Category: Tracking Technologies
Sec-GPC Signal
Also known as: Sec-GPC header, Global Privacy Control signal, GPC signal
Simply put
The Sec-GPC signal is a message a web browser can send to a website to indicate that the user does not want their personal information sold or shared. It is the technical part of the Global Privacy Control (GPC) mechanism, which is designed to help users exercise privacy rights such as the 'Do Not Sell or Share' request available under the California Consumer Privacy Act and similar US state privacy laws. Whether and how a website must respond to the signal depends on the applicable law.
Formal definition
Sec-GPC is an HTTP request header that forms the technical implementation of Global Privacy Control (GPC), a browser-transmitted mechanism for communicating a user's preference not to have their personal data sold or shared. When present, the header indicates the user's exercise of an opt-out preference; per the GPC specification and project materials, it is intended primarily to convey a 'Do Not Sell or Share' request under the California Consumer Privacy Act (CCPA/CPRA) and comparable US state privacy laws that rely on opt-out signals. The signal's legal effect is jurisdiction-dependent: US state opt-out regimes generally recognize such universal opt-out mechanisms, whereas its treatment under EU and UK frameworks (which typically require prior opt-in consent for non-essential cookies and similar technologies under the ePrivacy rules and GDPR) is not established by the evidence here and should be assessed against applicable law and regulatory guidance. The signal expresses a preference at the transport level; enforcement, scope, and required server-side handling depend on the governing legal regime rather than on the header alone.
Why it matters
The Sec-GPC signal matters because it offers a scalable way for users to communicate a privacy preference automatically, rather than clicking an opt-out control on every website they visit. Under the California Consumer Privacy Act (CCPA/CPRA) and comparable US state privacy laws that rely on opt-out mechanisms, universal signals of this kind are generally recognized as a valid way for consumers to exercise a 'Do Not Sell or Share' request. For businesses subject to these regimes, this means the signal may carry legal weight and may need to be honored, so how a website detects and processes the header can have direct compliance consequences.
Who it's relevant to
Privacy officers and compliance teams
Those responsible for compliance with US state privacy laws such as the CCPA/CPRA should assess whether their organization is required to recognize universal opt-out signals like GPC and, if so, ensure that received Sec-GPC headers are translated into the appropriate 'Do Not Sell or Share' handling. Because obligations vary by state and depend on the applicable law, this should be evaluated against current legal and regulatory guidance rather than assumed.
Web developers and engineers
Developers implementing consent and preference handling need to detect the Sec-GPC HTTP request header and route it to the systems that govern data sharing and sales. The header is only a preference at the transport level, so its effect depends entirely on server-side logic being built to interpret and act on it; simply receiving the signal does nothing on its own.
Legal counsel and data protection professionals
Counsel should advise on the jurisdiction-dependent effect of the signal. US state opt-out regimes generally recognize universal opt-out mechanisms, whereas the treatment of GPC under EU and UK frameworks, which typically require prior opt-in consent for non-essential cookies and similar technologies under the ePrivacy rules and GDPR, is not established here and should be assessed against applicable law. The signal supports the exercise of rights but does not by itself determine what a business is legally required to do.
CMP vendors and consent management teams
Those building or configuring consent management platforms should consider how their tools detect, log, and respond to GPC signals across the jurisdictions their clients operate in. Tooling can support compliance by surfacing and processing the signal, but it does not replace the legal judgment needed to determine when and how the signal must be honored.
Inside Sec-GPC Signal
HTTP request header
Sec-GPC is an HTTP header transmitted with a value of '1' to indicate that the user has enabled a Global Privacy Control preference. The 'Sec-' prefix marks it as a forbidden header name that cannot be set programmatically via client-side scripts, helping ensure the signal reflects a genuine browser or extension configuration.
JavaScript DOM property
The signal is also exposed to web pages through the navigator.globalPrivacyControl property, allowing site scripts to read the user's preference client-side in addition to the server receiving the HTTP header.
Binary opt-out preference
The signal conveys a single preference: that the user is asserting an opt-out of the sale or sharing of their personal information, or similar rights, where applicable law recognizes such a signal. It does not carry granular, purpose-by-purpose choices.
Association with Global Privacy Control (GPC)
Sec-GPC is the technical transport mechanism for the Global Privacy Control specification, a browser-level signal designed primarily to support opt-out rights under certain US state privacy laws such as the CCPA and CPRA in California. Its legal weight depends on the applicable jurisdiction.
Legal recognition varying by jurisdiction
Whether a business must honor the signal, and what obligation it triggers, depends on the governing law. Some US state frameworks may treat it as a valid opt-out request, while its role under the EU ePrivacy Directive and GDPR opt-in consent model is far less established and generally not a substitute for affirmative consent.
Common questions
Answers to the questions practitioners most commonly ask about Sec-GPC Signal.
Does receiving a Sec-GPC signal automatically make my site compliant with all cookie consent laws?
