CINXE.COM

<!DOCTYPE html><html lang="en"><head><meta charSet="UTF-8"/><meta http-equiv="X-UA-Compatible" content="IE=Edge"/><meta name="viewport" content="width=device-width, initial-scale=1"/><meta name="robots" content="all"/><meta name="HandheldFriendly" content="true"/><meta name="referrer" content="no-referrer-when-downgrade"/><link rel="apple-touch-icon" sizes="180x180" href="/img/favicon/apple-touch-icon.png"/><link rel="icon" type="image/png" sizes="32x32" href="/img/favicon/favicon-32x32.png"/><link rel="icon" type="image/png" sizes="16x16" href="/img/favicon/favicon-16x16.png"/><link rel="manifest" href="/site.webmanifest"/><title>Frequently Asked Questions | Global Privacy Control</title><meta name="title" content="Frequently Asked Questions | Global Privacy Control"/><meta name="description" content="Exercise your privacy rights in one step via the “Global Privacy Control” (GPC) signal, a proposed specification backed by over a dozen organizations."/><link rel="canonical" href="https://globalprivacycontrol.org/faq"/><meta property="og:type" content="website"/><meta property="og:url" content="https://globalprivacycontrol.org/faq"/><meta property="og:title" content="Frequently Asked Questions | Global Privacy Control"/><meta property="og:description" content="Exercise your privacy rights in one step via the “Global Privacy Control” (GPC) signal, a proposed specification backed by over a dozen organizations."/><meta property="og:image" content="https://globalprivacycontrol.org/img/gpc-social-big.jpg"/><meta name="twitter:card" content="summary_large_image"/><meta name="twitter:url" content="https://globalprivacycontrol.org/faq"/><meta name="twitter:title" content="Global Privacy Control — Take Control Of Your Privacy"/><meta name="twitter:description" content="Exercise your privacy rights in one step via the “Global Privacy Control” (GPC) signal, a proposed specification backed by over a dozen organizations."/><meta name="twitter:image" content="https://globalprivacycontrol.org/img/gpc-social-big.jpg"/><meta name="twitter:site" content="@globalprivcntrl"/><meta name="twitter:creator" content="@globalprivcntrl"/><meta name="next-head-count" content="26"/><link rel="preload" href="/_next/static/css/4c7c71af00750e7c.css" as="style" crossorigin="anonymous"/><link rel="stylesheet" href="/_next/static/css/4c7c71af00750e7c.css" crossorigin="anonymous" data-n-g=""/><link rel="preload" href="/_next/static/css/4d301fbc82950a1f.css" as="style" crossorigin="anonymous"/><link rel="stylesheet" href="/_next/static/css/4d301fbc82950a1f.css" crossorigin="anonymous" data-n-p=""/><noscript data-n-css=""></noscript><script defer="" crossorigin="anonymous" nomodule="" src="/_next/static/chunks/polyfills-42372ed130431b0a.js"></script><script src="/_next/static/chunks/webpack-f589c4a567f8d08f.js" defer="" crossorigin="anonymous"></script><script src="/_next/static/chunks/framework-49c6cecf1f6d5795.js" defer="" crossorigin="anonymous"></script><script src="/_next/static/chunks/main-bde9ba5b55cb3179.js" defer="" crossorigin="anonymous"></script><script src="/_next/static/chunks/pages/_app-b3bdceccb5cb7748.js" defer="" crossorigin="anonymous"></script><script src="/_next/static/chunks/500-78d27ccc42d9a0f0.js" defer="" crossorigin="anonymous"></script><script src="/_next/static/chunks/918-4197135f264ad047.js" defer="" crossorigin="anonymous"></script><script src="/_next/static/chunks/pages/faq-707e171f76b69db7.js" defer="" crossorigin="anonymous"></script><script src="/_next/static/mrN_tD8pj6JtI-9KzqZN1/_buildManifest.js" defer="" crossorigin="anonymous"></script><script src="/_next/static/mrN_tD8pj6JtI-9KzqZN1/_ssgManifest.js" defer="" crossorigin="anonymous"></script></head><body><div id="__next"><div><aside></aside><header class="layout_header__kmos1"><div class="container"><div class="row no-gutters justify-content-center"><div class="col-12 layout_navWrapper__T5iiL"><nav class="navbar_navbar__iQJkt navbar navbar-expand-md"><div class="navbar__logos"><a href="/"><span class="visually-hidden_hidden__pVHwT">Home</span><img class="d-lg-none" src="/img/gpc-logo-mobile.svg" alt="global privacy control logo" id="hero-logo"/><img class="d-none d-lg-block navbar_headerLogoSmall__Dp52K" src="/img/gpc-logo-small.svg" alt="global privacy control logo" id="hero-logo"/></a></div><button class="d-md-none bg-transparent border-0" type="button" data-toggle="collapse" data-target="#navbarSupportedContent" aria-controls="navbarSupportedContent" aria-label="Main menu" aria-expanded="false"><svg width="22" height="12" viewBox="0 0 22 12" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-rule="evenodd" d="M0 1C0 0.447715 0.447715 0 1 