Extenshiextenshi.io/blog
Back to articles
privacybrowser-extensionsgpcglobal-privacy-controlccpadata-sellingchrome-extensions

Global Privacy Control (GPC) explained: what browser extensions can really do

Global Privacy Control (GPC) is the opt-out signal a dozen US states make businesses honor. How it works, why Chrome lacks it, and what it means for extensions.

Maxim Kosterin
10 min read
A hairline browser window raising one soft orange watercolor pennant toward a receding row of small web pages — one signal sent to every site.
A hairline browser window raising one soft orange watercolor pennant toward a receding row of small web pages — one signal sent to every site.

Tick one box in Firefox, and every site you visit gets a short machine-readable note: don't sell or share my data. The note is called Global Privacy Control, or GPC. In a dozen US states it isn't a polite request. It's an opt-out that businesses are legally required to honor.

Here's the awkward part. Chrome, where most extension users live, doesn't send it yet. A California law makes every browser offer a built-in opt-out signal by January 1, 2027. Until then, extensions fill the gap, and the data-selling ones may be on the hook to honor it.

What Global Privacy Control actually is

GPC is a one-bit signal your browser attaches to every request. It means one thing: don't sell or share this person's data. The W3C draft spec is deliberately tiny, and the GPC project tracks which browsers and extensions send it.

The law is what makes it matter. California's Attorney General says GPC "must be honored by covered businesses as a valid consumer request to stop the sale or sharing of personal information." No form, no email, no dark-pattern maze. You flip the switch once, and your browser repeats it everywhere.

GPC vs Do Not Track: what's different this time

You might remember Do Not Track, a header asking sites not to track you. It failed because nobody had to obey it, so most sites didn't. Firefox dropped its Do Not Track checkbox in version 135 and points people to GPC instead.

GPC asks for less and has a law behind it. It doesn't ask sites to stop tracking you, only not to sell or share your data. That's a right state privacy laws already give you, so a GPC signal is just your existing opt-out, delivered automatically.

The technical part: one header, one property, one file

GPC rides on two mechanisms, and you can read both in an afternoon.

Every HTTP request carries a header:

Sec-GPC: 1

And every page can read a JavaScript property:

if (navigator.globalPrivacyControl === true) {
	// This user has opted out of sale/sharing.
	// If your business sells or shares personal data, stop for them.
}

There's a third piece for site owners. A site can publish /.well-known/gpc.json to say whether it claims to honor the signal. That's the whole spec, and MDN's write-up covers the details.

One thing worth internalizing: GPC is a legal signal, not a technical barrier. It creates an obligation on the receiving end, and obligations are only as strong as enforcement.

Who sends it today

Per the GPC project, native support includes Brave and DuckDuckGo's browser, which send it by default, and Firefox. In Firefox it's a setting: open Settings → Privacy & Security and tick Tell websites not to sell or share my data.

Chrome, Safari and Edge aren't on that list. California's Opt Me Out Act (AB 566), signed in October 2025, is aimed at that gap. From January 1, 2027, the law (Civil Code §1798.136) bars shipping a browser without an opt-out signal that's "easy for a reasonable person to locate and configure." It doesn't name GPC, but GPC is the signal California already recognizes.

Chrome is the interesting one, because the work is visible. In December 2025 a Chromium contributor opened a GPC entry on Chrome Platform Status with an Intent to Prototype, citing the 2027 deadline. Chromium's source now has a "Force Global Privacy Control signal" flag for testing and a GPC settings page that's still off by default.

In that work-in-progress code, the setting is offered to users Chrome believes are in California: the default target location is us-ca. Google hasn't announced a ship date, and server-side rollouts aren't visible in the source. Treat it as groundwork, not a launch.

Who has to listen

California's privacy agency counts a dozen states that require businesses to honor opt-out signals. Four of them — California, Colorado, Connecticut and New Jersey — have said explicitly that GPC counts, per the GPC project's FAQ. The other eight allow opt-outs through "universal opt-out mechanisms", which is exactly what GPC is.

California also wants you to see it working. Since January 1, 2026, the CCPA regulations (§7025(c)(6)) require a business to show on its website whether it processed your signal as an opt-out. The rules give "Opt-Out Request Honored" as an example.

