Global Privacy Control: the signal most websites ignore

There is a signal that millions of browsers send with every single page view and that the vast majority of websites simply disregard. It is called Global Privacy Control, GPC for short. Ignoring it breaches applicable law in California — and the first case in which this was enforced cost 1.2 million dollars.

What the signal says

GPC is a technical declaration with a single content: this person objects to the sale and sharing of their personal information.

The idea behind it is compellingly simple. Instead of ticking boxes again on every website, you set the preference once in the browser — and it then sends it to every site you visit. For the user this means: decide once instead of clicking a hundred times.

Importantly, what GPC does not do: it blocks nothing. The signal is a message, not a technical barrier. The website learns of the objection — implementing it is its own job. Anyone doing nothing still receives the signal and simply ignores it.

Who sends it

More people than most assume:

• Firefox has the setting built in, under privacy and security
• Brave sends it by default
• The DuckDuckGo browser likewise
• Chrome, Safari and Edge do not send it by default but can be equipped via extensions such as Privacy Badger

Anyone who has enabled it sends it to all websites — including yours. The signal has long been arriving, regardless of whether anyone evaluates it.

Where it binds legally

Precision pays here, because the picture is uneven.

In the USA, GPC is binding. California stipulates in the CCPA as amended by the CPRA that websites must honour user-enabled opt-out signals. Colorado, Connecticut and further states have enacted comparable rules. Implementation is neither optional nor negotiable: whoever receives the signal must treat the objection as though the person had actively clicked a link.

In Switzerland and the EU it is not. Neither the revised Swiss FADP nor the GDPR mentions Global Privacy Control explicitly. Article 21(5) GDPR is interesting nonetheless: it expressly provides that data subjects may exercise their right to object "by automated means using technical specifications". That describes fairly precisely what GPC does — it has simply not been recognised as such so far.

Anyone honouring the signal in Europe therefore does more than required. From our point of view, that is no disadvantage.

The case that made it real

In August 2022, the Californian Attorney General settled with Sephora for a payment of 1.2 million US dollars — the first public enforcement of the CCPA at all. The company was accused, among other things, of not implementing objections made via Global Privacy Control.

Two details from the case are instructive:

First, the breach was not that Sephora sold data. The breach was receiving the signal and doing nothing with it. The authority argued that a received and ignored signal is a disregarded objection.

Second, the settlement included an obligation to report regularly to the Attorney General on how GPC signals are handled. It did not end with the payment — a duty of proof followed.

California has since brought further proceedings. The message is consistent: the signal counts.

How a website detects it

Technically the effort is minimal. GPC arrives in two ways:

In the browser via a property that is then true:

if (navigator.globalPrivacyControl === true) {
    // This person has objected
}

On the server via an HTTP header sent with every request:

Sec-GPC: 1

Both are evaluated in a few lines. The actual work lies not in detecting it, but in the consequence: the objection must feed into the consent logic, the corresponding scripts must not load, and the result must be communicated outward — for US traffic via the Global Privacy Platform, so that advertising partners learn of the objection too.

What an objection has to switch off

A common mistake is treating GPC like a GDPR refusal and switching everything off. That misses the purpose.

An objection under Californian law is directed against sale, sharing and targeted advertising. It is not directed against audience measurement for one's own purposes — that does not count as a sale there. Anyone switching everything off on GPC loses data they would be allowed to keep. Anyone switching off only what is necessary meets the rule precisely.

A second mistake: treating the signal as a default that can be overridden. If someone sends GPC, the objection has been declared. A banner that nonetheless asks for agreement and treats it as valid undermines it.

How Aiara handles it

As soon as the US opt-out model is enabled for a domain, the banner evaluates the signal before displaying anything. If it is set, the objection applies immediately — without asking, without a click.

This becomes visible in three places. Marketing scripts do not load. The selection window carries a note that the browser signal was detected and already honoured. And the corresponding switch is locked, because there is nothing left to decide — renewed agreement would override the declared objection.

Outward, the decision is communicated via the Global Privacy Platform so that advertising partners learn of it as well.

Is it worth it for Swiss websites?

It is not mandatory here. But there are two good reasons to honour the signal anyway.

The practical one: as soon as you have visitors from the USA and fall under one of the state laws there, it is a duty. Few Swiss SMEs reach that threshold — but those who do often notice only when an enquiry arrives.

The fundamental one: somebody took the trouble to set a preference in their browser settings. That person has declared their will unmistakably. Ignoring them because no law here compels otherwise is legally defensible — convincing it is not.