0H21C21.5523 0 22 0.447715 22 1C22 1.55228 21.5523 2 21 2H1C0.447716 2 0 1.55228 0 1ZM0 6C0 5.44772 0.447715 5 1 5H21C21.5523 5 22 5.44772 22 6C22 6.55228 21.5523 7 21 7H1C0.447716 7 0 6.55228 0 6ZM1 10C0.447715 10 0 10.4477 0 11C0 11.5523 0.447716 12 1 12H21C21.5523 12 22 11.5523 22 11C22 10.4477 21.5523 10 21 10H1Z" fill="white"></path></svg></button><div class="d-none d-md-block ml-auto text-nowrap"><ul class="navbar-nav navbar_linkList__c2Lqv"><li class="nav-item"><a class="nav-link text-uppercase" href="/#about">About</a></li><li class="nav-item"><a class="nav-link text-uppercase" href="/#gpc-spec">Spec</a></li><li class="nav-item"><a class="nav-link text-uppercase" href="/GPC_for_Users.pdf">For Users</a></li><li class="nav-item"><a class="nav-link text-uppercase" href="/implementation">For Implementers</a></li><li class="nav-item"><a class="nav-link text-uppercase" href="/#download">Download</a></li><li class="nav-item"><a class="nav-link text-uppercase" href="/#orgs">Organizations</a></li><li class="nav-item"><a class="nav-link text-uppercase" href="/#press">Press</a></li><li class="nav-item"><a class="nav-link text-uppercase" href="/#faq">FAQ</a></li></ul></div><div class="w-100 d-md-none overflow-hidden navbar_mobileMenu__kZxA7 " id="navbarSupportedContent"><div class="mt-4 d-flex"><ul class="navbar-nav navbar_linkList__c2Lqv"><li class="nav-item"><a class="nav-link text-uppercase" href="/#about">About</a></li><li class="nav-item"><a class="nav-link text-uppercase" href="/#gpc-spec">Spec</a></li><li class="nav-item"><a class="nav-link text-uppercase" href="/GPC_for_Users.pdf">For Users</a></li><li class="nav-item"><a class="nav-link text-uppercase" href="/implementation">For Implementers</a></li><li class="nav-item"><a class="nav-link text-uppercase" href="/#download">Download</a></li><li class="nav-item"><a class="nav-link text-uppercase" href="/#orgs">Organizations</a></li><li class="nav-item"><a class="nav-link text-uppercase" href="/#press">Press</a></li><li class="nav-item"><a class="nav-link text-uppercase" href="/#faq">FAQ</a></li></ul></div></div></nav></div></div></div></header><main><article class="article_articleWrapper__8gQb0"><div class="container"><div class="article_article__GEzIS"><div class="row justify-content-center"><div class="col-10"><div class="text-center"><h1 class="mb-4">Frequently Asked Questions</h1></div></div></div><div class="row justify-content-center"><div class="col-11 col-lg-8"><div vocab="https://schema.org/" typeof="FAQPage"><div property="mainEntity" typeof="Question"><section id="WhatIsGPC" class="mt-2"><header class="faq-list_header__YQn_V" property="name"><a class="px-4" href="#WhatIsGPC"><h2>What is the Global Privacy Control (GPC)?</h2><svg width="1em" height="1em" viewBox="0 0 16 16" fill="currentColor" xmlns="http://www.w3.org/2000/svg"><path d="M12.14 8.753l-5.482 4.796c-.646.566-1.658.106-1.658-.753V3.204a1 1 0 0 1 1.659-.753l5.48 4.796a1 1 0 0 1 0 1.506z"></path></svg></a></header><div class="collapse_collapse__qcl8O" style="height:0px" property="acceptedAnswer" typeof="Answer"><div property="text" class="faq-list_content__Lo4rF px-4 pt-4"><p>Global Privacy Control (GPC) is a proposed specification designed to allow Internet users to notify businesses of their privacy preferences, such as whether or not they want their personal information to be sold or shared. It consists of a setting or extension in the user’s browser or mobile device and acts as a mechanism that websites can use to indicate they support the specification.</p> </div></div></section></div><div property="mainEntity" typeof="Question"><section id="WhoIsGPC" class="mt-2"><header class="faq-list_header__YQn_V" property="name"><a class="px-4" href="#WhoIsGPC"><h2>Who is supporting the development of GPC?</h2><svg width="1em" height="1em" viewBox="0 0 16 16" fill="currentColor" xmlns="http://www.w3.org/2000/svg"><path d="M12.14 8.753l-5.482 4.796c-.646.566-1.658.106-1.658-.753V3.204a1 1 0 0 1 1.659-.753l5.48 4.796a1 1 0 0 1 0 1.506z"></path></svg></a></header><div class="collapse_collapse__qcl8O" style="height:0px" property="acceptedAnswer" typeof="Answer"><div property="text" class="faq-list_content__Lo4rF px-4 pt-4"><p>GPC is being developed by a broad coalition of stakeholders: technologists, web publishers, technology companies, browser vendors, extension developers, academics, and civil rights organizations.