Tracking Signals · Privacy Tests
Global Privacy Control Test
Check whether your browser sends Global Privacy Control, the opt-out privacy laws actually recognise.
Signals your browser exposes
Switched on right now
Every value here is read straight from your browser and stays on this page. Sending GPC is a request, not enforcement: a site that ignores the signal looks exactly the same from here as one that honours it, and this page cannot check whether any other site obeyed.
On this page
What GPC actually does
Global Privacy Control is a one-bit statement: do not sell or share my personal information. It travels two ways. The browser attaches the header Sec-GPC: 1 to every request, so a server can act on it before any script loads, and it sets navigator.globalPrivacyControl to true, so client-side code can read the same thing.
The design is deliberately simple, and that is the point. A cookie banner normally works by asking you, storing an answer and repeating the question when the storage is cleared. GPC is a standing instruction the browser sends before the page has asked anything, so a site can skip the question entirely for a visitor who has already answered it at the browser level.
A signal, not a switch
Nothing happens automatically when your browser sends it. A site has to look for the header or the property and then change its behaviour. The panel above can only tell you what your browser is sending.
GPC versus Do Not Track
Do Not Track was the earlier attempt at the same idea. Firefox, Internet Explorer, Safari and Chrome all added it between 2010 and 2011, and it sent a similar header, DNT: 1. What it never had was a rule behind it. No law required a site to honour it, the advertising industry declined to adopt it, and after a few years of arguing about a technical standard the effort stalled.
The result is a signal that is still sent by some browsers and ignored by almost everything. Safari went further and removed the option in 2017, on the grounds that it did nothing useful. Chrome kept the setting in its preferences, where it continues to send a header that changes no behaviour on the other side.
GPC learned from that failure. Rather than asking industry to volunteer, it was written into regulation, so the question of whether a site should honour it has a legal answer in some jurisdictions. That is the whole difference: the signal is nearly identical in shape, and the consequence of ignoring it is not.
Which browsers send GPC
Support is uneven, and the default matters more than the capability, because almost nobody changes this setting.
- Brave sends GPC in every mode, including normal browsing, and has done since 2020. It is the reference implementation.
- DuckDuckGo's browser sends it as well.
- Firefox sends GPC in private windows by default and provides a preference to send it in normal windows too.
- Safari has not implemented GPC, having removed DNT years earlier and taken the position that tracking prevention belongs in the engine rather than in a signal.
- Chrome, Edge, Opera and Samsung Internet do not send it and expose no built-in control. An extension can set the property and, with the right permissions, add the header.
Note the gap: support in the browser you use is not the same as sites acting on it. The Do Not Track test shows the older signal beside this one for comparison.
Where it is legally binding
California is the clearest case. The CPRA regulations that took effect on 1 January 2023 name opt-out preference signals as the mechanism a business must honour for requests to stop the sale or sharing of personal information, and GPC is the signal they point at. A business covered by the law that recognises the signal must treat the visitor as if they had clicked an opt-out link.
The effect is not confined to California residents forever, because detecting residency is awkward and many businesses simply honour the signal for everyone. Colorado and Connecticut added universal opt-out recognition to their own privacy laws, and more states have been following, so the practical coverage keeps widening.
Two important limits
The obligation sits with businesses that fall under a given law, not with every site on the internet, and it covers the sale and sharing of personal information rather than all tracking. A site can honour GPC and still set analytics cookies for its own use.
What GPC does not do
It does not make you anonymous. A site that honours GPC stops selling your data on, but it can still use it to run the page, and it can still read everything else your browser volunteers. The fingerprint test covers that surface, none of which is affected by any opt-out signal.
It does not confirm anything either. A page can read whether your browser sends the signal; it cannot ask a third party whether that third party obeyed it. If a site you use claims to respect GPC, the only way to hold it to that is to read its privacy policy or exercise the opt-out rights your jurisdiction gives you directly.
And it does not survive on its own. Some tools reset or strip headers, some network middleboxes rewrite them, and a proxy that terminates requests may or may not pass the header through. If the value above reads Not set in a browser you expected to support GPC, an extension, a proxy or an enterprise policy is the place to look first — along with the private mode test, since private windows sometimes behave differently here.