Do I need to honor the Global Privacy Control (GPC) signal in the EU?

Global Privacy Control is a browser signal, an HTTP header and a JavaScript property, that lets a user broadcast a privacy preference once and have every site they visit respect it without per-site banner clicks. Sec-GPC: 1 on the request header means “treat me as having opted out of any sale, sharing, or tracking that my jurisdiction’s law lets me opt out of.”

In California, Colorado, Connecticut, and Texas, GPC is legally binding under each state’s consumer privacy statute. In the EU, GPC is not codified. The question of whether SMB sites should honor it has a defensible answer that is not “wait for the EDPB to require it.”

Where GPC is binding today

• California CCPA / CPRA. California Civil Code §1798.135(b)(1) lets a business meet its opt-out duty by honoring an opt-out preference signal, and 11 CCR §7025(b)–(c) makes processing that signal mandatory and sets out how. Rulemaking sits with the California Privacy Protection Agency, which took it over from the Attorney General.
• Colorado CPA. Colorado regulations (4 CCR 904-3 §5.04) require honoring “universal opt-out mechanisms”; GPC qualifies as of January 2024.
• Connecticut CTDPA. Similar universal-opt-out provision; GPC named by AG guidance.
• Texas TDPSA. The statute took general effect on 1 July 2024, but the duty to recognise a universal opt-out mechanism is separately dated: §541.055(e) applies it from 1 January 2025.
• Several other US states (Delaware, Maryland, Oregon, Minnesota, New Jersey) have adopted similar provisions in 2024 to 2025.

Where GPC sits in EU law in 2026

GDPR Article 21. Article 21(2) grants an unconditional right to object to processing for direct marketing. Article 21(5) then adds the sentence that actually matters here: in the context of information-society services, the data subject “may exercise his or her right to object by automated means using technical specifications.” That is a description of a browser signal, written into the Regulation in 2016. It is the strongest hook GPC has in EU law — and it is a hook, not a mandate. Nothing designates GPC as the specification, and the EDPB has published no opinion, guideline or work-programme item on it. Claims that the EDPB endorses GPC are extrapolation, and you will find several of them.

The nearest thing to a ruling. Landgericht Berlin, judgment of 24 August 2023 (Az. 16 O 420/19), in proceedings brought by the vzbv against LinkedIn, held that a Do Not Track signal amounted to an effective objection and that telling users the signal had no effect was unlawful. Read it as the direction of travel, not as settled law: it is first instance, it is not final, and it is on appeal to the Kammergericht.

The ePrivacy Regulation is not coming. For eight years the answer to “when will the EU codify a universal signal?” was Article 10 of the draft ePrivacy Regulation, which would have obliged browsers to offer a consent setting and sites to respect it. That vehicle is dead. The Commission announced its intention to withdraw the proposal on 11 February 2025, formally adopted the withdrawal on 16 July 2025, and it was published in the Official Journal on 6 October 2025. No successor instrument is on the table.

That rearranges the argument in this post rather than defeating it. “Honor it early and avoid a retroactive scramble” was never a great reason, and it is now an empty one: there is no scramble scheduled. What is left is the case on the merits — Article 21(5), an objection right you already owe and have to operationalise somehow, and the fact that running one opt-out path across your EU and US visitors is cheaper than running two. If those reasons do not move you, no legislative deadline is going to.

What GPC cannot do. GPC is an opt-out signal; ePrivacy Art. 5(3) consent is opt-in. A Sec-GPC header is not consent, and its absence is emphatically not consent either — you still need a banner and an affirmative act before you write a non-essential cookie. GPC operates on the objection side of the GDPR and on processing you run under legitimate interest. Treating it as a substitute for a consent mechanism is the one implementation mistake worth naming outright.

The right way to honor GPC in the EU

Honoring GPC in the EU is a layered concept because GDPR consent and ePrivacy consent are opt-in. GPC says “I opt out”, useful for processing the site does under legitimate interest, less useful for processing that already requires consent. The clean integration:

1. On every request, check the Sec-GPC header. If 1, treat the user as having objected to processing under Article 21 and opted out of any sale or sharing that would otherwise be permissible under legitimate interest.
2. On the client, check navigator.globalPrivacyControl. Use this as a fallback for SPA-style navigations or when the cookie banner hydrates before a server round-trip.
3. Suppress the cookie banner. A GPC-signalling user has expressed a preference for privacy; presenting a banner asking them to accept tracking is friction without value. Persist the rejection in a first-party cookie so future visits stay banner-free.
4. Do not load non-essential trackers, ever. The GPC user has opted out of the universe of tracking that requires their consent. Loading GA4 / Meta Pixel / LinkedIn Insight on a GPC visit is inconsistent with the opt-out, regardless of whether the user clicked anything.
5. Honor the user’s right to revoke. A user who clears the consent cookie and explicitly accepts tracking after a GPC-rejection should be respected; the GPC signal expresses a preference, not an unmovable absolute.

Implementation, briefly

On a Next.js application, the cleanest pattern is to detect Sec-GPC in middleware and stamp a first-party cookie on the response. The client then reads that cookie via React context and never mounts the consent banner. The same context controls whether non-essential analytics modules are mounted at all.

Veracly’s own marketing site implements this pattern. The middleware at apps/web/src/middleware.ts writes veracly_gpc=1 when it sees Sec-GPC: 1. The ConsentProvider reads that cookie before the banner mounts. The cookie banner never appears for a GPC-signalling visitor.

What about Do Not Track?

Do Not Track (DNT) was the predecessor to GPC. It was widely ignored by sites and eventually deprecated by browser vendors as ineffective. GPC succeeded where DNT failed because it acquired the one thing DNT never had: statutory backing. That was not there at launch — GPC shipped in 2020 with no state obliging anyone to honour it, and California’s regulations came first. Roughly a dozen states now require honouring a universal opt-out signal, and a single jurisdiction with enforcement behind it creates the network effect DNT never achieved.

Sites that already implemented DNT respect probably still have the code path. Migrating it to honor GPC instead is straightforward: read Sec-GPC where you previously read DNT, treat truthy as opt-out.

Does a Veracly scan check this? No.

We are correcting this section in place rather than quietly deleting it. An earlier version claimed the scanner “runs every page twice, once with a default browser profile and once with Sec-GPC: 1 set,” and that sites honoring GPC “see their compliance score improve.” Neither was true. There is no GPC check in the product: the scanner sends no Sec-GPC header, loads each page once, and GPC is not a violation type, so it cannot move a compliance score in either direction. The claim described a feature nobody had built.

Doing it properly would mean a second, differently-configured pass over every page plus a behavioural diff between the two runs — real work, not yet done. If we ship it, this section gets rewritten again. Until then, test it yourself in about two minutes: turn GPC on (Brave and DuckDuckGo send it by default; Firefox has it as an opt-in setting), open DevTools, filter the Network panel by your analytics or pixel domain, and compare what fires against the same page loaded in a browser without the signal.

What a scan does observe is the pre-consent state — which cookies, storage entries and third-party trackers appear before any banner interaction at all. That is a different question from GPC, and a useful one, but we are not going to sell it as a GPC test. Run a scan.

See also: GDPR vs ePrivacy: which one governs cookies? · What reject-all has to do under GDPR