</p> <p>The GPC was initially spearheaded by <a href="https://twitter.com/ashk4n">Ashkan Soltani</a> <a href="https://www.georgetowntech.org/">Georgetown Law</a> and <a href="https://twitter.com/SZimmeck">Sebastian Zimmeck</a> (<a href="https://www.wesleyan.edu/">Wesleyan University</a>) in collaboration with <a href="https://www.nytimes.com">The New York Times</a>, <a href="https://www.washingtonpost.com/">The Washington Post</a>, <a href="https://www.ft.com/">Financial Times</a>, <a href="https://automattic.com/">Automattic (Wordpress.com & Tumblr)</a>, <a href="https://glitch.com/">Glitch</a>, <a href="https://spreadprivacy.com/announcing-global-privacy-control/">DuckDuckGo</a>, <a href="https://brave.com/global-privacy-control/">Brave</a>, <a href="https://www.mozilla.org/en-US/">Mozilla</a>, <a href="https://disconnect.me/">Disconnect</a>, <a href="https://joindeleteme.com/blog/how-to-enable-global-privacy-control/">Abine</a>, <a href="https://digitalcontentnext.org/">Digital Content Next (DCN)</a>, <a href="https://advocacy.consumerreports.org/issue/tech-privacy/">Consumer Reports</a>, and the <a href="https://www.eff.org/">Electronic Frontier Foundation (EFF)</a>.</p> </div></div></section></div><div property="mainEntity" typeof="Question"><section id="HowToSignal" class="mt-2"><header class="faq-list_header__YQn_V" property="name"><a class="px-4" href="#HowToSignal"><h2>I’m a web user. How can I use GPC to signal my privacy preferences to websites?</h2><svg width="1em" height="1em" viewBox="0 0 16 16" fill="currentColor" xmlns="http://www.w3.org/2000/svg"><path d="M12.14 8.753l-5.482 4.796c-.646.566-1.658.106-1.658-.753V3.204a1 1 0 0 1 1.659-.753l5.48 4.796a1 1 0 0 1 0 1.506z"></path></svg></a></header><div class="collapse_collapse__qcl8O" style="height:0px" property="acceptedAnswer" typeof="Answer"><div property="text" class="faq-list_content__Lo4rF px-4 pt-4"><p>GPC is available for an increasing number of browsers and browser extensions, listed <a href="https://globalprivacycontrol.org/#download">here</a>. If you want to use GPC, you can download and enable it via a participating browser or browser extension. More information about downloading GPC is available <a href="https://globalprivacycontrol.org/">here</a>.</p> </div></div></section></div><div property="mainEntity" typeof="Question"><section id="Publisher" class="mt-2"><header class="faq-list_header__YQn_V" property="name"><a class="px-4" href="#Publisher"><h2>I’m a publisher, developer, or other service. How can I support GPC?</h2><svg width="1em" height="1em" viewBox="0 0 16 16" fill="currentColor" xmlns="http://www.w3.org/2000/svg"><path d="M12.14 8.753l-5.482 4.796c-.646.566-1.658.106-1.658-.753V3.204a1 1 0 0 1 1.659-.753l5.48 4.796a1 1 0 0 1 0 1.506z"></path></svg></a></header><div class="collapse_collapse__qcl8O" style="height:0px" property="acceptedAnswer" typeof="Answer"><div property="text" class="faq-list_content__Lo4rF px-4 pt-4"><p>The GPC spec is easy to implement on a wide variety of websites and other services. The proposed specification and back-end implementation reference documentation are available <a href="https://global-privacy-control.glitch.me/">here</a>. For additional information, please feel free to reach out on Github or Twitter (<a href="https://twitter.com/globalprivctrl">@globablprivctrl</a>).</p> </div></div></section></div><div property="mainEntity" typeof="Question"><section id="Policymaker" class="mt-2"><header class="faq-list_header__YQn_V" property="name"><a class="px-4" href="#Policymaker"><h2>I’m a policymaker. How can I support GPC or learn more about how it could apply in my jurisdiction?</h2><svg width="1em" height="1em" viewBox="0 0 16 16" fill="currentColor" xmlns="http://www.w3.org/2000/svg"><path d="M12.14 8.753l-5.482 4.796c-.646.566-1.658.106-1.658-.753V3.204a1 1 0 0 1 1.659-.753l5.48 4.796a1 1 0 0 1 0 1.506z"></path></svg></a></header><div class="collapse_collapse__qcl8O" style="height:0px" property="acceptedAnswer" typeof="Answer"><div property="text" class="faq-list_content__Lo4rF px-4 pt-4"><p>As it is intended to invoke users’ privacy rights, we encourage policymakers from around the world to engage in the development of this specification. If you would like to learn more about how GPC could work in your jurisdiction, please contact us via email at <a href="mailto:info%5Bat%5Dglobalprivacycontrol.org">info[at]globalprivacycontrol.org</a>.</p> </div></div></section></div><div property="mainEntity" typeof="Question"><section id="GetInvolved" class="mt-2"><header class="faq-list_header__YQn_V" property="name"><a class="px-4" href="#GetInvolved"><h2>How can I get involved in developing the proposed specification?