Sec-GPC is the HTTP request header defined by the GPC specification. When the preference is active, its field value is 1. The same preference is exposed to page scripts through navigator.globalPrivacyControl.

Is GPC the same as Do Not Track?

No. GPC communicates a do-not-sell-or-share preference designed to interact with privacy laws. The older DNT signal had a different scope and did not acquire the same California opt-out treatment.

Must a website display a GPC confirmation?

California regulations require a business to display whether it processed the signal, but implementation can vary. AllyProof's visible-acknowledgement observation is only one part of verifying that downstream sale or sharing actually stopped.

Legal & Compliance

Global Privacy Control (GPC) and the Sec-GPC Header

Global Privacy Control (GPC) lets a person express one persistent browser preference instead of finding and operating a separate sale/share opt-out on every website.

The technical signal

The W3C Working Draft defines two surfaces:

Sec-GPC: 1

The browser sends that request header when the preference is enabled. Page JavaScript can read the corresponding navigator.globalPrivacyControl boolean. The signal says “do not sell or share”; it is not a general-purpose consent record and does not by itself explain every jurisdiction's legal effect.

California legal effect

Under the CCPA regulations, a qualifying opt-out preference signal is treated as a request to opt out of sale/sharing. The business must process it for the browser or device and must not require extra information to make it effective, although account-aware treatment and exceptions have detailed rules. Section 7025 also addresses how the site communicates whether the signal was processed.

California enforcement is real: the Attorney General's Sephora settlement included allegations that the business failed to process GPC opt-outs.

What AllyProof tests

The California worker sends both Sec-GPC: 1 and the DOM preference from a California browser. It looks for a visible processing acknowledgement and captures relevant requests and choice controls. No visible acknowledgement normally means Needs review, not automatic failure: the duty can be conditional, a site may acknowledge in a non-obvious interface, and a browser observation cannot prove every downstream recipient stopped sale or sharing.

Official sources

GPC's effect depends on the applicable law and the business's practices. A front-end acknowledgement is valuable evidence, but complete verification also requires downstream processing and vendor controls.

Common questions

What is Sec-GPC?: Sec-GPC is the HTTP request header defined by the GPC specification. When the preference is active, its field value is 1. The same preference is exposed to page scripts through navigator.globalPrivacyControl.
Is GPC the same as Do Not Track?: No. GPC communicates a do-not-sell-or-share preference designed to interact with privacy laws. The older DNT signal had a different scope and did not acquire the same California opt-out treatment.
Must a website display a GPC confirmation?: California regulations require a business to display whether it processed the signal, but implementation can vary. AllyProof's visible-acknowledgement observation is only one part of verifying that downstream sale or sharing actually stopped.

Want to review these signals on your own website?

Run a free compliance check