Skip to content
Vol. 1 · Ed. 2026
CyberGlossary
Português
Entry № 494

Global Privacy Control (GPC)

O que é Global Privacy Control (GPC)?

Global Privacy Control (GPC)A browser-level signal — an HTTP header and a JavaScript property — by which a user expresses a 'do not sell or share' opt-out, given binding legal force in California (CCPA/CPRA) and Colorado (CPA) regulations.

Global Privacy Control (GPC) is a browser-level privacy signal developed by a coalition of privacy advocates, publishers, and browser vendors (DuckDuckGo, Mozilla, Brave, EFF, NYT, WaPo, Disconnect) and first deployed in 2021. It is both an HTTP request header (`Sec-GPC: 1`) and a JavaScript property (`navigator.globalPrivacyControl`) which, when present, communicates that the user does not want their personal data sold or shared for cross-context behavioural advertising. Unlike the failed earlier Do-Not-Track signal, GPC has explicit regulatory force: the California AG and CPPA require businesses subject to CCPA/CPRA to treat GPC as a valid opt-out of sale and sharing; Colorado's CPA requires similar handling; other U.S. state laws (Connecticut, Delaware, New Jersey, Oregon) have followed. Major browsers (Firefox, Brave, DuckDuckGo, Safari via add-ons) send GPC by default or by toggle; Chrome and Edge currently do not. From a compliance perspective, sites serving U.S. users must implement server-side handling of GPC, link consent records to the signal, and update opt-out states accordingly.

● Exemplos

  1. 01

    A retailer's web stack reads `Sec-GPC: 1` on incoming requests and disables third-party advertising scripts for California, Colorado, and Connecticut users on that request.

  2. 02

    A CMP (consent management platform) integrates GPC handling so that the IAB TCF consent string is set to opt-out when the GPC header is present.

● Perguntas frequentes

O que é Global Privacy Control (GPC)?

A browser-level signal — an HTTP header and a JavaScript property — by which a user expresses a 'do not sell or share' opt-out, given binding legal force in California (CCPA/CPRA) and Colorado (CPA) regulations. Pertence à categoria Privacidade e proteção de dados da cibersegurança.

O que significa Global Privacy Control (GPC)?

A browser-level signal — an HTTP header and a JavaScript property — by which a user expresses a 'do not sell or share' opt-out, given binding legal force in California (CCPA/CPRA) and Colorado (CPA) regulations.

Como funciona Global Privacy Control (GPC)?

Global Privacy Control (GPC) is a browser-level privacy signal developed by a coalition of privacy advocates, publishers, and browser vendors (DuckDuckGo, Mozilla, Brave, EFF, NYT, WaPo, Disconnect) and first deployed in 2021. It is both an HTTP request header (`Sec-GPC: 1`) and a JavaScript property (`navigator.globalPrivacyControl`) which, when present, communicates that the user does not want their personal data sold or shared for cross-context behavioural advertising. Unlike the failed earlier Do-Not-Track signal, GPC has explicit regulatory force: the California AG and CPPA require businesses subject to CCPA/CPRA to treat GPC as a valid opt-out of sale and sharing; Colorado's CPA requires similar handling; other U.S. state laws (Connecticut, Delaware, New Jersey, Oregon) have followed. Major browsers (Firefox, Brave, DuckDuckGo, Safari via add-ons) send GPC by default or by toggle; Chrome and Edge currently do not. From a compliance perspective, sites serving U.S. users must implement server-side handling of GPC, link consent records to the signal, and update opt-out states accordingly.

Como se defender contra Global Privacy Control (GPC)?

As defesas contra Global Privacy Control (GPC) costumam combinar controles técnicos e práticas operacionais, conforme detalhado na definição acima.

Quais são outros nomes para Global Privacy Control (GPC)?

Nomes alternativos comuns: GPC, Sec-GPC header.

● Termos relacionados

● Veja também