</h2><svg width="1em" height="1em" viewBox="0 0 16 16" fill="currentColor" xmlns="http://www.w3.org/2000/svg"><path d="M12.14 8.753l-5.482 4.796c-.646.566-1.658.106-1.658-.753V3.204a1 1 0 0 1 1.659-.753l5.48 4.796a1 1 0 0 1 0 1.506z"></path></svg></a></header><div class="collapse_collapse__qcl8O" style="height:0px" property="acceptedAnswer" typeof="Answer"><div property="text" class="faq-list_content__Lo4rF px-4 pt-4"><p>GPC was initially introduced at the World Wide Web Consortium (W3C) <a href="https://privacycg.github.io/">Privacy Community Group</a> (Privacy CG) in April 2020. A number of stakeholders are part of that community. There are ongoing discussions in the Privacy CG. Interested parties are encouraged to engage with the proposal <a href="https://github.com/privacycg/proposals/issues/10/">here</a>.</p> <p>Additionally, GPC is currently being implemented across the web. A number of browsers, extensions, and publishers are supporting or implementing GPC (see below).</p> </div></div></section></div><div property="mainEntity" typeof="Question"><section id="Benefit" class="mt-2"><header class="faq-list_header__YQn_V" property="name"><a class="px-4" href="#Benefit"><h2>How does GPC benefit consumers, publishers, software makers, and advertisers?</h2><svg width="1em" height="1em" viewBox="0 0 16 16" fill="currentColor" xmlns="http://www.w3.org/2000/svg"><path d="M12.14 8.753l-5.482 4.796c-.646.566-1.658.106-1.658-.753V3.204a1 1 0 0 1 1.659-.753l5.48 4.796a1 1 0 0 1 0 1.506z"></path></svg></a></header><div class="collapse_collapse__qcl8O" style="height:0px" property="acceptedAnswer" typeof="Answer"><div property="text" class="faq-list_content__Lo4rF px-4 pt-4"><p>The online advertising ecosystem is evolving, and consumer expectations are changing. An increasing number of web users do not want to be tracked by parties they aren’t choosing to interact with, and new laws, technological changes, and advertising business models reflect these preferences.</p> <p>GPC provides consumers and businesses with clear expectations and guidelines for the sharing and sale of data online. It permits users to easily and clearly exercise their privacy rights, facilitates greater trust between businesses and their customers, and fosters certainty for businesses and advertisers by relying on an open standard.</p> </div></div></section></div><div property="mainEntity" typeof="Question"><section id="IsItBinding" class="mt-2"><header class="faq-list_header__YQn_V" property="name"><a class="px-4" href="#IsItBinding"><h2>Is GPC legally binding?</h2><svg width="1em" height="1em" viewBox="0 0 16 16" fill="currentColor" xmlns="http://www.w3.org/2000/svg"><path d="M12.14 8.753l-5.482 4.796c-.646.566-1.658.106-1.658-.753V3.204a1 1 0 0 1 1.659-.753l5.48 4.796a1 1 0 0 1 0 1.506z"></path></svg></a></header><div class="collapse_collapse__qcl8O" style="height:0px" property="acceptedAnswer" typeof="Answer"><div property="text" class="faq-list_content__Lo4rF px-4 pt-4"><p>GPC is intended to serve as an expression of users’ intent to invoke their online privacy rights. Depending on the jurisdiction and applicable laws, a user’s expression through GPC may have legal impact. However, GPC on its own does not create any legally binding obligations.</p> <p>GPC may impact existing law in several ways: In California, Section 1798.135(c) of the <a href="http://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?division=3.&part=4.&lawCode=CIV&title=1.81.5">California Consumer Privacy Act (CCPA)</a> gives users the right to opt out of the sale of their personal information.</p> <p>Furthermore, Section 999.315 of the <a href="https://oag.ca.gov/privacy/ccpa/regs">CCPA Regulations</a> requires businesses to honor these opt-out requests. The regulations specify that "[a] business shall provide two or more designated methods for submitting requests to opt-out […] [including] user-enabled global privacy controls, such as a browser plug-in or privacy setting, device setting, or other mechanism, that communicate or signal the consumer’s choice to opt-out of the sale of their personal information. […] User-enabled global privacy controls, such as a browser plug-in or privacy setting, device setting, or other mechanism, that communicate or signal the consumer’s choice to opt-out of the sale of their personal information shall be considered a request directly from the consumer, not through an authorized agent."</p> <p>On this basis, it is possible that the GPC may become a legally binding opt-out signal in California.</p> <p>In addition, the <a href="https://gdpr-info.eu/">European General Data Protection Regulation (GDPR)</a> gives users the right to object to their personal data being processed. The GPC signal is intended to convey a general request that data controllers limit the sale or sharing of the user's personal data to other data controllers. It is possible that a GPC signal opting out of processing could create a legally binding obligation for data processors.