Sec-GPC

Privacy regulations require a machine-readable opt-out signal for data sale and sharing. The Sec-GPC request header transmits that signal, expressing a preference against cross-context targeted advertising.

Table of Contents

Usage

The Sec-GPC header is part of the Global Privacy Control (GPC) specification developed at the W3C. When a browser sends Sec-GPC: 1, the signal expresses the preference to opt out of data sale and sharing. The absence of the header means no preference has been stated.

GPC builds on the concept behind Do Not Track (DNT) but carries stronger legal backing. Several privacy regulations recognize GPC as a valid opt-out mechanism. The California Consumer Privacy Act (CCPA/CPRA) requires businesses to treat GPC as a binding opt-out of data sale and sharing. Colorado and other US states with comprehensive privacy laws include similar provisions. California legislation will require browsers to provide a built-in GPC setting once the mandate takes effect.

The header uses the Sec- prefix, preventing JavaScript from setting or modifying the value via the XMLHttpRequest and fetch() APIs. On the client side, the navigator.globalPrivacyControl property exposes the same preference as a boolean. Scripts checking this property see true when GPC is active and false otherwise.

The header is sent with every request when the user has enabled the preference. Servers receiving the signal are expected to apply applicable privacy protections. In the absence of regulatory requirements, the specification leaves the response to server discretion.

Firefox sends Sec-GPC by default in private browsing and exposes the preference as a manual setting for regular browsing. Brave and DuckDuckGo browsers send the header by default. Chromium-based browsers without built-in GPC support rely on third-party extensions.

Values

1

The value 1 is the only defined value. The header is either sent with this value or omitted entirely. There is no 0 value. The absence of the header is the neutral state.

Example

A browser with GPC enabled sends the header on every request. The value 1 indicates the preference to opt out of data sale and sharing.

Sec-GPC: 1

A server receiving GPC alongside other privacy-related headers. The combination of Sec-GPC and DNT signals the preference through both the modern and legacy mechanisms.

Sec-GPC: 1
DNT: 1

JavaScript access to the GPC preference through the navigator.globalPrivacyControl property. The value mirrors the state of the Sec-GPC header for the current page load.

if (navigator.globalPrivacyControl) {
  // disable third-party sharing features
}

A signal the page cannot forge

The Sec- prefix places Sec-GPC among the headers script is forbidden to set, so a value on the wire was asserted by the browser under user control rather than by page code. The predecessor lacked exactly this property: DNT carried no protected prefix and was script-settable, which weakened its evidentiary value. Absence is equally precise in the other direction, meaning no decision rather than consent.

Legal weight arrived through enforcement. The California attorney general's Sephora settlement, 1.2 million dollars in 2022, turned on the company ignoring opt-outs delivered through this signal, establishing a browser-level preference as a CCPA opt-out a business processes rather than a suggestion.

Shipping and sending are different facts. Chrome and Safari send nothing. Firefox sends the header by default only in private browsing and otherwise ships the mechanism behind a setting, off by default, so regular browsing emits the header only after a deliberate choice, with Brave and DuckDuckGo enabling the signal out of the box. Server-side handling starts with reading one header and one value, Sec-GPC: 1, and a /.well-known/gpc.json resource advertises whether an origin intends to honor the signal.

See also

Last updated: August 17, 2026