Global Privacy Control: Turn On This Browser Opt-Out

You clicked "Do Not Sell My Personal Information" on a shopping site last spring. Then you cleared your cookies, switched to your phone, and logged in from a work laptop. On at least two of those screens, that request quietly stopped existing.

Global Privacy Control fixes that by sending your opt-out automatically, from the browser, to every site you visit. Microsoft began rolling a built-in switch into Edge for US users in late October, Google is testing one in Chrome, and a California law forces every browser to offer it from January 1. This guide covers what the signal does, where it carries legal weight, what it misses, and how to turn it on in about a minute per device.

What Global Privacy Control Actually Sends

Global Privacy Control, or GPC, is a one-line message your browser attaches to every page request. It says, in effect, "this person opts out of the sale or sharing of their data." You set it once, and it travels with you to every site.

Compare that with the old way. Each site hides its own "Do Not Sell or Share" link in the footer. Many of those opt-outs live in a cookie, so clearing your browser history erases them. Others apply only to the device you clicked from.

GPC is not new. A group including DuckDuckGo, Brave and Mozilla launched it in October 2020. What changed is that it is moving out of privacy-niche browsers and into the two browsers most people actually use.

The older signal it replaces

If this sounds like "Do Not Track," that is the right comparison. Do Not Track failed because no law made anyone obey it, so sites ignored it. GPC is different because several state laws turn the signal into a binding request. That legal backing is the whole reason it matters now.

Why a Browser Signal Now Has Legal Teeth

California's privacy law treats a user-enabled opt-out preference signal like GPC as a valid request to stop selling or sharing your data. A business covered by the law cannot demand you also fill in its form. It has to honor the signal it receives.

Regulators have started collecting on that rule. The California Privacy Protection Agency fined Tractor Supply $1.35 million, the largest penalty in the agency's history at the time, partly for failing to honor opt-out preference signals such as Global Privacy Control. In March, the same agency ordered PlayOn Sports to pay $1.1 million after finding its platforms did not recognize the signal at all.

California is not alone. Colorado, Connecticut, Texas, Oregon and New Jersey are among roughly a dozen states whose privacy laws require covered businesses to honor a universal opt-out signal. Colorado's attorney general has formally recognized GPC as a qualifying mechanism.

• If you live in one of those states, a covered company that ignores your GPC signal is breaking the law.
• If you live elsewhere, the signal is still sent, but a site has no legal duty to act on it.
• Either way, many large sites apply one nationwide setting, so you may benefit even without a state law behind you.

What Changes on January 1 Under the Opt Me Out Act

Until now, the burden sat with you. Brave and DuckDuckGo send GPC by default, and Firefox offers it as a setting. Chrome and Edge users, who make up most of the market, needed an extension.

California's Opt Me Out Act, signed in 2025, flips that. From January 1, browsers must include a built-in setting that sends an opt-out preference signal. The state's privacy office says Californians will see new privacy options in their browsers once the law takes effect, and calls California the first state to require this.

Where Edge and Chrome stand today

Microsoft moved first. Edge's new GPC option sits under Settings, then "Privacy, search, and services," then the Privacy section. German outlet Borncity, citing Neowin's reporting, says the switch is limited to US users for now.

Google is further behind. Chrome's GPC toggle has appeared only in Canary, its experimental test channel. Code changes reported in August suggest the setting may show up only where a law requires it, which means many readers outside California could still need an extension after January.

The Real Math of Opting Out by Hand

So what does one switch actually save you? Run the numbers on the manual method. These figures are an illustration, not a survey, but they match how most households browse.

Say you regularly use 30 sites that sell or share data for ads. You browse on three devices: a home laptop, a phone and a work computer. Opting out by hand means 30 sites times 3 devices, or 90 separate forms.

• At 2 minutes per form, that is 180 minutes, or 3 hours of clicking.
• If a third of those opt-outs are stored in cookies, clearing your cookies wipes 30 of them. Do that four times a year and you redo 120 forms, another 4 hours.
• With Global Privacy Control, you flip one switch on each of the 3 browsers. Call it 3 minutes total, and clearing cookies does not touch it.

