# Global Privacy Control

> A browser signal asking websites not to sell or share the visitor's personal data.

Source: https://datacenter.so/glossary/global-privacy-control
Also called: GPC, Sec-GPC, opt-out preference signal.

Global Privacy Control (GPC) is a preference the visitor sets once in their browser or an extension. The browser then sends it to every site in two ways: a `Sec-GPC: 1` header on each request, and a `navigator.globalPrivacyControl` property that page scripts can read ([W3C](https://www.w3.org/TR/gpc/)).

It is a "do not sell or share" signal, not a consent banner answer. Its weight comes from law. In California, regulations under the CCPA require a business to treat a qualifying opt-out preference signal such as GPC as a valid request to opt out of sale and sharing ([CPPA](https://cppa.ca.gov/regulations/)). Other US states are adopting similar rules, so check each state where you have customers.

For measurement, the signal matters most where data leaves your site for advertising: ad pixels, retargeting audiences and server-side sends such as a [Conversions API](https://datacenter.so/glossary/conversions-api). A site that honors GPC stops those for that visitor. Whether analytics kept only by the site itself counts as a sale or share depends on the setup and the state, so check with counsel.

## Related terms

- https://datacenter.so/glossary/consent-mode
- https://datacenter.so/glossary/third-party-cookie
- https://datacenter.so/glossary/conversions-api