</p> <p>In Bermuda, the Privacy Commissioner has <a href="https://www.privacy.bm/post/global-privacy-control-interoperability-in-action">indicated</a> that he believes the GPC may be used to create a legally binding obligation on businesses under their laws, which provide users the right to “request an organisation to cease, or not begin, using his [or her] personal information […] for the purposes of advertising, marketing or public relations,” or “where the use of that personal information is causing or is likely to cause substantial damage or substantial distress to the individual or to another individual.”</p> <p>Additional information is available in the <a href="https://privacycg.github.io/gpc-spec/">proposed specification</a>.</p> </div></div></section></div><div property="mainEntity" typeof="Question"><section id="DND" class="mt-2"><header class="faq-list_header__YQn_V" property="name"><a class="px-4" href="#DND"><h2>Why not just use Do Not Track (DNT)?</h2><svg width="1em" height="1em" viewBox="0 0 16 16" fill="currentColor" xmlns="http://www.w3.org/2000/svg"><path d="M12.14 8.753l-5.482 4.796c-.646.566-1.658.106-1.658-.753V3.204a1 1 0 0 1 1.659-.753l5.48 4.796a1 1 0 0 1 0 1.506z"></path></svg></a></header><div class="collapse_collapse__qcl8O" style="height:0px" property="acceptedAnswer" typeof="Answer"><div property="text" class="faq-list_content__Lo4rF px-4 pt-4"><p>Do Not Track was an effort preceding GPC to permit users to communicate their privacy preferences to websites they visit. Unfortunately, in the appendices to their Final Statement of Reasons, the California Attorney General (AG) determined that the AG could not require businesses to comply with DNT requests because the requests do not clearly convey users’ intent to opt out of the sale of their data. A more detailed discussion of the inadequacies of DNT is available as <a href="https://oag.ca.gov/privacy/ccpa/regs">Appendix E</a> of the AG’s Final Statement of Reasons.</p> <p>When considering whether DNT was sufficient under the CCPA, the AG specifically determined that a new type of privacy signal would benefit users and businesses and that its regulation is “intended to support innovation for privacy services that facilitate the exercise of consumer rights in furtherance of the CCPA.”</p> <p>GPC responds to this call for innovation by providing a mechanism for privacy signaling that is applicable to current laws, technologies, and business practices. The Attorney General has said that he believes GPC is “a technical standard that would make it easier for consumers to stop the sale of their personal information” and that he is “<a href="https://twitter.com/AGBecerra/status/1313884769478828032?s=20">heartened</a> to see a wave of innovation in this space.”</p> </div></div></section></div><div property="mainEntity" typeof="Question"><section id="ExistingDNS" class="mt-2"><header class="faq-list_header__YQn_V" property="name"><a class="px-4" href="#ExistingDNS"><h2>How does GPC interact with companies' existing Do Not Sell links?</h2><svg width="1em" height="1em" viewBox="0 0 16 16" fill="currentColor" xmlns="http://www.w3.org/2000/svg"><path d="M12.14 8.753l-5.482 4.796c-.646.566-1.658.106-1.658-.753V3.204a1 1 0 0 1 1.659-.753l5.48 4.796a1 1 0 0 1 0 1.506z"></path></svg></a></header><div class="collapse_collapse__qcl8O" style="height:0px" property="acceptedAnswer" typeof="Answer"><div property="text" class="faq-list_content__Lo4rF px-4 pt-4"><p>The California AG has determined that businesses must honor two methods of submitting opt-outs. GPC is meant to provide users with an additional option for objecting to the sale of their data, and it functions identically to clicking a “Do Not Sell My Personal Information” link provided by a business.</p> </div></div></section></div><div property="mainEntity" typeof="Question"><section id="Conflict" class="mt-2"><header class="faq-list_header__YQn_V" property="name"><a class="px-4" href="#Conflict"><h2>What if there is a conflict between a GPC signal and a user-selected privacy preference?</h2><svg width="1em" height="1em" viewBox="0 0 16 16" fill="currentColor" xmlns="http://www.w3.org/2000/svg"><path d="M12.14 8.753l-5.482 4.796c-.646.566-1.658.106-1.658-.753V3.204a1 1 0 0 1 1.659-.753l5.48 4.796a1 1 0 0 1 0 1.506z"></path></svg></a></header><div class="collapse_collapse__qcl8O" style="height:0px" property="acceptedAnswer" typeof="Answer"><div property="text" class="faq-list_content__Lo4rF px-4 pt-4"><p>Some jurisdictions allow businesses to sell user data when there is a conflict between global and site-specific preferences — for instance, if a user has provided specific permission to a website to sell their data. The <a href="https://privacycg.github.io/gpc-spec/#bib-ccpa-regulations">CCPA Regulations</a> §999.315(c)(2) state that when a GPC signal conflicts with the existing privacy settings a consumer has with the business, the business shall respect the GPC signal but may notify the consumer of the conflict and give the consumer an opportunity to confirm the business-specific privacy setting or participation in a financial incentive program.