That is roughly 7 hours a year against 3 minutes. More to the point, nobody actually spends those 7 hours. The real choice is between a signal that runs on every visit and a promise to yourself you will not keep.

What Global Privacy Control Will Not Do

The catch is that GPC lives in your browser, and a lot of your data never passes through one. Knowing the gaps tells you what else to set.

It stops at the browser window

Phone apps, game consoles and connected TVs do not send your browser's signal. Your TV's viewing data runs through a separate system with its own settings, which is why turning off smart TV tracking is a separate job. The same goes for each app's privacy menu on your phone.

It can be scoped to one device

California's attorney general found exactly this problem in February. In a $2.75 million settlement with Disney, the office said Disney limited GPC opt-outs to the device a person was using, even when that person was logged in. Disney must now apply a logged-in opt-out across every streaming service tied to the account. Other companies may still scope it narrowly, so turn GPC on in every browser you use, not just one.

It does not erase what companies already have

GPC stops future selling and sharing. It does not delete records already sitting with a data broker, and it does nothing about breaches. When a vendor leaks a mailing list, as in the pattern behind how a newsletter data breach exposes your email, an opt-out signal is irrelevant.

Californians have a separate tool for deletion. The state's DROP platform, at privacy.ca.gov/drop, sends one verified deletion request to every registered data broker, and brokers had to start processing those requests in August.

How to Turn On Global Privacy Control in Every Browser

This takes about a minute per browser. Do it on every device you use, including your phone.

1. Microsoft Edge (US): Settings, then "Privacy, search, and services," then find Global Privacy Control under Privacy and switch it on. If you do not see it yet, update Edge, since the rollout is gradual.
2. Firefox: Settings, then Privacy & Security, then tick "Tell websites not to sell or share my data."
3. Brave and DuckDuckGo: GPC is on by default. Nothing to do.
4. Chrome: Until Google ships its built-in switch, install a GPC-supporting extension such as the EFF's Privacy Badger.
5. Check it worked: Visit globalprivacycontrol.org. The page reports whether your browser is sending the signal.

On phones, Chrome does not accept extensions, so a mobile browser with GPC built in is the simpler route. Browser choice is shifting fast for other reasons too, which our look at the AI browser wars covers if you are already weighing a switch.

What you give up

Very little. You may see ads that match your interests less closely, because sites can no longer pass your activity to ad partners. Sites still load, logins still work, and your shopping cart still remembers you. GPC is not an ad blocker, so if you want fewer ads rather than less tracking, that is a different tool.

Frequently Asked Questions

Does Global Privacy Control block ads?

No. It tells sites not to sell or share your data, so ads may become less targeted, but you will still see them. Blocking ads takes a separate content blocker.

Do websites have to honor Global Privacy Control?

In California and roughly a dozen other states with similar laws, covered businesses must treat the signal as a valid opt-out request. Elsewhere it is voluntary, though many large sites apply one policy nationwide.

Does Chrome support Global Privacy Control?

Not in the stable version yet. Google is testing a built-in toggle in Chrome Canary, and California's Opt Me Out Act requires browsers to offer one from January 1. Until then, a GPC extension such as Privacy Badger adds the signal.

Is Global Privacy Control the same as Do Not Track?

They work the same way technically, but Do Not Track had no law behind it and sites ignored it. Global Privacy Control is recognized under California's privacy law and several other state laws, which makes it enforceable.

Do I need to turn on Global Privacy Control on my phone too?

Yes. The signal only comes from the browser where you enabled it, and companies may apply it only to that device. Turn it on in every browser on every device you use.

One Minute Now Beats 90 Forms Later

For years, opting out was designed to be tedious enough that you would give up. Global Privacy Control moves the work from you to your browser, and state regulators are now fining companies that look the other way.

Turn it on today in every browser you own, starting with the one on your phone. Then spend five more minutes on the places the signal cannot reach: your TV, your apps and, if you live in California, the DROP deletion request. When January 1 arrives and your browser offers the switch on its own, you will already be ahead.