Our demo store is set up to honor Global Privacy Control. Its consent log had five records in it, and every one of them said the signal was absent. Nothing was broken. It took me a minute to work out why, and the answer is the most useful thing I know about GPC.
All five visits came from Chrome. Chrome does not send the signal.
Global Privacy Control is a way for a browser to say “do not sell or share my personal information” once, on the visitor’s behalf, on every site they load. They set it and then stop thinking about it. That is the whole idea, and it is a good one, because the alternative is asking people to find a link on every site they visit and fill in a form.
It arrives in two forms. A browser with the preference on adds a header, Sec-GPC: 1, to its requests, so your server can see it before it sends any HTML. In the page, navigator.globalPrivacyControl is true for the same visitor. Either one is easy to read. Nothing in the browser blocks trackers, though, and Mozilla says so plainly in its own documentation. The signal notifies your site, and what happens next is entirely up to your code.
Why your log is probably quiet too
Two browsers send it by default, and neither is one most people use. Brave sends it. So does DuckDuckGo. Firefox supports it but leaves it switched off until someone goes looking: on Windows and Linux the checkbox is under Settings, then Privacy and Security, down in Additional protections, labelled “Tell websites not to sell or share my data”. On macOS the same box sits under Website Privacy Preferences. Firefox for Android has it too.
Safari does not have the setting at all. Apple never implemented it, and the extension options there are thin.
And Chrome, which is most of your traffic, sends nothing unless the visitor installs an extension. The Network Advertising Initiative publishes one. Privacy Badger, OptMeowt and Disconnect set the signal as well. Almost nobody does this, which is why a log full of false is the normal result rather than a symptom of anything.
That is changing on a fixed date. California passed AB 566, the Opt Me Out Act, and the governor signed it on 8 October 2025. From 1 January 2027 browsers serving California users have to include a built-in setting for sending an opt-out signal, easy for an ordinary person to find. Chrome, Safari and Edge all have to ship one. So the trickle of signals your site sees today is not a good guide to what it will see in 2027.
What it looks like when one does arrive
I turned the Firefox setting on and loaded the store again. The new record came back with gpcSignal: true. Same site, same banner version, same jurisdiction as the five Chrome visits before it. Marketing and statistics were both refused and all nine third-party services under them stayed off, leaving only Stripe running under the essential category.
One field moved that I had not touched. doNotSell also reads true. The banner script falls back to the GPC value when there is no separate Do Not Sell request, so the visitor never found a link and never opened a form. One checkbox in a browser, set once and then forgotten, and the site recorded an opt-out on their behalf.1
An arriving signal carries the same request your opt-out link exists to collect, and it gets there before the visitor has looked at your page.
How to check your own site
Look at what got recorded, not at what should have arrived. In ConsentLayer every consent record carries a gpcSignal field next to the categories the visitor allowed, the jurisdiction applied, the banner version they saw, and a truncated IP with the last octet removed. The consent log lists them and exports to CSV.
Then go and produce a real signal, because you cannot test this with the browser you already have open. Turn the Firefox setting on, or open your site in Brave, load a page, make a choice on the banner, and read the record. If gpcSignal comes back false on a visit you know sent it, something between the browser and your log is dropping it. If it comes back true and your trackers ran anyway, then you are detecting the signal and ignoring it, which is a worse position than never reading it.
Do you actually have to honor it?
Maybe not, and the number you will see quoted is too high. Twelve states get named regularly. We read the statutes instead of another vendor’s summary, and ten of them put it beyond argument: California, Colorado, Connecticut, Delaware, Minnesota, Montana, New Hampshire, New Jersey, Oregon and Texas.
The other two are softer than their reputation. Maryland’s Online Data Privacy Act, at Com. Law § 14-4607(f)(3), says a controller “may utilize” the following methods, then lists a clear and conspicuous website link or an opt-out preference signal, joined by “or”. They are alternatives, and the binding duty in (f)(1) asks only for “one or more secure and reliable methods”. The signal option carries its own deadline of 1 October 2025, which is probably how Maryland ends up counted: a tracker finds a date attached to an opt-out signal and files the state as requiring one, when the date governs a method the controller can decline to use.