</p> <p>A conflict between GPC and site-specific privacy preferences may be resolved differently in other jurisdictions.</p> <p>Additionally, some implementations of GPC allow users to consent to the sale or sharing of their data on an individual basis.</p> </div></div></section></div><div property="mainEntity" typeof="Question"><section id="Default" class="mt-2"><header class="faq-list_header__YQn_V" property="name"><a class="px-4" href="#Default"><h2>Can GPC be enabled by default?</h2><svg width="1em" height="1em" viewBox="0 0 16 16" fill="currentColor" xmlns="http://www.w3.org/2000/svg"><path d="M12.14 8.753l-5.482 4.796c-.646.566-1.658.106-1.658-.753V3.204a1 1 0 0 1 1.659-.753l5.48 4.796a1 1 0 0 1 0 1.506z"></path></svg></a></header><div class="collapse_collapse__qcl8O" style="height:0px" property="acceptedAnswer" typeof="Answer"><div property="text" class="faq-list_content__Lo4rF px-4 pt-4"><p>The GPC preference expression should accurately reflect the users’ privacy preferences. The threshold for obtaining user consent differs between jurisdictions. GPC strives to honor those differences while still providing users with choice about how businesses use their data. In some jurisdictions, the presence of GPC in a user’s browser may constitute an adequate signal to not sell their data, while regulations in another jurisdiction may require the user’s explicit consent in order to send a GPC signal.</p> <p>What constitutes a deliberate choice may differ between regional regulations. For example, regulations in one jurisdiction may consider the use of a privacy-focused browser to imply a GPC preference, such as under the CCPA <a href="https://oag.ca.gov/sites/all/files/agweb/pdfs/privacy/ccpa-fsor-appendix-e.pdf">Final Statement of Reasons - Appendix E #73</a> ("<em>The consumer exercises their choice by affirmatively choosing the privacy control […] including when utilizing privacy-by-design products or services</em>"), while regulations in another jurisdiction may require explicit consent from the user to send a GPC signal.</p> </div></div></section></div></div></div></div></div></div></article></main><section id="contact" class="layout_contact__8hGrR text-center"><div class="container"><div class="row justify-content-center"><div class="col-12 col-lg-6"><h1>Get Involved</h1><p>Contact us to learn more about supporting <abbr title="Global Privacy Control">GPC</abbr> in your browser, app, or website.</p><p><a href="https://twitter.com/globalprivctrl" target="_blank" rel="noopener noreferrer">@globalprivctrl</a></p></div></div></div></section><footer class="layout_footer__agPsP"><div class="container"><div class="row text-center"><div class="col"><p class="mb-0">This site is hosted by <a href="https://github.com">GitHub</a> and is subject to its <a href="https://docs.github.com/en/free-pro-team@latest/github/site-policy/github-privacy-statement">Privacy Policy</a> and <a href="https://docs.github.com/en/free-pro-team@latest/github/site-policy/github-terms-of-service">Terms of Service</a>.</p><p class="mb-0">Content on this site is licensed under a Creative Commons Attribution 4.0 International license. This license does not apply to any logos or marks on this site.</p></div></div></div></footer></div></div><script id="__NEXT_DATA__" type="application/json" crossorigin="anonymous">{"props":{"pageProps":{"data":{"title":"Frequently Asked Questions"},"html":"","sections":[{"key":"WhatIsGPC","data":{"title":"What is the Global Privacy Control (GPC)?"},"html":"\u003cp\u003eGlobal Privacy Control (GPC) is a proposed specification designed to allow\nInternet users to notify businesses of their privacy preferences, such as\nwhether or not they want their personal information to be sold or shared. It\nconsists of a setting or extension in the user’s browser or mobile device and\nacts as a mechanism that websites can use to indicate they support the\nspecification.\u003c/p\u003e\n"},{"key":"WhoIsGPC","data":{"title":"Who is supporting the development of GPC?"},"html":"\u003cp\u003eGPC is being developed by a broad coalition of stakeholders:\ntechnologists, web publishers, technology companies,\nbrowser vendors, extension developers, academics, and\ncivil rights organizations.