A Single Setting That Opts You Out Everywhere
Most privacy laws that give you the right to opt out of data sales require you to visit each company’s website individually and click through their specific opt-out process. Global Privacy Control (GPC) flips that around: it’s a browser or extension setting that broadcasts a standardized “do not sell or share my data” signal to every website you visit automatically, no per-site clicking required. In states where GPC compliance is legally mandated, a company that ignores the signal is violating the law.
How GPC Actually Works
When GPC is enabled, your browser sends a small signal alongside every web request telling the site “this visitor has opted out of the sale and sharing of their personal information.” Compliant websites are supposed to detect that signal and automatically apply the same opt-out you’d otherwise have to request manually through a “Do Not Sell My Info” link.
GPC only affects websites, it does not opt you out of data collection by apps, it doesn’t stop data brokers who don’t check for the signal, and it can’t retroactively delete data already collected. It’s a forward-looking preference signal, not a removal tool.
Which States Legally Require Honoring GPC
Several state privacy laws specifically require covered businesses to recognize and honor GPC (or an equivalent universal opt-out mechanism) rather than requiring per-site requests:
- Colorado (Colorado Privacy Act) requires honoring universal opt-out signals like GPC.
- Connecticut requires honoring opt-out preference signals.
- Delaware, as of January 1, 2026, requires companies to honor opt-out preference signals under its Personal Data Privacy Act.
- A growing number of other states with comprehensive privacy laws are adding similar universal opt-out signal requirements as their laws mature.
California’s CCPA also recognizes GPC as a valid method of exercising your opt-out rights, though California’s broader framework doesn’t mandate it as the exclusive required mechanism the way some newer state laws do.
If you live in a state without a GPC mandate, turning it on still doesn’t hurt, and many companies honor it voluntarily even without a legal requirement, but you have less legal recourse if a company ignores it.
How to Turn On GPC
Browsers With Native Support
- Firefox: Go to Settings, then Privacy & Security, and enable “Tell websites not to sell or share my data” (also called “Global Privacy Control” in some versions).
- Brave: GPC is enabled by default in Brave’s Shields settings, no action needed.
- DuckDuckGo browser: GPC is enabled by default.
Chrome and Safari (No Native Support)
Chrome and Safari don’t currently offer a built-in GPC toggle. To enable GPC on these browsers, install a privacy-focused extension that supports the signal, such as Privacy Badger (from the Electronic Frontier Foundation) or DuckDuckGo’s Privacy Essentials extension.
What GPC Won’t Do
GPC is a genuinely useful, free, one-time-setup tool, but it’s not a complete privacy solution. It won’t remove information data brokers already collected before you turned it on. It won’t stop companies that simply ignore the signal in states without a legal mandate. And it has no effect on people-search sites that build profiles from public records rather than tracking your browsing, which is the majority of what shows up when you search your own name.
For that layer, opting out of individual data broker listings directly, or using a removal service to handle it at scale, is still necessary. See our comparison of Incogni, DeleteMe, Optery, and Aura if you want ongoing removal alongside GPC.
The Bottom Line
Turning on GPC takes about thirty seconds and costs nothing. It’s not a substitute for actively opting out of data broker sites, but it’s a meaningful, low-effort layer that stops a lot of future data sales before they happen, and in states like Colorado and Connecticut, companies are legally required to listen to it.
