Global Privacy Control lets one setting apply across websites

What it is

Global Privacy Control (GPC) lets a person express a do-not-sell-or-share preference once in a browser or other user agent and convey it to websites. The current W3C Working Draft defines an HTTP Sec-GPC: 1 signal and a DOM navigator.globalPrivacyControl property. It scales preference communication; it does not make the browser delete every site's data.

Why it happens

Finding an opt-out on every site creates repeated privacy labor, and each interface can add different vocabulary and friction. A common machine-readable signal decouples preference from site design, allowing recognition on the first HTTP request and script access to a Boolean consistent with top-level navigation. This solves scalable expression; execution still depends on implementation, relationship, and applicable rules.

Studying it

Toggle GPC in a controlled user agent and instrument multiple sites. Inspect Sec-GPC on navigation and subresources, the DOM property, site display, backend preference, and subsequent flows. Ask participants what the signal stops and does not stop to detect false omnipotence. A transmitted header proves communication, not compliance.

Where it stops holding

GPC addresses do-not-sell-or-share and cross-context advertising preferences, not global deletion or necessarily every first-context collection and use. The specification is an evolving W3C Working Draft, and legal effect varies with jurisdiction, location, and relationship. The signal does not universally require a manual per-user opt-in: choosing a tool that clearly defaults to GPC because that matches its users' privacy expectations can also express preference. The test is whether tool choice, explanation, and default accurately represent the person and meet applicable prerequisites.

Applying it

• Explain GPC scope in the user agent and let people inspect whether it is being sent to the current site.
• Test that enabled GPC sends Sec-GPC: 1 and exposes DOM true; disabled or unset state omits the header rather than sending Sec-GPC: 0 and exposes DOM false.
• Test top-level-navigation caching separately: a mid-navigation preference change leaves the current document consistent and appears after reload or the next top-level navigation.
• On receipt, show recognition, applicable scope, relation to site choices, and uncovered behavior rather than “privacy protected.”
• Verify transmission, server recognition, preference persistence, and downstream behavior separately.

Related

• Same group: O2.11.1 Persistent cross-device and cross-session opt-out · O2.11.3 Opt-out versus stopping collection · O2.11.4 Limits of voluntary compliance
• Adjacent: O2.05 Tracking transparency · O2.13 Disclosure of third-party data sharing
• Search terms: Global Privacy Control · Sec-GPC · universal opt-out signal