\u003c/p\u003e\n\u003cp\u003eThe GPC was initially spearheaded by \u003ca href=\"https://twitter.com/ashk4n\"\u003eAshkan\nSoltani\u003c/a\u003e \u003ca href=\"https://www.georgetowntech.org/\"\u003eGeorgetown\nLaw\u003c/a\u003e and \u003ca href=\"https://twitter.com/SZimmeck\"\u003eSebastian\nZimmeck\u003c/a\u003e (\u003ca href=\"https://www.wesleyan.edu/\"\u003eWesleyan\nUniversity\u003c/a\u003e) in collaboration with \u003ca href=\"https://www.nytimes.com\"\u003eThe New York\nTimes\u003c/a\u003e, \u003ca href=\"https://www.washingtonpost.com/\"\u003eThe Washington\nPost\u003c/a\u003e, \u003ca href=\"https://www.ft.com/\"\u003eFinancial Times\u003c/a\u003e,\n\u003ca href=\"https://automattic.com/\"\u003eAutomattic (Wordpress.com \u0026#x26; Tumblr)\u003c/a\u003e,\n\u003ca href=\"https://glitch.com/\"\u003eGlitch\u003c/a\u003e,\n\u003ca href=\"https://spreadprivacy.com/announcing-global-privacy-control/\"\u003eDuckDuckGo\u003c/a\u003e,\n\u003ca href=\"https://brave.com/global-privacy-control/\"\u003eBrave\u003c/a\u003e,\n\u003ca href=\"https://www.mozilla.org/en-US/\"\u003eMozilla\u003c/a\u003e, \u003ca href=\"https://disconnect.me/\"\u003eDisconnect\u003c/a\u003e,\n\u003ca href=\"https://joindeleteme.com/blog/how-to-enable-global-privacy-control/\"\u003eAbine\u003c/a\u003e,\n\u003ca href=\"https://digitalcontentnext.org/\"\u003eDigital Content Next (DCN)\u003c/a\u003e, \u003ca href=\"https://advocacy.consumerreports.org/issue/tech-privacy/\"\u003eConsumer\nReports\u003c/a\u003e, and the\n\u003ca href=\"https://www.eff.org/\"\u003eElectronic Frontier Foundation (EFF)\u003c/a\u003e.\u003c/p\u003e\n"},{"key":"HowToSignal","data":{"title":"I’m a web user. How can I use GPC to signal my privacy preferences to websites?"},"html":"\u003cp\u003eGPC is available for an increasing number of browsers and browser extensions,\nlisted \u003ca href=\"https://globalprivacycontrol.org/#download\"\u003ehere\u003c/a\u003e. If you want to use\nGPC, you can download and enable it via a participating browser or browser\nextension. More information about downloading GPC is available\n\u003ca href=\"https://globalprivacycontrol.org/\"\u003ehere\u003c/a\u003e.\u003c/p\u003e\n"},{"key":"Publisher","data":{"title":"I’m a publisher, developer, or other service. How can I support GPC?"},"html":"\u003cp\u003eThe GPC spec is easy to implement on a wide variety of websites and other\nservices. The proposed specification and back-end implementation reference\ndocumentation are available \u003ca href=\"https://global-privacy-control.glitch.me/\"\u003ehere\u003c/a\u003e.\nFor additional information, please feel free to reach out on Github or Twitter\n(\u003ca href=\"https://twitter.com/globalprivctrl\"\u003e@globablprivctrl\u003c/a\u003e).\u003c/p\u003e\n"},{"key":"Policymaker","data":{"title":"I’m a policymaker. How can I support GPC or learn more about how it could apply in my jurisdiction?"},"html":"\u003cp\u003eAs it is intended to invoke users’ privacy rights, we encourage policymakers\nfrom around the world to engage in the development of this specification. If you\nwould like to learn more about how GPC could work in your jurisdiction, please\ncontact us via email at\n\u003ca href=\"mailto:info%5Bat%5Dglobalprivacycontrol.org\"\u003einfo[at]globalprivacycontrol.org\u003c/a\u003e.\u003c/p\u003e\n"},{"key":"GetInvolved","data":{"title":"How can I get involved in developing the proposed specification?"},"html":"\u003cp\u003eGPC was initially introduced at the World Wide Web Consortium (W3C) \u003ca href=\"https://privacycg.github.io/\"\u003ePrivacy\nCommunity Group\u003c/a\u003e (Privacy CG) in April 2020. A\nnumber of stakeholders are part of that community. There are ongoing\ndiscussions in the Privacy CG. Interested parties are encouraged to engage with\nthe proposal \u003ca href=\"https://github.com/privacycg/proposals/issues/10/\"\u003ehere\u003c/a\u003e.\u003c/p\u003e\n\u003cp\u003eAdditionally, GPC is currently being implemented across the web. A number of\nbrowsers, extensions, and publishers are supporting or implementing GPC (see\nbelow).\u003c/p\u003e\n"},{"key":"Benefit","data":{"title":"How does GPC benefit consumers, publishers, software makers, and advertisers?"},"html":"\u003cp\u003eThe online advertising ecosystem is evolving, and consumer expectations are\nchanging. An increasing number of web users do not want to be tracked by parties\nthey aren’t choosing to interact with, and new laws, technological changes, and\nadvertising business models reflect these preferences.