Global Privacy Control (GPC) Signal

Overview

Global Privacy Control (GPC) is a browser-level privacy signal that lets a visitor express a single, persistent opt-out preference to every website they visit — without having to click a "Do Not Sell" link on each one.

When enabled, the browser:

Sends an HTTP request header: Sec-GPC: 1
Exposes a JavaScript property: navigator.globalPrivacyControl === true

A growing number of U.S. state privacy laws require businesses to recognize GPC as a legally valid opt-out request. Rather than gating GPC handling by region, Consent Pro honors the signal for every visitor whose browser sends it, anywhere in the world. This goes beyond the legal minimum and treats GPC as what it was designed to be: a universal expression of a visitor's privacy preference.

Consent Pro handles GPC detection, the opt-out logic, and the user-facing confirmation display automatically.

Scope: Every GPC-Enabled Visitor

GPC is honored globally, with no region check. If navigator.globalPrivacyControl === true, Consent Pro applies the opt-out — whether the visitor is in California, Berlin, São Paulo, or anywhere else.

This decision is deliberate:

Legal compliance is a floor, not a ceiling. Twelve U.S. states currently mandate GPC recognition (with more on the way). Honoring GPC universally satisfies every existing mandate and any future one without requiring a code change.
It matches user intent. A visitor who has explicitly enabled GPC has made a clear privacy choice. Ignoring it because they happen to be visiting from a jurisdiction without an enforcement statute is bad faith.
It simplifies the runtime. No geo-IP lookup, no region allowlist to maintain, no edge cases when geolocation fails or returns ambiguous results.

The signal still has no practical effect on Opt-In or Informational banners (see Supported Banner Types below) — those don't pre-enable categories, so there's nothing for GPC to override.

How Visitors Enable GPC

A visitor can turn on GPC in one of two ways:

Native browser support — Brave, Firefox, and DuckDuckGo's browser ship with GPC built in (Brave and DuckDuckGo enable it by default; Firefox exposes it as a setting).
Browser extension — Privacy Badger, OptMeowt, and DuckDuckGo Privacy Essentials add GPC support to browsers that don't include it natively (such as Chrome and Edge).

Once enabled, the signal is sent automatically with every request — there is nothing the website operator needs to do to receive it.

When Consent Pro loads, it checks navigator.globalPrivacyControl and compares the signal against the stored consent:

Situation	Behavior
No prior consent stored (first visit)	The signal is honored: non-essential categories (analytics, marketing, personalization) are opted out by default, and the `gpc-honored` element is shown.
Stored consent predates the signal	The signal wins. Non-essential categories are opted out automatically, cookies set under them are cleaned up, a new consent record is written, and the banner is re-shown once (see below).
*Stored consent was given after* the signal was honored**	The visitor knowingly overrode the signal, so their choice stands and the `gpc-honored` element stays hidden.
Stored consent already grants nothing	The signal is being respected already, so nothing is written. The `gpc-honored` element is shown.
Signal is switched off after being honored	The opt-out stays in place. An absent signal is never treated as consent to opt back in (§ 7025(c)(5)); the `gpc-honored` element is hidden because there is no longer a signal to honor.
Visitor manually updates preferences	The manual choice overrides the signal from that point on, for as long as the consent cookie lives.

A GPC signal is a live opt-out request on every page load, not a one-time default. Under CCPA § 7025(c)(3) (11 CCR § 7025), where the signal conflicts with a saved setting that permits sale or sharing, the business must process the signal as a valid opt-out request — it may then notify the visitor of the conflict and offer them the chance to consent instead. If the visitor does consent, the business may ignore the signal "for as long as the consumer remains known to the business."

Consent Pro implements exactly that: the more recent expression of the visitor's preference wins.

Because browsers expose only the current value of navigator.globalPrivacyControl — with no indication of when it was switched on — Consent Pro records when it first observed the signal in the consent cookie, as a gpcHonoredAt timestamp. Comparing that against the consent timestamp is what distinguishes "consent given before the signal arrived" (signal wins) from "consent given knowingly, after the signal was honored" (consent wins). The stamp is written on every consent write made while the signal is active, and cleared on any write made while it is absent — so consent given with GPC switched off is not immune to a signal that arrives later.

