Global Privacy Control: the signal your banner should already respect

A visitor arrives on your site, the banner appears, and they refuse. On the next site, they do it again. Then on the next. Global Privacy Control offers an alternative: express this refusal once, in the browser, and have every site respect it automatically. Here is what this concretely means for a French publisher.

What GPC is

Global Privacy Control is a technical signal sent by the browser or an extension. It takes the form of an HTTP header Sec-GPC: 1 and a JavaScript property navigator.globalPrivacyControl set to true. Its semantics are deliberately simple: the person objects to the sale and sharing of their personal data, as well as to the setting of non-essential trackers.

It can be enabled natively in Firefox and Brave, and through an extension in Chromium-based browsers. It is not a per-site preference but a global setting, carried by the user.

GPC is the pragmatic successor to Do Not Track, which failed because there was no obligation to respect it. The difference is decisive: GPC has been backed by texts that give it binding force, at least in some jurisdictions.

Its legal value in Europe

In California, the regulator has explicitly recognized GPC as a valid opt-out expression under the CCPA, and has enforced it through sanctions. In Europe, the framework is different: the GDPR and the ePrivacy directive rely on prior consent, not on a right to object that has to be activated.

But GDPR article 21(5) provides that the right to object may be exercised "by automated means using technical specifications". And recital 32 reminds us that consent must be a clear affirmative act. An active GPC signal is therefore, at a minimum, an explicit and documented refusal: overriding it amounts to setting trackers against a clearly expressed will.

No European decision has yet settled the question head-on. The prudent position is this: GPC does not replace the banner, but it costs nothing to treat it as a refusal.

What a GPC-respecting CMP does

The expected behavior comes down to three points:

• Set the non-essential categories to "denied" from load, without waiting for any interaction;
• Do not hide the possibility of choosing: the visitor must remain free to accept if they wish, through the persistent re-access badge;
• Log the origin of the refusal, to distinguish in your evidence an explicit refusal from a refusal inferred from a signal.

The third point is often overlooked even though it matters: in the event of an inspection, knowing where each decision comes from makes the difference between a usable proof of consent and an ambiguous log.

Why ignoring it is a bad calculation

The argument against GPC is always the same: fewer consents, therefore less data. In practice, the population that enables GPC is the one that already systematically refuses banners. The volume lost is marginal; the risk avoided is not.

There is also an argument of consistency. A site that displays a compliant banner but ignores a refusal expressed upstream sends a contradictory message. Respecting the signal is inexpensive to implement and easy to describe in a privacy policy.

In practice

If your CMP (consent management platform) handles it natively, there is nothing to do; this is the case with Consenteer, in every plan. If you have an in-house integration, test navigator.globalPrivacyControl before initializing your tags, and combine this reading with your Google Consent Mode v2 signals so that the two mechanisms do not contradict each other.

To check your installation, enable GPC in Firefox (Settings, Privacy & Security), open your site in a private window and confirm that no non-essential cookie is set before any interaction.