| name | global-privacy-control |
| title | Implementing Global Privacy Control (GPC) |
| description | Implementation guide for Global Privacy Control (GPC) automated opt-out signal per CPRA Section 1798.135(e). Covers Sec-GPC HTTP header detection, JavaScript navigator.globalPrivacyControl API, and state-specific requirements for CA, CO, CT, MT, TX, and OR. Includes server-side detection code and compliance mapping. |
| author | mukul975 |
| author_url | https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/global-privacy-control |
| license | Apache-2.0 |
| version | 0.1.0 |
| execution_mode | open |
| jurisdiction | us |
| practice | data-protection |
| language | en |
Implementing Global Privacy Control (GPC)
Overview
Global Privacy Control (GPC) is a browser-level signal that communicates a user's privacy preference to opt out of the sale or sharing of their personal information. The GPC specification defines both an HTTP header (Sec-GPC: 1) and a JavaScript API (navigator.globalPrivacyControl) for transmitting this signal.
Under California Privacy Rights Act (CPRA) Section 1798.135(e), businesses must treat GPC signals as valid opt-out requests. The California Attorney General confirmed this enforcement position in the Sephora settlement (August 2022, $1.2 million fine), which was the first enforcement action involving GPC signals.
Legal Requirements by State
California — CPRA (effective January 1, 2023)
- Section 1798.135(e): A business that collects consumers' personal information shall treat the consumer's use of an opt-out preference signal as a valid request to opt out of sale/sharing under Section 1798.120.
- AG Regulation 11 CCR 7025(b): If a business collects personal information from consumers online, the business shall treat an opt-out preference signal as a valid request to opt-out of sale/sharing for that browser or device and any consumer profile associated with that browser or device.
- Sephora Settlement (August 2022): California AG fined Sephora $1.2 million for failing to honor GPC signals, among other violations.
Colorado — Colorado Privacy Act (CPA, effective July 1, 2024)
- Section 6-1-1306(1)(a)(IV)(A): Consumers may exercise the right to opt out through an opt-out preference signal sent by a platform, technology, or mechanism on behalf of the consumer, to the extent technically feasible.
- CPA Rules 4.6: Controllers must recognize universal opt-out mechanisms by July 1, 2024.
Connecticut — Connecticut Data Privacy Act (CTDPA, effective July 1, 2023)
- Section 42-520(b)(5): Beginning January 1, 2025, controllers must recognize universal opt-out mechanisms for the sale of personal data and targeted advertising.
Montana — Montana Consumer Data Privacy Act (effective October 1, 2024)
- Section 30-14-2807: Controllers must recognize opt-out preference signals as valid opt-out requests for the sale of personal data and targeted advertising.
Texas — Texas Data Privacy and Security Act (TDPSA, effective July 1, 2024)
- Section 541.055: Controllers must allow consumers to opt out of the sale of personal data and targeted advertising. Universal opt-out mechanisms must be honored beginning January 1, 2025.