And this isn't hypothetical anymore. In September 2025, California, Colorado and Connecticut announced a joint sweep of businesses that didn't appear to honor GPC. California's settlements tell the same story, according to the Attorney General's announcements:

Where extensions fit in, on both sides

Side one: extensions as the fix. In Chrome today, the way to send GPC is an extension. Two well-known examples are Privacy Badger and DuckDuckGo Privacy Essentials.

The mechanics are worth a look if you build extensions. In Manifest V3 the header comes from a declarativeNetRequest modifyHeaders rule. DuckDuckGo's open-source extension, for example, generates one that sets Sec-GPC: 1 on outgoing requests. I walked through that rule machinery in my DNR tutorial.

The JavaScript property is trickier. Page scripts only see navigator.globalPrivacyControl if the extension defines it from a script running in the page's own JavaScript world (the MAIN world). A normal content script lives in an isolated world, so its changes to navigator are invisible to the page.

Telling detail: Chrome's privacy API, the official way for extensions to flip browser privacy switches, has a Do Not Track switch (websites.doNotTrackEnabled) but no GPC switch. Chrome itself has no GPC setting yet, so GPC extensions work at the network layer instead. I covered the privacy permission in its own post.

Side two: extensions as the regulated. GPC obligations fall on businesses, and a developer who sells user data can be one. California's law has a threshold that fits data-funded extensions exactly. Make half your revenue or more from selling or sharing Californians' personal information, and the law covers you however small you are (Civil Code §1798.140).

Remember the 82 Chrome extensions LayerX Security found disclosing the sale of 6.5 million users' data in their privacy policies? Disclose in a policy nobody reads, then sell: that model now has a mandatory off switch in a dozen states. Honor GPC, and users who send it are out of the sale. Ignore it, and you're one state sweep away from a settlement.

One wrinkle: the rules were written with websites in mind, so how an extension's own data pipeline should pick up the signal is less settled. I'd treat that gray area as a reason to honor GPC wherever your code can see it, not as a loophole. And if your extension has accounts, remember the third settlement: an opt-out that stopped at one device was the problem.

What GPC does not do

Let's keep expectations honest, because this is where GPC gets oversold.

It's not a tracker blocker. The analytics still run, the pixels still fire, and the extension still sees what its permissions let it see. GPC only says: whatever you collect, don't sell or share this user's data. My breakdown of browsing-history exfiltration shows how much an extension can collect in the first place.

It doesn't apply everywhere. The obligations come from state privacy laws, which cover residents of those states and businesses that meet each law's thresholds. A hobby extension that makes no money and never sells data has nothing to comply with.

And it does nothing about malicious extensions. A fake ad blocker shipping your history to a data broker doesn't care about headers or state AGs. GPC protects you from the legal data trade, the disclosed, policy-covered kind. That's exactly the kind most people can't spot on their own.

How to check your extensions

So what do you actually do with all this?

  1. Read the sale/share section of the privacy policy. Search it for "sell", "share", and "Global Privacy Control" or "opt-out preference signal". A developer who honors GPC has every reason to say so. A policy that claims the right to sell your data and never mentions opt-out signals is a yellow flag.
  2. Check the permissions that make a dataset sellable. <all_urls>, history and tabs are the usual suspects. Permissions don't prove a sale, but they define what's possible.
  3. Decide whether you want to send GPC at all. In Firefox, it's the one checkbox above. In Chrome, for now, it means installing a privacy extension that sets it, and checking that extension the same way. Ironic, but that's the ecosystem.
  4. Check before you install. Paste the store URL into the Extenshi checker and look at the safety score and permission list before the extension ever sees your browser.

Your browser should be sending this signal for you, and from 2027 California law says it must. Until then, it's on you to make sure something sends it, and to check who's listening.

Check an extension →: one store URL, one report with the safety score, permissions, and what the listing really asks for. You can also browse the catalog to see what the extensions you already love ask for. Installed a pile of them? Scan the extensions you installed from a store with Guard →

Sources

This article is based on publicly available laws, regulations, enforcement announcements, official browser documentation and Chromium source code, plus third-party privacy research; state counts, deadlines and browser support were checked on October 16, 2026 and may have changed since. Extenshi does not independently verify all claims made by third-party researchers. References to specific companies or products reflect the findings of cited sources and do not constitute accusations of intentional wrongdoing. If you believe any information is inaccurate, please contact us at [email protected].

Related Articles