Known limitation: if a visitor knowingly overrides the signal and then switches GPC off and on again, that second switch-on is invisible to any website — no browser API exposes it — so the override stands until the consent cookie expires. This matches the "for as long as the consumer remains known" allowance above.

If you write the fs-consent cookie yourself from a non-Webflow site, you must carry the gpcHonoredAt stamp forward or the consent you write will be revoked on the visitor's next Webflow page view. See Custom Integration.

What the Visitor Sees

The revocation happens only on pages the banner instance is configured to run on. On a page excluded by the instance's page targeting, Consent Pro does not manage consent at all — it would have no way to block trackers or clean up cookies there — so it leaves the stored consent alone until the visitor reaches a page it does manage.

When the signal revokes a stored consent, the banner is shown once more on that page load, carrying the gpc-honored message. This tells the visitor their saved preferences changed and gives them the § 7025(c)(3) opportunity to consent knowingly instead. It happens only on the page load where a category was actually revoked — later visits show the fixed-preferences element as usual.

If a visitor accepts after seeing that notice, the gpc-honored element hides immediately: the signal has stopped being processed, so Consent Pro stops claiming it was.

A GPC-driven opt-out is recorded like any other consent, with action: "reject_all" and source: "gpc", so it appears in the consent log and in CSV exports as an auditable record of the signal having been processed. Its banner_text may be empty, because the record is written before the banner document has finished loading.

GPC has a meaningful effect only on banners where categories are pre-enabled by default. Consent Pro therefore applies GPC behavior on:

Opt-Out banners
Do Not Sell banners

For both types, all categories are enabled on first visit. When a visitor has GPC active, that default is overridden and non-essential categories (analytics, marketing, personalization) are automatically opted out.

The same scope applies to the recency behavior above: a stored consent is only revoked on Opt-Out and Do Not Sell instances.

GPC does not revoke consent on Opt-In or Informational banners. Opt-In instances don't pre-enable categories in the first place, and GDPR does not recognize GPC as a mechanism for withdrawing consent — every law that mandates GPC recognition maps onto Opt-Out or Do Not Sell instances.

California Display Requirement (§ 7025(c)(6))

Effective January 1, 2026, the updated CCPA regulations changed § 7025(c)(6) from "may" to "must": businesses are now required to visibly display that a consumer's opt-out preference signal has been processed. A silent backend implementation is no longer compliant for visitors in California.

Consent Pro satisfies this requirement automatically. Because the gpc-honored element is shown for every visitor whose signal is being processed — not just those in California — the California display obligation is met as a side effect of the universal scope. The default copy ("The GPC signal has been honored.") meets the regulation's example wording (e.g., "Opt-Out Request Preference Signal Honored").

Note the regulation requires displaying whether the signal was processed. When a visitor knowingly consents after the signal was honored, Consent Pro is no longer processing it, so the gpc-honored element is hidden rather than left in place — their opt-out status is then reflected by the toggles in the Preferences panel, which the regulation gives as an acceptable display.

Regulators have actively scrutinized businesses' handling of opt-out preference signals, so organizations should ensure GPC requests are both honored and clearly communicated to visitors.

If your banner was generated before the gpc-honored element was added, see Updating an Existing Banner below.

No Configuration Required

GPC support is built into Opt-Out and Do Not Sell banners and works automatically. There is no toggle, setting, or region list to enable. When a visitor has GPC active in their browser, Consent Pro will honor it and display the confirmation.

Consent Pro sets a fs-consent-gpc attribute on the banner, preferences, and fixed-preferences elements, reflecting whether the signal is currently being processed — not merely whether it is present:

fs-consent-gpc="true" — GPC is active and is being honored
fs-consent-gpc="false" — GPC is not active, or the visitor knowingly consented after it was honored

The attribute updates live, so it flips to "false" the moment a visitor accepts cookies while a signal is active.

An element with the attribute fs-consent-element="gpc-honored" is automatically shown when GPC is honored and hidden when it is not. Use this to display a message confirming that the visitor's GPC preference has been respected.

The gpc-honored element is included by default in newly generated Opt-Out and Do Not Sell banners. If your banner was generated before GPC support was added, you can either:

Regenerate the banner from the Consent Pro app (recommended), or
Manually add the element using the markup below.

