GPC (Global Privacy Control)

Global Privacy Control (GPC) is a browser-level privacy signal specification that enables users to communicate their data privacy preferences to websites automatically. When enabled, GPC sends a signal (navigator.globalPrivacyControl = true) with every HTTP request, indicating that the user does not want their personal data sold, shared, or used for targeted advertising. GPC was developed as a successor to the Do Not Track (DNT) signal, which failed due to lack of legal enforcement. Unlike DNT, GPC has legal backing under several privacy regulations. The California Consumer Privacy Act (CCPA/CPRA) explicitly recognizes GPC as a valid opt-out mechanism — businesses must honor GPC signals from California residents as a request to opt-out of the sale and sharing of personal data. The Colorado Privacy Act similarly recognizes universal opt-out mechanisms including GPC. In the EU, data protection authorities have indicated that GPC signals may constitute a valid withdrawal of consent under GDPR, though legal interpretation varies by member state. GPC is supported by several browsers and browser extensions including Firefox, Brave, DuckDuckGo, and privacy-focused browser extensions for Chrome and Safari. When a website detects the GPC signal, the compliant response is to treat the visit as if the user has opted out of non-essential data processing — suppressing marketing cookies, blocking advertising trackers, and flagging any server-side events as restricted. Arqam360 detects the GPC signal automatically (navigator.globalPrivacyControl), auto-opts-out new visitors with GPC enabled from non-essential consent categories, displays an informational banner notifying the visitor that their GPC preference has been honored, and includes the gpcDetected flag in consent records sent to the backend for audit trail purposes.