
GPC can:
GPC cannot:
GPC generally communicates an opt-out preference. It is not a complete statement of every privacy right a user may have.
The W3C specification specifically distinguishes GPC from other privacy rights. For example, GPC is not designed to exercise deletion rights or every possible advertising opt-out or data-processing right.
A business should therefore avoid interpreting GPC as:
"The user has rejected every form of data processing."
Instead, the business should map the signal to the rights and processing activities covered by the applicable law.
A simplified GPC flow looks like this:
Enable
The user enables GPC in a supported browser, browser extension, or privacy tool.
Communicate
The browser communicates the preference to websites the user visits.
Detect
The website detects the GPC signal.
Determine
The website determines which legal obligations apply based on the user's context and applicable privacy laws.
Apply
The website applies the corresponding opt-out preference, such as disabling covered sale or sharing.
Propagate
Downstream systems and third parties should receive the appropriate updated privacy state.
Record
The business records or otherwise maintains appropriate evidence of how the request was handled, where required by its compliance program.
GPC is therefore more than a visual privacy setting. It is a machine-readable way to communicate a user's privacy preference to websites.
At the technical level, GPC can be communicated through web mechanisms including:
The W3C GPC specification defines the signal and its use for communicating applicable opt-out preferences.
A privacy platform or CMP can inspect the incoming signal and translate it into an internal privacy state.
For example:
The exact enforcement behavior should depend on the applicable legal requirements and the business's privacy architecture.
Does GPC block cookies?
Not by itself.
GPC is a signal, not a universal tracker blocker.
Detecting GPC does not automatically guarantee that:
A website needs an enforcement layer that translates the GPC signal into appropriate technical actions.
For example, a CMP may use the signal to:
Does GPC mean "do not track"?
Not exactly.
GPC is commonly described as a global opt-out mechanism, but it should not be treated as a generic "turn off every type of tracking" command.
The legal effect of GPC depends on the applicable law and the processing activity.
The W3C specification specifically notes that GPC is not designed to exercise every privacy right or every possible advertising opt-out.
This distinction is important because:
| Jurisdiction / Law | GPC relevance |
|---|---|
| California | CCPA/CPRA: covered businesses must honor a valid GPC signal as a request to opt out of sale or sharing. Learn more |
| Colorado and Connecticut | US state privacy laws: GPC is recognized as a universal opt-out signal, but the requirements differ by state. Learn more: Colorado · Connecticut |
| GDPR / UK GDPR | GPC is not a substitute for GDPR consent. Learn more: EU · UK |
| India DPDPA | India's DPDPA does not name GPC, but consent and notice rules still apply. Learn more |
GPC has a particularly important role under the California Consumer Privacy Act (CCPA).
California recognizes a user-enabled global privacy control as one method for consumers to submit a request to opt out of the sale or sharing of personal information. Covered businesses must honor qualifying opt-out preference signals as valid requests.
This is especially relevant to businesses whose processing involves:
The California Privacy Protection Agency also describes opt-out preference signals as a way for users to automatically communicate an opt-out request through a browser setting or extension.
Is GPC required under the CCPA?
For businesses covered by the applicable CCPA opt-out requirements, a qualifying GPC or other valid opt-out preference signal must be honored when it meets the applicable requirements.
This does not mean that every website in every jurisdiction must implement GPC in exactly the same way.
The legal requirement depends on factors such as:
For California businesses and consumers, however, GPC is an important technical mechanism for exercising the CCPA right to opt out of sale or sharing.
GPC and CPRA
The California Privacy Rights Act (CPRA) amended the CCPA and expanded California privacy protections.
The CPRA did not create a completely separate privacy law from the CCPA. Instead, it amended the existing CCPA framework and added additional rights and requirements.
GPC is relevant to the CCPA/CPRA opt-out framework because California recognizes qualifying opt-out preference signals as a mechanism for communicating a consumer's request to opt out of sale or sharing.
GPC is increasingly relevant beyond California because several US state privacy laws include mechanisms for universal or opt-out preference signals.
However, the exact legal requirements differ by state.
A website operating across multiple US jurisdictions should therefore avoid implementing a simplistic rule such as:
"If GPC is present, block everything."
Instead, the website should use jurisdiction-aware rules that determine:
GPC is not inherently a substitute for GDPR or UK GDPR consent.
The GPC specification describes potential use of the signal in GDPR contexts, including communicating certain requests concerning the sale or sharing of personal data and applicable rights. However, organizations should not assume that detecting GPC automatically satisfies every GDPR obligation or replaces the legal analysis required for a particular processing activity.
For GDPR-covered websites, businesses may still need mechanisms for:
The DPDPA does not mention GPC or browser opt-out signals. A GPC signal can still be respected as the visitor's privacy preference, but it does not replace DPDPA notice, consent or the right to withdraw consent.
GPC is particularly relevant to cross-context behavioral advertising.
Cross-context behavioral advertising generally involves using personal information obtained from a consumer's activity across businesses, websites, applications, or other contexts to target advertising.
Under California privacy rules, consumers have a right to opt out of the sale or sharing of personal information, including sharing associated with cross-context behavioral advertising.
A compliant implementation should therefore consider how a GPC signal affects:
No.
GPC does not automatically replace a consent banner.
A cookie banner and GPC address different privacy workflows:
Cookie banner
A cookie banner can ask for consent.