Place the following HTML inside both your banner element and your Preferences panel:

html

<div fs-consent-element="gpc-honored" class="consent_gpc-honored">
  <div class="consent_gpc-honored-icon w-embed">
    <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="currentColor" class="size-6">
      <path
        fill-rule="evenodd"
        d="M2.25 12c0-5.385 4.365-9.75 9.75-9.75s9.75 4.365
        9.75 9.75-4.365 9.75-9.75 9.75S2.25 17.385 2.25
        12Zm13.36-1.814a.75.75 0 1 0-1.22-.872l-3.236
        4.53L9.53 12.22a.75.75 0 0 0-1.06 1.06l2.25
        2.25a.75.75 0 0 0 1.14-.094l3.75-5.25Z"
        clip-rule="evenodd"
      />
    </svg>
  </div>
  <div class="consent_gpc-honored_text">The GPC signal has been honored.</div>
</div>

Style the consent_gpc-honored element and its children in your site builder or with custom CSS.

Optional: Publishing `/.well-known/gpc.json`

The GPC specification defines an optional, machine-readable support file that websites may host at:

text

/.well-known/gpc.json

This file is a public declaration that your site recognizes and honors GPC. Privacy tools, browser extensions, scanners, and compliance reviewers may check for it.

Do I need it?

No — it is optional. Your site can fully honor GPC without it, because the signal is transmitted directly by the browser with every request. Consent Pro does not require this file to function.

That said, publishing it is a low-effort transparency win and is recommended for audit readiness.

File contents

json

{
  "gpc": true,
  "lastUpdate": "2026-04-28"
}

Field	Description
`gpc`	`true` declares that your site intends to honor GPC requests.
`lastUpdate`	The date this declaration was last reviewed, in ISO format (`YYYY-MM-DD`).

Where to host it

The file must be publicly accessible on your website's domain:

text

https://yourdomain.com/.well-known/gpc.json

Do not host it on the Consent Pro CDN or script domain — this declaration belongs to the website operator, not the CMP vendor.

Best Practice Recommendation

For strongest transparency and audit readiness:

Use an Opt-Out or Do Not Sell banner (Consent Pro handles GPC automatically).
Confirm the gpc-honored element is present in your banner and Preferences panel.
Publish /.well-known/gpc.json on your domain.
Keep the lastUpdate value current when your privacy policies change.

Looking Ahead: California's "Opt Me Out" Act (AB 566)

California enacted AB 566 ("Opt Me Out" Act) in October 2025. Effective January 1, 2027, all major web browsers distributed in California will be required to include built-in functionality for sending opt-out preference signals.

The practical implication: GPC adoption — currently around 1% of U.S. users — is expected to rise sharply once Chrome and Edge are required to expose it. Sites that already honor GPC today will see no behavioral change; sites that don't will see a sharp increase in opt-out traffic they're failing to handle. Because Consent Pro honors GPC for every visitor, no migration is needed when adoption grows.

Summary

GPC is a browser-level signal that communicates a user's opt-out preference automatically.
Consent Pro honors GPC for every visitor whose browser sends it, regardless of region.
The signal is treated as a live opt-out request, so it overrides consent that was saved before it arrived — and a consent given knowingly after it was honored overrides the signal in turn. The most recent expression of the visitor's preference wins.
This satisfies all U.S. state mandates (currently twelve states) and the California § 7025(c)(6) display requirement as a side effect.
The gpc-honored element is shown whenever the signal is being processed, and is included by default in new Opt-Out and Do Not Sell banners.
Publishing /.well-known/gpc.json is optional but recommended.
No configuration is required — GPC support is built in.

Global Privacy Control (GPC) Signal ​

Overview ​

Scope: Every GPC-Enabled Visitor ​

How Visitors Enable GPC ​

How Consent Pro Handles the Signal ​

Recency: Why a Signal Can Override Saved Consent ​

What the Visitor Sees ​

Consent Records ​

Supported Banner Types ​

California Display Requirement (§ 7025(c)(6)) ​

No Configuration Required ​

Banner Behavior and Styling ​

Updating an Existing Banner ​

Optional: Publishing /.well-known/gpc.json ​

Do I need it? ​

File contents ​

Where to host it ​

Best Practice Recommendation ​

Looking Ahead: California's "Opt Me Out" Act (AB 566) ​

Summary ​