By Marc Alexander

Some of your US visitors have already opted out before they reach your site. Their browser says so on every request. The question is whether your tags are listening.

Global Privacy Control, or GPC, is a signal a browser sends to every website to say "don't sell or share my data". Brave and DuckDuckGo's browser send it by default, Firefox has a setting for it, and browser extensions add it elsewhere.

Why it matters now.

California has required businesses to treat GPC as a valid opt-out of the sale and sharing of personal information for several years. Its first big privacy settlement, with Sephora in 2022, was partly about not honouring it.

Since then, more states have written similar requirements into their own privacy laws. By 2026 around a dozen states, including California, Colorado, Connecticut, Texas and New Jersey, require businesses to honour opt-out signals like GPC. A visitor with it switched on counts as having opted out, without clicking anything on your site.

How the signal reaches you.

GPC arrives in two ways:

  • as a request header, Sec-GPC: 1, sent with every page request
  • as a property in the browser, navigator.globalPrivacyControl, which is true when the setting is on

Tags in the browser can read the second, which makes Google Tag Manager the natural place to act on it.

Honouring it in Tag Manager.

If your consent platform supports GPC, switch that option on and check it works. Many do. If not, the steps in GTM are straightforward:

  1. Create a variable. A Custom JavaScript variable, for example "GPC enabled", that returns whether the signal is on: 
    function () {
  return navigator.globalPrivacyControl === true;
}
  2. Update consent early. In a tag on the Consent Initialization trigger, when the variable is true, update Consent Mode so ad_storage, ad_user_data and ad_personalization are denied.
  3. Restrict Google Ads processing. Set Google's restricted data processing for those visitors, so Google Ads processes their data only for limited purposes.
  4. Stop the other pixels. Add the variable to the triggers of Meta, TikTok and other advertising tags as an exception, so they don't fire when it's true.
  5. Record it. If your site stores opt-outs, save this one too, so it holds for the visitor's account and future visits.

Whether analytics tags such as GA4 should change as well depends on how your lawyers classify your analytics. Most treat advertising as the priority.

Only for the right visitors?

The laws cover residents of the states that have them. Some businesses apply GPC only to visitors detected in those states. Many apply it to everyone, because location detection is imperfect and honouring an explicit "no" everywhere is simpler to defend. That's a policy decision for your legal team.

If you do apply it by location, Consent Mode's region settings can help, as described in region-specific consent in Tag Manager.

Testing it.

  1. Open your site in Brave, or in Firefox with Global Privacy Control switched on in its privacy settings.
  2. In the browser console, check navigator.globalPrivacyControl returns true.
  3. Use GTM's Preview mode to confirm the consent update fires first, and the advertising tags don't fire.
  4. In the network panel, check there are no requests to the ad platforms you've excluded.
  5. Repeat in a browser with the setting off, to make sure you haven't blocked everyone.

GPC is one part of meeting US state privacy laws. Marc Alexander sets up consent for US businesses in Tag Manager and Consent Mode, and tests every state. The GA4 mini audit shows what your tags do today.