Preference centre
A preference centre can allow users to modify choices.
GPC
GPC can communicate an applicable opt-out preference automatically.
CMP
A CMP can interpret and enforce these signals across the website.
Depending on the jurisdictions and processing activities involved, a website may need several of these mechanisms together.
| GPC | CMP |
|---|---|
| Communicates a user's privacy preference | Manages privacy preferences and consent |
| Browser/user-controlled signal | Website-controlled software |
| Primarily communicates opt-out preferences | Can manage multiple consent and opt-out states |
| Works across participating websites | Usually configured for a specific website or organization |
| Does not enforce itself | Can enforce rules across tags and vendors |
| Does not replace all privacy rights | Can provide a broader privacy-management workflow |
GPC and a CMP therefore work well together.
GPC and consent management platforms
A Consent Management Platform (CMP) can act as the enforcement layer between the GPC signal and a website's technology stack.
A typical flow is:
A mature CMP should be able to:
This makes GPC complementary to a CMP rather than an alternative to one.
A website subject to California's opt-out requirements may provide a "Do Not Sell or Share My Personal Information" link or another qualifying privacy-choice mechanism.
GPC provides another way for a user to communicate the relevant opt-out preference.
California's guidance explains that businesses subject to the applicable opt-out requirements must honor qualifying opt-out preference signals, while also generally providing consumers with a way to exercise the right directly on the website.
Therefore, GPC should be treated as part of a broader privacy-choice system rather than as a replacement for every other consumer-facing privacy mechanism.
Opt-out preference signal is the broader concept.
GPC is one example of a user-enabled signal that can communicate a privacy preference to websites.
The California Privacy Protection Agency uses the term opt-out preference signal (OOPS) for mechanisms that allow a consumer to communicate an opt-out request automatically.
GPC and Google Consent Mode solve different problems.
GPC communicates a user's privacy preference to a website.
Google Consent Mode communicates relevant consent states to supported Google tags and services so their behavior can adjust according to those states.
A website can therefore use both:
This is particularly important for websites that operate advertising and analytics technologies across multiple jurisdictions.
Implementing GPC is an important part of privacy compliance for businesses subject to laws that recognize applicable opt-out preference signals, but it does not by itself make a website compliant.
A complete privacy program may also require:
GPC should therefore be treated as one component of a broader privacy compliance architecture.
Businesses implementing GPC should consider the following checklist:
Detect the signal
Confirm that the website can reliably identify incoming GPC preferences.
Determine the applicable law
Use jurisdiction and processing context to determine what the signal means for the visitor.
Map the signal to a privacy state
Define exactly what happens when GPC is present.
Stop applicable sale or sharing
Ensure covered data sharing and advertising activities are restricted as required.
Control third-party technologies
Review advertising, retargeting, analytics, social, and data-provider integrations.
Update the consent/privacy platform
Ensure the CMP or privacy preference centre reflects the user's state.
Preserve appropriate evidence
Maintain records that demonstrate how privacy preferences were detected and enforced where appropriate.
Test repeatedly
Test GPC with:
Test across jurisdictions
Do not assume the same GPC behavior is legally appropriate for every visitor.
Keep privacy notices aligned
Your privacy policy and preference centre should accurately explain how opt-out requests are handled.
Detecting GPC but doing nothing
A signal that is merely logged but does not change the applicable privacy state does not provide meaningful enforcement.
Treating GPC as a cookie blocker
GPC communicates a privacy preference. Your technology stack still needs to enforce the resulting preference.
Treating GPC as universal consent refusal
GPC is not equivalent to rejecting every processing purpose.
Ignoring third-party systems
Your first-party website may respond correctly while advertising and analytics vendors continue receiving covered information.
Assuming one rule works everywhere
Privacy laws differ across jurisdictions. A global website needs rules that account for those differences.
Removing the privacy-choice interface
GPC does not necessarily eliminate the need for other required consumer-facing privacy mechanisms.
Failing to test after deployment
A CMP configuration can detect GPC while a tag manager, server-side integration, or vendor continues processing data incorrectly.
GPC becomes especially important when a website uses third-party technologies for:
Simply detecting GPC is not enough.
The website should verify that the relevant third-party technologies actually respond to the resulting privacy state.
For example, a business may detect GPC correctly but still send advertising identifiers to a third party. In that situation, the signal is being received but not effectively enforced.
Detecting GPC is only step one. ConsentX reads the signal, applies the right privacy state for each visitor's region, and stops the trackers and vendors that should not run. Every decision is saved as evidence, so you can show what happened when a visitor's browser said "opt out."
Turn GPC detection into enforcement.
Scan your site to see which trackers still fire when GPC is on, or book a demo to see ConsentX apply the signal live.
California privacy framework governing consumer privacy rights, including opt-out rights.
A technical mechanism for communicating a consumer's opt-out preference.
Advertising based on personal information obtained from activity across businesses or contexts.
Software used to manage consent and privacy preferences.
The process of obtaining and managing user choices regarding cookies and related technologies.
Obtaining required consent before activating applicable non-essential processing or trackers.
Google's framework for communicating relevant consent states to supported Google tags.
A California privacy-choice mechanism associated with the CCPA opt-out right.
An interface through which users can review or change applicable privacy choices.
The EU's General Data Protection Regulation, including its rules on consent and personal data.