No. The Sec-GPC header is a technical signal that communicates a user's opt-out preference, but honoring it is only one component of compliance. In the EU and UK, the ePrivacy rules generally require prior consent before placing non-essential cookies, so an opt-out signal does not by itself satisfy an opt-in standard. In certain US states, recognizing the signal may be treated as a required opt-out mechanism, but obligations vary by jurisdiction and depend on facts beyond the presence of the header. The signal supports compliance efforts; it does not replace legal judgment or a broader consent management approach.
Is the Sec-GPC signal the same as a browser Do Not Track (DNT) header?
They are related in concept but not identical. Both are browser-level signals expressing a privacy preference, but they arose in different contexts and are treated differently in practice. Do Not Track historically lacked a widely agreed enforcement mechanism, and many sites did not act on it. Global Privacy Control, transmitted via the Sec-GPC header, was designed to express an opt-out preference that certain US state frameworks may treat as a legally meaningful request. Whether and how a given signal must be honored depends on the applicable legal regime, so the two should not be treated as interchangeable.
How is the Sec-GPC signal transmitted and detected on my server?
The signal is generally sent as an HTTP request header named Sec-GPC, typically with a value indicating the user has enabled the preference. It may also be exposed to client-side scripts through a corresponding browser property. Detection usually involves inspecting the incoming header on the server or reading the exposed value in the browser. The exact behavior can depend on the browser or extension generating the signal, so implementers should test against the environments their users actually use rather than assuming uniform behavior.
How should a consent management platform (CMP) respond when it detects a Sec-GPC signal?
A CMP will typically be configured to interpret the signal as an opt-out preference and adjust the categories of cookies or processing accordingly, for example by suppressing certain advertising or sale-related activities where the applicable law treats the signal as a valid opt-out. How the signal maps to specific consent categories depends on your legal analysis and the jurisdictions you serve. Because requirements differ between the EU, UK, and individual US states, the mapping should be reviewed against the relevant framework rather than applied uniformly, and the CMP configuration should be validated with legal input.
Should the fact that a user sent a Sec-GPC signal be logged?
Maintaining records of how consent and opt-out preferences were handled is generally part of demonstrating accountability, so many organizations log receipt of the signal alongside the action taken in response. What to log, how long to retain it, and how it relates to broader consent record-keeping obligations depend on the applicable legal regime and your own retention policies. This entry does not prescribe a specific logging schema; organizations should align logging practices with their documented compliance and data minimization approach.
Does honoring a Sec-GPC signal replace the need to display a cookie banner or consent interface?
Not necessarily. In jurisdictions that require prior opt-in consent for non-essential cookies, a consent interface may still be needed regardless of any opt-out signal. In jurisdictions where the signal functions as an opt-out, honoring it may reduce reliance on a manual opt-out interaction for the relevant activities, but other notice and choice obligations may still apply. Because the interplay between browser signals and required user interfaces varies by regime and remains subject to evolving guidance, the two should be treated as complementary rather than mutually exclusive.
Common misconceptions
Honoring a Sec-GPC signal makes a website compliant with EU cookie consent requirements.
In most EU jurisdictions, the ePrivacy Directive and GDPR generally require prior, affirmative opt-in consent before placing non-essential cookies or similar technologies. GPC is an opt-out signal, and its recognition is chiefly associated with certain US state laws such as the CCPA and CPRA. It is not generally treated as a mechanism that satisfies EU opt-in consent, and its status in the EU remains largely unsettled.
The Sec-GPC header is universally legally binding on every business that receives it.
The obligation to honor the signal depends on the applicable legal regime. Some US state privacy frameworks may require covered businesses to treat it as a valid opt-out, but this is not a universal rule, and enforcement positions and interpretations continue to evolve. Whether and how a given organization must respond depends on facts and jurisdictions not resolved by the signal itself.
Sec-GPC communicates detailed, purpose-specific consent choices.
The signal is a simple binary indication (value '1') that a user has enabled a privacy preference. It does not express granular, category-by-category or purpose-by-purpose choices the way a consent management platform interface might, so organizations may still need other mechanisms to capture more specific preferences.
Best practices
Map where your users are located and identify which legal regimes may recognize the GPC signal (for example certain US state laws such as the CCPA and CPRA) before deciding how your systems should respond.
Detect the signal both via the Sec-GPC HTTP header and the navigator.globalPrivacyControl JavaScript property, since either may be available depending on the request context.
Do not rely on GPC alone to meet EU-style opt-in requirements; in most EU jurisdictions continue to obtain prior affirmative consent for non-essential cookies and similar technologies through your consent management platform.
Treat the signal as an opt-out preference where applicable law recognizes it, and configure downstream processing (such as sale or sharing of personal information) accordingly rather than assuming it addresses all consent obligations.
Log and retain records of received GPC signals and the resulting actions to support your record-keeping and accountability obligations, recognizing that tooling supports but does not replace legal judgment.
Consult qualified legal counsel to determine your specific obligations, since GPC's legal effect varies by jurisdiction and regulatory guidance and enforcement positions continue to evolve.
