What is Global Privacy Control, and how do you test it on a storefront?

Not legal advice

This article explains Global Privacy Control as a technical browser signal and how to test it on a storefront. It is not legal advice, not a CPRA compliance guarantee, and not counsel on whether any business must honor GPC. Readers should talk to their own counsel about California obligations.

A signal on the request shows what the browser sent. It does not, by itself, show that the storefront changed cookies or third-party requests. Last updated September 22, 2026.

Short answer

Global Privacy Control (GPC) is a browser signal that tells a site the visitor wants to opt out of the sale or sharing of personal information. Browsers that support it send a Sec-GPC: 1 HTTP header, and some also expose a matching value in page JavaScript. To test it on a storefront, enable GPC in a clean browser profile, load the shop without clicking the banner unless your plan requires a click, and compare cookies and third-party ad or analytics requests with a GPC-off visit to the same URL.

This page teaches what GPC is, how to enable it, and how to run that paired storefront test. The GPC versus CMP claims guide covers mismatch diagnosis when the banner says the signal was detected and the network still matches the GPC-off visit. Save both runs and open that guide for the diagnosis.

What GPC is

GPC is a preference the browser sends for the visitor. The W3C Global Privacy Control specification describes the signal, over HTTP and through the DOM, as a request that sites not sell or share the person's personal information. Read that specification and the Global Privacy Control site for the wording.

You can confirm the browser sent the signal and still find the same advertising requests as the GPC-off visit. Record those as separate facts. A marketing line that says the store honors GPC is a claim. The paired visits are the check.

• The visitor's preference: opt out of sale or sharing, in plain language.
• The browser's signal: Sec-GPC: 1 on requests, and sometimes navigator.globalPrivacyControl in JavaScript.
• The site's response: which cookies, storage keys, and third-party requests change when the signal is on.

The Sec-GPC header

On a GPC-on visit, open DevTools, select the document request for the page you loaded, and read the request headers. Look for Sec-GPC: 1. The W3C specification defines that field value as 1 when the preference is set. A missing header means this visit did not send the signal, so do not label the file GPC-on.

A redacted document request can look like this: host shop.example, path /products/example-tee, request header Sec-GPC: 1. Strip cookie values and query secrets before you share the screenshot or the HAR snippet. The example host is illustrative. It is not a live store capture.

Some stacks also expose navigator.globalPrivacyControl in page JavaScript. On the same visit, open the console and read that value. A true result is an optional check. File the header from the document request. A console value without the header is an incomplete GPC-on record.

How shoppers enable GPC

Use a dedicated clean profile. Extensions, logins, and leftover consent cookies pollute the cookie table. Close other windows in that profile before you load the shop.

As of September 22, 2026, the Global Privacy Control site lists Brave and DuckDuckGo with the signal on by default, and Firefox with the signal available in privacy settings. Chrome and similar browsers typically need a GPC extension, because they do not ship the same built-in control. Menu labels move. Enable the capability, then confirm Sec-GPC: 1 on the document request before you record cookies or pixels.

Write down the browser and the enable method. If the document request lacks Sec-GPC: 1, fix the profile before you record the rest of the visit.

Storefront test: two isolated runs

Prepare two clean profiles. Use the same public URL, a similar time of day, and no logged-in account unless that path is the test. Write down the region you actually used. A California conclusion needs a California-context run. A free US-baseline visit sits outside that path. Leave the banner untouched unless the written plan requires a click. Change only the GPC signal.

1. Run A, GPC off. Load the homepage, wait for the banner, and do not click it. Export cookies, storage, and third-party requests. Screenshot the banner. Repeat on one product URL if that template is in scope.
2. Run B, GPC on. Use a new profile. Confirm Sec-GPC: 1 on the document request. Optionally read navigator.globalPrivacyControl in the console. Record the same cookies, storage, and requests.
3. Diff the runs. List vendors and cookies present in both, tags you expected to drop on GPC-on that stayed, and any CMP detected state that arrived without a network change.
4. Save the URL and timestamps. Strip identifier query values before you send the pack.

CMP copy and the network

A CMP line that says GPC was detected is an interface state. Suppression is a smaller set of cookies and third-party requests on the GPC-on run than on the matched GPC-off run. Record both. If the detected line is on screen and the request list still matches GPC-off, you have a claims-versus-runtime gap.

Open the GPC versus CMP claims guide for the mismatch table. Open the runtime audit versus CMP guide when banner copy and the wire disagree on reject or accept as well. Record the CMP vendor only so engineering can find the integration.

California observation

Many operators who sell to California shoppers treat GPC as a sale or share opt-out signal in day-to-day storefront work. Obligations vary by business. This section is a testing note. It is not legal advice, and it is not a statement that every site must honor the signal. Talk to your own counsel before you publish a claim about California shoppers.

If the store says it honors GPC for California shoppers, prove that sentence with the paired runs, on a California-context path, with the header confirmed. A free US-baseline visit records one non-California pass. It does not produce a California GPC conclusion. Read the free versus paid guide before you file that report as a GPC result. The SB 690 page covers lawsuit status. It does not run this comparison.

Evidence pack

Label every artifact GPC-off or GPC-on. Include the cookie table, storage keys, the request URLs you are asking engineering to review, a screenshot or HAR snippet that shows Sec-GPC: 1, a screenshot of the CMP when it shows a detected state, the URL, the browser, and the timestamps.

ConsentProbe maps findings to the request, the cookie, and the screenshot. The California scenario stores the GPC-off visit next to the GPC-on visit.

DIY compared with a California GPC scenario

Use the DIY pair to learn the signal. Use the saved California scenario when you need a repeatable pack tied to requests, cookies, and screenshots.

Save the paired visits

Run ConsentProbe's California scenario when you need the GPC-off and GPC-on visits stored on the storefront URL. A free US-baseline visit remains a format check. This page is technical testing guidance, not legal advice.

FAQ

Related guides

Use the GPC versus CMP claims guide when a detected state and the request list disagree. Use the free versus paid guide before a US-baseline file stands in for a California result.

• GPC vs CMP Claims: How to Spot a Mismatch
• What does a free US-baseline cookie audit prove vs paid EU or California scans?
• Runtime Audit vs CMP: What Each One Measures
• What does California SB 690 change for website tracking lawsuits?
• Pre-Consent Cookie Audit: A Storefront Checklist
• Testing Global Privacy Control on a California Storefront
• ConsentProbe methodology
• Pricing and listed regional products