Imagine having to repeat the same preference every time you enter a different room. That is a useful way to think about one challenge of online privacy: a person may have a consistent boundary, while each website presents a different place to express it. Global Privacy Control, often shortened to GPC, offers a way to communicate certain choices through the browser.

I believe that idea deserves attention. A privacy choice should be understandable and reasonably easy to express. The value of a tool also depends on knowing its purpose, so people can use it without expecting more protection than it provides.

What the signal communicates

The California Attorney General's GPC explainer describes a browser setting or extension that communicates a request to stop the sale or sharing of personal information. It provides an alternative to repeatedly finding and using individual websites' opt-out controls.

Think of the signal as a way of delivering a preference. The browser can communicate it, while the website receiving it has to interpret and handle that request. The legal obligations attached to that process depend on the applicable rules. A broad name such as Global Privacy Control should not be read as a promise of identical rights everywhere.

Where the law gives it meaning

In California, the Attorney General explains that covered businesses must honor GPC as a valid request to stop selling or sharing personal information. The state's CCPA questions and answers clarify that the law protects California residents and has coverage limits and exceptions. In this context, sharing specifically includes using information across different websites to target advertising; it does not mean every possible transfer of information.

Colorado provides another concrete example. According to the Colorado Attorney General's opt-out guidance, since July 1, 2024, organizations within the Colorado Privacy Act's coverage must let Colorado consumers use GPC to opt out of personal-data sales or use for targeted advertising. This is an existing requirement, not a proposal awaiting passage.

These are examples, not a complete inventory of state laws. California and Colorado protections do not automatically give a Florida reader the same statutory rights. Check the guidance for your jurisdiction and the service's published privacy choices before assuming a particular legal result.

A practical place to start

Check whether your browser supports GPC and follow its current instructions. For example, Mozilla's Firefox guide directs desktop users to the privacy section of Settings and the option labeled Tell websites not to sell or share my data. The surrounding section names can vary between versions, so use the guide if your screen looks different.

If you browse on several devices or use more than one browser, review each one. Colorado's guidance specifically notes that GPC needs to be enabled separately for different browsers and devices. Turning it on in one place should not be assumed to configure every other place you browse.

Understand what remains outside its scope

Mozilla cautions that sending GPC does not itself block tracking, and some websites may ignore the signal. It is therefore useful to distinguish communicating a request from technically preventing a connection. A setting that expresses your preference is not proof that every recipient has acted on it.

The W3C's GPC Working Draft, dated June 11, 2026, also explains that GPC is not designed to exercise deletion rights or stop every form of data collection and advertising. The technical document remains a work in progress. Its draft status is separate from the existing state requirements described above.

If your goal is to obtain a copy of your information or request deletion, look for the service's instructions for that particular request. Do not assume the browser signal has completed those tasks. Being specific about the outcome you want makes privacy controls easier to evaluate.

Why simpler choices matter

In my view, good privacy design should reduce the effort needed to express a considered decision. Someone should be able to understand what a control communicates and find a clear explanation of how a service responds to it. That is a reasonable expectation to bring to a privacy policy or settings page.

GPC makes that discussion concrete: can a service recognize a clear preference and explain what happens next? Privacy advocacy can help keep that question visible. Clearer tools, accurate explanations, and meaningful responses all deserve a place in the conversation.

General information for education and awareness, not legal advice. Rights depend on jurisdiction, coverage, and applicable exceptions. Browser controls can change. Sources reviewed September 7, 2026.

Explore privacy articles