Global Privacy Control for ecommerce: what GPC signals mean for your store

In August 2022, the California Attorney General Rob Bonta announced a $1.2 million settlement with Sephora for violating CCPA. The core violation: Sephora failed to honor Global Privacy Control (GPC) signals from browsers as opt-out requests. This was the first major enforcement action focused specifically on GPC compliance, and it put the industry on notice.

GPC is a browser-level signal that tells websites a user wants to opt out of the sale and sharing of their personal information. It is not advisory. In California, Colorado, Connecticut and several other US state privacy laws, honoring GPC is a legal requirement. If your ecommerce store uses advertising pixels, retargeting or behavioral analytics, GPC affects you.

What Global Privacy Control is

Global Privacy Control is a privacy signal specification developed by a coalition that includes Mozilla, DuckDuckGo, the Electronic Frontier Foundation, the New York Times and others. The goal was to create a universal browser-level mechanism for users to opt out of data sale and sharing, without requiring them to visit each website individually and interact with a cookie banner.

The GPC signal communicates a single preference: "Do not sell or share my personal information." It is designed to be sent automatically by browsers and browser extensions that respect the user's configured privacy preferences, eliminating the need for per-site action.

The specification is hosted at globalprivacycontrol.org and is recognized by California CPRA, the Colorado CPA, the Connecticut CTDPA, Montana's MCDPA, Oregon's OCPA and several other state laws.

How GPC works technically

GPC operates via two mechanisms:

• HTTP request header. When a GPC-enabled browser loads your website, it includes an HTTP header in the request: Sec-GPC: 1. This header is sent with every HTTP request, including page loads and API requests. Your server can read this header and adjust data processing behavior accordingly.
• JavaScript property. GPC-enabled browsers expose the signal via JavaScript as navigator.globalPrivacyControl. When this property is true, the user has enabled GPC. Client-side code and tag managers can check this property and suppress tracking scripts or data sharing calls accordingly.

The well-known resource at /.well-known/gpc.json allows a site to publish its GPC support status. A GPC-compliant site should serve a JSON file at this path that declares its support. This is not strictly required for compliance but is part of the specification.

Which browsers and extensions send GPC

GPC is not yet a default browser feature in Chrome or Safari, which dominate market share. Current GPC-enabled browsing environments:

• Firefox. GPC support is built into Firefox 120 and later. Users can enable it via the Enhanced Tracking Protection settings. It is not on by default in standard mode but is on by default in Strict mode.
• Brave browser. GPC is enabled by default for all Brave users. Brave has a significant privacy-conscious user base, particularly among tech-aware consumers.
• DuckDuckGo Privacy Browser. GPC enabled by default on the DuckDuckGo mobile browser and desktop browser extension.
• Chrome extensions. The GPC extension from Privacy Badger (EFF) adds GPC support to Chrome. OptMeOwt adds it to Chrome, Firefox and Edge.
• Safari. Safari does not natively support GPC as of late 2026, though this may change as regulation pressure increases.

Brave alone accounts for an estimated 60-80 million monthly active users globally. For ecommerce stores, particularly those targeting tech-aware, privacy-conscious consumers, the proportion of visitors sending GPC signals can be significant: 5-15% in some demographics. For a $20M revenue store, that is a non-trivial number of transactions where incorrect GPC handling creates legal exposure.

Legal status of GPC by jurisdiction

The legal requirement to honor GPC varies by state:

• California (CCPA/CPRA). The California Privacy Protection Agency's regulations explicitly state that businesses must honor GPC as a valid opt-out of sale and sharing of personal information. Non-compliance is enforceable and was the basis for the Sephora settlement.
• Colorado (CPA). Colorado's implementing regulations require businesses to process opt-out requests submitted via GPC and other universal opt-out mechanisms (UOOMs). Colorado's approach is technology-neutral: GPC is one recognized UOOM, but the obligation is to recognize any UOOM that meets the specification criteria.
• Connecticut (CTDPA). Similar to Colorado. GPC recognition is required as part of the opt-out obligations.
• Montana (MCDPA). Includes universal opt-out mechanism recognition requirements similar to Colorado.
• Oregon (OCPA). Recognizes GPC as a valid opt-out mechanism.
• Texas (TDPSA). Does not explicitly require GPC recognition but requires opt-out mechanisms for sale and targeted advertising. GPC recognition would satisfy those requirements but is not mandated.
• Virginia (VCDPA). Does not require GPC recognition. Opt-out can be through other mechanisms.
• Most other states. Either silent on GPC or do not mandate it. Implementing GPC support proactively is recommended as laws evolve.

The Sephora case in detail

The California AG's August 2022 Sephora settlement established the enforcement template for GPC non-compliance. The allegations:

• Sephora allowed advertising and analytics vendors to collect and sell consumer personal information for behavioral advertising purposes.
• Sephora did not disclose this as a "sale" of personal information in its privacy policy.
• Sephora did not process opt-out requests sent via GPC signals.
• Sephora did not honor opt-out requests submitted through its privacy portal within the required 15-day period.

The settlement included $1.2 million in fines and a two-year injunction requiring Sephora to implement a service provider program compliant with CCPA, update its privacy policy and implement GPC recognition.

The AG's office announced the settlement alongside investigations of 100 additional companies across retail, travel, food services and other sectors. Many of those companies received cure notices and were required to implement GPC support to avoid further action.

The key lesson: regulators do not expect perfection in GPC implementation immediately. They do expect companies to be making good-faith efforts. Doing nothing about GPC is a significant enforcement risk.

