GPC signal: what Global Privacy Control means for a B2B marketing site, and how to honor it.

What is the GPC signal?

The GPC signal is a privacy preference that a browser sends to every website: a request not to sell or share the visitor's personal data. It travels as an HTTP header, Sec-GPC with a value of 1, and pages can read it in JavaScript as navigator.globalPrivacyControl. Visitors turn it on once, in a browser or an extension.

The W3C, the web's standards body, describes GPC as "a signal, transmitted over HTTP and through the DOM, that conveys a person's request" that sites not sell or share their data. The current specification is a W3C Working Draft dated September 24, 2026. It also defines an optional file, /.well-known/gpc.json, where a site can state that it is aware of the signal.

Support is already built in. The Global Privacy Control project lists Brave, DuckDuckGo's browser, where the signal is on by default, and Firefox, where it is a setting, plus extensions such as Privacy Badger. The project says the signal reaches over 150 million users. More are coming: California's AB 566, signed on October 8, 2025, requires browsers operating in the state to offer an opt-out preference signal when it takes effect in January 2027.

Which laws require you to honor GPC?

In California, Colorado, and Connecticut, covered businesses must treat the GPC signal as an opt-out. California's Attorney General says it "must be honored by covered businesses as a valid consumer request to stop the sale or sharing" of personal information. Colorado has required it since July 1, 2024, and Connecticut since January 1, 2025.

Regulators have acted on it. California announced a 1.2 million dollar settlement with Sephora in August 2022; according to the Attorney General, the company "failed to process user requests to opt out of sale via user-enabled global privacy controls." Three years later, on September 9, 2025, California, Colorado, and Connecticut announced a joint sweep of businesses that may be ignoring opt-outs sent through GPC. California's Attorney General said "businesses have an obligation to honor this request."

None of this is legal advice. Other states have their own rules, and thresholds and definitions differ between them, so have counsel confirm what applies to you.

Does GPC apply to B2B websites?

Often, yes. California's exemption for business-to-business personal information "expired on December 31, 2022," so a buyer reading your site from California is a consumer under the CCPA like anyone else. Colorado's law excludes people "acting in a commercial or employment context," but a browser signal can't tell you which context a visitor is in.

Here is where it gets awkward. A procurement lead comparing vendors from the office may fall outside Colorado's definition; the same person reading your blog on the couch that evening may not. The header doesn't say which, and neither does the JavaScript property. It doesn't say where they live, either.

You can honor the signal for everyone, or try to honor it only where a law clearly applies, which means guessing each visitor's location and context. We'd do the first unless counsel says otherwise. It costs you part of your retargeting audience, and you build and test one rule for every page.

What does honoring GPC mean on a marketing site?

For most B2B marketing sites, it means not loading tags that sell or share the visitor's data with third parties for that browser. In practice that is advertising pixels and retargeting tags, which serve what California calls cross-context behavioral advertising. Forms, the site itself, and analytics you don't use for advertising usually keep working.

That table is a common reading, not the only one, and the same tag can behave differently depending on its contract and settings. Walk through it with counsel once, then put the rule in your tag manager so every page follows it.

How do you set up GPC on your website?

Read the signal before any advertising tag loads, and when it's on, keep those tags off for that browser. On a Webflow or headless site, that is a small rule in your tag manager or consent tool, a line in the privacy notice, and a test. Your consent platform may read GPC already; check what it turns off.

Start with an inventory. Open your tag manager, list every tag, and mark the ones that sell or share data, with the table above as a guide. On most B2B sites the list is short: one or two ad pixels, a retargeting tag, maybe a data enrichment script someone added for an old campaign.

The check itself is one line of JavaScript. If navigator.globalPrivacyControl is true, don't fire the marked tags, or switch your consent tool to its opted-out state for advertising. Sites that render on a server can read the Sec-GPC header instead and leave those tags out of the HTML. Our guide to Consent Mode v2 on a Webflow site shows how consent states reach Google's tags.

Two loose ends are easy to miss. Leads still come in through forms, so pass the opt-out along, for example in a hidden field, so your CRM doesn't add that person to an ad audience later. And update the privacy notice: Colorado requires it to explain how opt-outs sent through universal opt-out mechanisms are processed. If you want to show awareness publicly, the W3C draft describes an optional /.well-known/gpc.json file.

How do you test that your site honors GPC?

Turn the signal on, load your pages, and watch the network requests. If the setup works, requests carry Sec-GPC: 1, the page reports navigator.globalPrivacyControl as true, and nothing goes out to your ad networks, while forms and pages behave normally.

The quickest way to send the signal is a browser that already supports it. Firefox has it as a privacy setting, and Brave and DuckDuckGo's browser send it too. Open your site, open the developer tools, and reload with the Network tab visible.

Click any page request and look for Sec-GPC: 1 in the request headers. Then type navigator.globalPrivacyControl in the console; it should return true. Now filter the network list by the domains of your ad platforms. If anything shows up, a tag is still firing, often one pasted straight into the page code rather than added through the tag manager.

Finish with a test lead through your main form, and check that it reaches the CRM with the opt-out recorded. Then turn the signal off and repeat, to make sure the tags still load for everyone else. Do this again whenever someone adds a pixel, launches a campaign, or updates the consent tool. Our Webflow analytics guide covers the wider tracking setup, and our website maintenance checklist has a slot for the quarterly retest.

We build and maintain websites for B2B SaaS companies, so we have an interest in the topic. Our website support plans include checks like these.

Questions about the GPC signal