# Global Privacy Control: The Browser Signal Your Banner Cannot Ignore Source: https://cookiecitadel.com/blog/2026-11-11-global-privacy-control-signal-banner.html [Home](../index.md) / [Blog](index.md) / Global Privacy Control: The Browser Signal Your Banner Cannot Ignore Published 2026-11-11 A visitor arrives with Global Privacy Control turned on. Their browser sends a signal with every request: Sec-GPC: 1. The signal says do not sell or share my personal data. The site shows a cookie banner and asks the visitor to choose. The visitor already chose, before the page loaded, in a setting that applies to every site they visit. The banner is asking a question that has been answered. Global Privacy Control is a browser-level opt-out signal, and in California and a growing list of US states, the law treats it as a valid request to opt out of the sale or sharing of personal data and of targeted advertising. Websites covered by those laws must honor it automatically, without asking the visitor to click anything. A banner is not a substitute. The Kukie guide puts it plainly: under the CCPA regulations, a business that sells or shares personal information must treat the GPC signal as a valid opt-out for that browser or device and for any profile linked to it. ## What the signal actually is GPC is a setting in the browser, not a cookie and not a banner choice. When it is on, the browser sends the Sec-GPC: 1 header with every request and exposes it to scripts as navigator.globalPrivacyControl. Brave, DuckDuckGo, and Firefox build it in. Chrome does not yet, which matters, because the visitors who send the signal are the ones who went out of their way to turn it on, and they are also the ones most likely to notice when a site ignores it. The legal weight comes from the CCPA regulations, 11 CCR section 7025, which require businesses that sell or share personal information to treat the signal as a valid opt-out request. The California Attorney General has enforced it: the 2022 Sephora settlement, 1.2 million dollars, included the company's failure to process opt-outs sent through GPC. The Ketch compliance guide adds the timeline: as of January 1, 2026, twelve US states require businesses to honor opt-out preference signals, and California's Opt Me Out Act, signed in October 2025, requires browsers to offer a built-in opt-out signal setting from January 1, 2027, so GPC traffic is expected to grow. ## What honoring it actually requires Three obligations follow from the signal. First, stop selling and sharing as soon as feasibly possible, and no later than 15 business days. Second, honor it beyond new collection: the opt-out has to reach data already collected and already flowing to third parties, not just stop the tap going forward. Third, honor it beyond the device it arrived on, whether or not the person is logged in, when the business can associate the browser, device, or profile with a person by any reasonable means. A banner or cookie control tool, by itself, is not an acceptable way to process an opt-out of sale or sharing. The regulation says so in so many words. The common failure is treating GPC as a banner preference. A site that reads the signal and then shows a banner asking the visitor to confirm has not honored the signal. It has added a step to a right the law says must be automatic. The correct behavior is to apply the opt-out the moment the signal is detected, record that it was honored, and let the visitor change their mind later if they want to, not the other way around. ## The test that takes five minutes Open the site in Firefox or Brave with GPC enabled, and watch the network tab. The site should detect the signal on the first request, apply the opt-out, and log it. Then check the new California requirement: since the updated regulations took effect on January 1, 2026, the business must also show on its website whether it has processed the signal, for example with an Opt-Out Request Honored message. If the site shows nothing, or shows a banner asking the visitor to choose, the signal is not being honored. Then check the downstream systems. The opt-out has to reach the ad platforms, the analytics vendors, and the data partners, not just the banner. A site that honors GPC on the front end and keeps sharing the visitor's data with a third party on the back end has honored nothing. The test for that is the vendor list: every downstream recipient of the visitor's data should have received the opt-out, and the record should show when. Keep reading: [what the consent mode numbers mean](https://cookiecitadel.com/blog/2026-11-09-consent-mode-modeling-what-numbers-mean.md), [reading the TCF consent string](https://cookiecitadel.com/blog/2026-11-07-tcf-consent-string-read.md), and [consent version history as evidence](https://cookiecitadel.com/blog/2026-11-05-consent-version-history-evidence.md) cover the nearby cases in this series. ## Frequently asked questions ### What is Global Privacy Control? A browser setting that tells every website a visitor opens not to sell or share their personal data. The browser sends it as the Sec-GPC: 1 header and exposes it to scripts as navigator.globalPrivacyControl. Brave, DuckDuckGo, and Firefox build it in. ### Does my site have to honor GPC? If the site is covered by the CCPA or one of the other state privacy laws that require opt-out signals to be honored, yes. As of January 1, 2026, twelve US states require it, and California has enforced it, including the 1.2 million dollar Sephora settlement. ### Is showing a banner enough when a visitor sends GPC? No. A banner or cookie control tool, by itself, is not an acceptable way to process an opt-out of sale or sharing. The opt-out has to be applied automatically when the signal is detected, and the site has to show whether it was processed. ### How do I test whether my site honors GPC? Open the site in Firefox or Brave with GPC enabled and watch the network tab. The site should detect the signal on the first request, apply the opt-out, and log it. Then check that the opt-out reached the downstream vendors, not just the banner.