Nebraska handles browser signals through its authorized-agent provision at Neb. Rev. Stat. § 87-1111(5), which covers a “browser setting or extension, or a global setting on an electronic device” but obliges a controller only where it can verify “the identity of the consumer and the authorized agent’s authority”. Subsection (5)(d) then removes the duty entirely from a controller that does not already process such requests to comply with another state’s law. Honor GPC because of Colorado and you will honor it for Nebraskans as a side effect, which is not the same as Nebraska asking you to.
Eight more states have comprehensive privacy laws that ask for no signal at all, Virginia, Utah and Indiana among them. They want a disclosed opt-out method, which in practice means a link.
Colorado is the one place a regulator has named the technology. The Colorado Privacy Act makes the Attorney General publish a list of the mechanisms controllers must detect, and that page currently says GPC is the only one it considers valid. There is enforcement history too: on 24 August 2022 the California Attorney General settled with Sephora for $1.2 million, the first public CCPA action, and the allegations included failing to process opt-outs sent through user-enabled global privacy controls.
The two states I have called softer than their reputation are exactly the kind of question to put to a lawyer rather than a vendor, and the disclaimer at the bottom of this page is not a formality where those two are concerned.
Making it work
You do not have to wire this up yourself. ConsentLayer runs an MCP server, so a coding agent like Claude Code or Cursor can do it. One command connects it:
npx -y @consentlayer/mcp setupThen say what you want in ordinary words. Ask it to set up consent for your site and honor GPC, and it creates the site, scans your pages for whatever is already tracking people, sorts those scripts into categories, switches the setting on, and hands back the line you paste into your page. Ask it to read the configuration back and it will tell you what it did.
There is one judgement call left, and it is about your visitors rather than your code. GPC expresses an opt-out, which is the default posture in the US states above. GDPR expects consent before non-essential tracking in the first place. The same signal lands in two different regimes, so a single global setting will get one of them wrong. Our demo store splits it geographically: European visitors see nothing non-essential until they choose, and Californian visitors get the opt-out arrangement with the signal respected. You can ask for that split in words.2
If you do one thing after reading this, go and see whether your own log has ever recorded a true. Ours had not, across every record in it, and the configuration was correct the whole time.
You can create a site and read your own consent log on the free plan at app.consentlayer.com/register. If you want the other side of this, we wrote about Do Not Sell requests when we shipped them, and about the CIPA demand letters that come from tracking which runs before anyone has agreed to it.
Notes
1. The check in the banner script is strict: it tests navigator.globalPrivacyControl === true, then treats the signal as honored only if the site’s own setting has not been turned off. Worth copying if you read the property yourself, because a missing property and a false one mean different things.
2. If you want the “Your Privacy Choices” link as well, add the consentlayer-do-not-sell class to an ordinary anchor pointing at the hosted form. The banner script listens for clicks on that class and calls preventDefault(), so the link still works for anyone whose JavaScript failed to load. The specification also lets you publish a small file at /.well-known/gpc.json declaring that you honor the signal. It is optional, and the reference version is two fields: {"gpc": true, "lastUpdate": "2021-05-13"}.
A note on legal advice
ConsentLayer is a tool, not a law firm, and nothing above is legal advice. This article describes how a technical signal behaves and reports what published statutes and regulators say, with the provisions cited so you can read them yourself. It does not tell you what any law requires of your business. Whether these laws apply to you depends on facts this article cannot see, including where your visitors are, what you do with their data, and who you share it with. The readings of Maryland and Nebraska here are ours, taken from the statutory text, and they depart from figures you will find elsewhere. Please talk to a qualified attorney about your own situation before relying on any of it.