What is Global Privacy Control (GPC)? Who supports the GPC signal?
The GPC was developed by a coalition of publishers, tech companies, browser and extension developers, and civil rights groups to help publishers easily respect California consumer opt-out of sale requests in line with CCPA-REGULATIONS §999.315. While developed to meet the California requirement, this signal may be used for any jurisdiction requiring an opt-out model.
The GPC signal may also be used to support General Data Protection Regulation (GDPR) compliance. The signal conveys a general request that data controllers limit the sale or sharing of a data subject’s personal data to other controllers (GDPR Articles 7 and 21).
To implement GPC on your website
On the menu, select . The Geolocation Rule Groups list screen appears.
Select a geolocation rule group from the list. The Geolocation Rule Group Details screen appears.
-
Select a geolocation rule from the Geolocation Rule pane.
Note
You can also add a new geolocation rule by clicking the Add Rule button.
-
Click the Edit icon 
. All editable fields will display as configurable.
-
Click the Expand icon 
on the Cookie Categories section. The cookie categories display.
-
Use the checkboxes to configure Global Privacy Control for each cookie category.
Note
Selecting a checkbox for a category displays the category as disabled by default in the Preference Center if the browser sends a GPC signal.
Click the Save button. Your configuration will display when you publish the script.
To configure an opt-out signal notification
You can display a notification on your Banner and Preference Center indicating that a user's opt-out signal will be honored.
On the menu, select . The Templates screen appears.
Click on the name of the template you want to configure. The Template Details screen appears.
Go to the Banner or Preference Center tab.
Select the Web Browser button next to Platform.
Expand the Content section. The Content section appears.
Click the Edit icon 
next to Opt Out Signal. The Opt Out Signal Notification modal appears.
Configure the fields. For more information, see Opt Out Signal Modal Reference.
Click the Save button.
Opt Out Signal Modal Reference
Testing GPC signals on your website
Users can employ the GPC signal by downloading one of the supporting browsers or browser extensions, listed here. The easiest method is to leverage the browser extensions Privacy Badger from EFF or Duck Duck Go Privacy Essentials so that you can switch your GPC signal on and off. If you would like more information about downloading GPC you can learn more here.
Turn on the signal: Turn on the Global Privacy Control (GPC) signal in your browser-level settings or via the extension.
Navigate to or Refresh the Website: Check that if you open the browser console navigator.globalPrivacyControl = true or = 1.
-
Check the CMP: Check to see that the category for which you configured GPC is disabled (inactive) by default.
Note
This will disable the category regardless of the previous consent of the category, the new GPC signal will be treated as the most recent choice. However, if you enable this category after turning on GPC, then the assumption is that you want to override the GPC signal in this instance via the interface.
Disable GPC: Turn off the GPC signal in your browser-level settings or via the extension.
Clear Cookies and Refresh: Check in the console that navigator.globalPrivacyControl = false or undefined and that the category you are controlling via GPC is enabled (active) by default (if this is the behavior configured in the geolocation rules).
Global Privacy Control Scenarios
The following scenarios detail Banner and Preference Center behavior on GPC-enabled sites.
-
The GPC signal is detected for users who are visiting a site for the first time or on expired consent and the users have not explicitly provided consent:
Result: The category for which the GPC signal is enabled will display an opt-in or toggle-disabled status (GPC takes precedence).
Example: If GPC is configured for a OneTrust category (like targeting cookies), then the user visiting the site for the first time will see the targeting category display as opted-out while all other categories will be display as configured per the default consent model.
-
The GPC signal is detected for users who are visiting a site for the first time or on expired consent and the users explicitly change consent through the Banner or Preference Center:
Result: The user’s consent choice is reflected in the GPC-enabled category (manual consent takes precedence).
Example: If GPC is configured for a OneTrust category (like targeting cookies), then the user visiting the site for the first time will see the targeting category as opted-out. But if users opt-in to the targeting category explicitly through the Banner or Preference Center, the status for the targeting category will remain opted-in.
-
The GPC signal is detected for the first time and users have previously provided OneTrust consent:
Result: Any previous settings made by the user— explicitly through interaction or implicitly through inaction—should be updated and overridden by a subsequent GPC signal.
Example: If a user opts-in for all categories and later adds the GPC extension to their browser and enables a GPC signal, then the GPC-configured category (like targeting) will be opted-out while other categories remain opted-in.
Note
In this scenario, if the opt-out signal notification (on the Banner or Preference Center) is enabled in the template, users will be notified again through the Banner or when they click on Preference Center.
-
The GPC signal is detected for the first time and users have previously provided OneTrust consent but explicitly change consent through the Banner or Preference Center:
Result: The user’s consent preferences are reflected in the GPC-enabled category (manual consent takes precedence).
Example: If a user, upon viewing the GPC notification through the Banner, explicitly changes the GPC-enabled category (like targeting cookies) from opt-out to opt-in, then the status for targeting cookies will display as opted-in.
-
The GPC signal is disabled at any point in time (including mid of any of the scenarios above).
Result: The category will retain the previous consent status, whether overridden by GPC or manual configuration.
Example: If a user has explicitly opted in or out, there is no change in the category status upon removal of GPC. Disabling GPC does not give consent to automatically opt-in to a category nor default to consent model.