What "honoring" GPC means practically

Honoring a GPC signal means treating it as a valid opt-out from the sale and sharing of personal information. In practical terms for an ecommerce store:

• Suppress targeted advertising pixels. Do not fire Meta Pixel, Google Ads conversion tracking, TikTok Pixel or other advertising trackers for users who send GPC signals. These trackers enable retargeting and constitute "sharing" under CCPA.
• Stop sharing data with advertising platforms. Do not upload customer data to advertising custom audiences for users who have sent GPC signals. Do not share order data with advertising pixels for conversion attribution for those users.
• Adjust analytics data sharing. Google Analytics 4's default configuration shares data with Google for advertising purposes. For GPC users, ensure this sharing is disabled (configurable in GA4 settings per user consent state).
• Do not sell customer data. If your business model involves any data sales to third parties, exclude GPC users from those data transfers.
• Preserve non-sharing analytics. First-party analytics that does not involve sharing data with third parties and is not used for targeted advertising is generally not affected by GPC. Server-side analytics without third-party sharing can continue for GPC users.
• Ecommerce functionality is unaffected. GPC does not prevent you from using a customer's data for transaction processing, customer service, fraud prevention or fulfillment. It only applies to sale and sharing, not to the processing necessary to complete a purchase.

How to detect and honor GPC

There are several implementation approaches depending on your stack:

• Via your CMP. Most modern CMPs (Osano, Cookiebot, Usercentrics, Didomi, OneTrust) support GPC detection and will automatically adjust consent state to opt-out when a GPC signal is detected. This is the recommended approach: your existing consent management infrastructure handles GPC alongside other consent signals. Configure your CMP to treat GPC as an opt-out from sale/sharing categories.
• Via Google Tag Manager. You can detect the GPC signal in GTM using a custom JavaScript variable that reads navigator.globalPrivacyControl. Create a trigger that fires only when this variable is false or undefined, and block advertising tags from firing when it is true. Note: this requires GTM-based tag blocking to already be working correctly, which has its own PCI implications.
• Via server-side code. Read the Sec-GPC: 1 header in your server middleware. When present, suppress server-side data sharing calls and set a session flag that downstream systems can use to adjust data handling. This is more reliable than client-side detection for users who block JavaScript.
• Via Google Consent Mode v2. If you use Google products (GA4, Google Ads), implement Google Consent Mode v2. Configure it to set ad_storage and ad_personalization to "denied" for GPC users. See our Consent Mode v2 implementation guide for details. This prevents advertising-related data collection and sharing via Google products.

The /.well-known/gpc.json file

The GPC specification includes an optional machine-readable file at /.well-known/gpc.json that declares whether your site honors GPC. The file structure is simple:

A compliant gpc.json contains a gpc boolean set to true and a lastUpdate date. Publishing this file is not legally required by any current state law but demonstrates proactive GPC compliance and may be considered by regulators as evidence of good-faith effort. It takes minutes to implement and carries no technical risk.

Implementation guide

A practical implementation sequence:

• Audit your current tracking setup: list every advertising pixel, analytics tool and data-sharing integration on your site.
• Configure your CMP to recognize and honor GPC if it supports it (most major CMPs do). Set the GPC response to opt out of sale/sharing categories.
• If you do not have a CMP, implement server-side Sec-GPC header detection in your middleware. Block advertising pixel server-side calls when the header is present.
• Configure Google Consent Mode v2 to deny ad_storage and ad_personalization when GPC is present.
• Test GPC detection by enabling Brave browser or the Firefox GPC setting, browsing your site and verifying that advertising pixels do not fire in the network tab.
• Update your privacy policy to state that you honor GPC signals.
• Publish a /.well-known/gpc.json file declaring GPC support.
• Document your implementation for compliance records.

GPC and first-party data strategy

GPC and the broader shift toward privacy-by-default browsing are accelerating the move to first-party data strategies. As third-party cookies deprecate (Chrome's deprecation timeline shifted but the direction is clear) and GPC adoption grows, advertising strategies built on third-party data sharing become less reliable.

Ecommerce stores that invest in first-party data collection (email and SMS subscriptions, loyalty programs, owned channels) are both more GPC-compliant and more resilient to the long-term direction of browser privacy. Adopting a privacy by design approach makes GPC compliance a natural outcome rather than a retrofit. GPC compliance is not just a legal checkbox; it is an indicator that your data strategy is aligned with where the market is going.

Frequently asked questions

Is honoring GPC legally required for ecommerce stores?

Yes, in California, Colorado, Connecticut, Montana and Oregon. These states explicitly require businesses to treat GPC signals as valid opt-out requests for the sale and sharing of personal information. Sephora was fined $1.2 million partly for ignoring GPC.

How does GPC work technically?

GPC operates via two mechanisms: an HTTP header (Sec-GPC: 1) sent with every request and a JavaScript property (navigator.globalPrivacyControl). Your server or client-side code reads these signals and suppresses advertising trackers and data sharing for that visitor.

Which browsers send GPC signals?

Brave sends GPC by default for all users. Firefox supports GPC in Strict mode. DuckDuckGo Privacy Browser enables it by default. Chrome users can add GPC via extensions like Privacy Badger. Safari does not natively support GPC as of late 2026.

Does GPC block all tracking on my store?

No. GPC only covers the sale and sharing of personal information. First-party analytics without third-party sharing, transaction processing, customer service and fraud prevention are unaffected. Only advertising pixels and cross-context behavioral data sharing must be suppressed.