\u003c/p\u003e\n\u003cp\u003eGPC provides consumers and businesses with clear expectations and guidelines for\nthe sharing and sale of data online. It permits users to easily and clearly\nexercise their privacy rights, facilitates greater trust between businesses and\ntheir customers, and fosters certainty for businesses and advertisers by relying\non an open standard.\u003c/p\u003e\n"},{"key":"IsItBinding","data":{"title":"Is GPC legally binding?"},"html":"\u003cp\u003eGPC is intended to serve as an expression of users’ intent to\ninvoke their online privacy rights. Depending on the jurisdiction\nand applicable laws, a user’s expression through GPC may have\nlegal impact. However, GPC on its own does not create any\nlegally binding obligations.\u003c/p\u003e\n\u003cp\u003eGPC may impact existing law in several ways: In California, Section 1798.135(c)\nof the \u003ca href=\"http://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?division=3.\u0026#x26;part=4.\u0026#x26;lawCode=CIV\u0026#x26;title=1.81.5\"\u003eCalifornia Consumer Privacy Act\n(CCPA)\u003c/a\u003e\ngives users the right to opt out of the sale of their personal information.\u003c/p\u003e\n\u003cp\u003eFurthermore, Section 999.315 of the \u003ca href=\"https://oag.ca.gov/privacy/ccpa/regs\"\u003eCCPA\nRegulations\u003c/a\u003e requires businesses to honor\nthese opt-out requests. The regulations specify that \"[a] business shall provide\ntwo or more designated methods for submitting requests to opt-out […]\n[including] user-enabled global privacy controls, such as a browser plug-in or\nprivacy setting, device setting, or other mechanism, that communicate or signal\nthe consumer’s choice to opt-out of the sale of their personal information. […]\nUser-enabled global privacy controls, such as a browser plug-in or privacy\nsetting, device setting, or other mechanism, that communicate or signal the\nconsumer’s choice to opt-out of the sale of their personal information shall be\nconsidered a request directly from the consumer, not through an authorized\nagent.\"\u003c/p\u003e\n\u003cp\u003eOn this basis, it is possible that the GPC may become a legally binding opt-out\nsignal in California.\u003c/p\u003e\n\u003cp\u003eIn addition, the \u003ca href=\"https://gdpr-info.eu/\"\u003eEuropean General Data Protection Regulation\n(GDPR)\u003c/a\u003e gives users the right to object to their personal\ndata being processed. The GPC signal is intended to convey a general request\nthat data controllers limit the sale or sharing of the user's personal data to\nother data controllers. It is possible that a GPC signal opting out of\nprocessing could create a legally binding obligation for data processors.\u003c/p\u003e\n\u003cp\u003eIn Bermuda, the Privacy Commissioner has\n\u003ca href=\"https://www.privacy.bm/post/global-privacy-control-interoperability-in-action\"\u003eindicated\u003c/a\u003e\nthat he believes the GPC may be used to create a legally binding obligation on\nbusinesses under their laws, which provide users the right to “request an\norganisation to cease, or not begin, using his [or her] personal information\n[…] for the purposes of advertising, marketing or public relations,” or\n“where the use of that personal information is causing or is likely to cause\nsubstantial damage or substantial distress to the individual or to another\nindividual.”\u003c/p\u003e\n\u003cp\u003eAdditional information is available in the \u003ca href=\"https://privacycg.github.io/gpc-spec/\"\u003eproposed\nspecification\u003c/a\u003e.\u003c/p\u003e\n"},{"key":"DND","data":{"title":"Why not just use Do Not Track (DNT)?"},"html":"\u003cp\u003eDo Not Track was an effort preceding GPC to permit users to communicate their\nprivacy preferences to websites they visit. Unfortunately, in the appendices to\ntheir Final Statement of Reasons, the California Attorney General (AG)\ndetermined that the AG could not require businesses to comply with DNT requests\nbecause the requests do not clearly convey users’ intent to opt out of the sale\nof their data. A more detailed discussion of the inadequacies of DNT is\navailable as \u003ca href=\"https://oag.ca.gov/privacy/ccpa/regs\"\u003eAppendix E\u003c/a\u003e of\nthe AG’s Final Statement of Reasons.\u003c/p\u003e\n\u003cp\u003eWhen considering whether DNT was sufficient under the CCPA, the AG specifically\ndetermined that a new type of privacy signal would benefit users and businesses\nand that its regulation is “intended to support innovation for privacy services\nthat facilitate the exercise of consumer rights in furtherance of the CCPA.”\u003c/p\u003e\n\u003cp\u003eGPC responds to this call for innovation by providing a mechanism for privacy\nsignaling that is applicable to current laws, technologies, and business\npractices. The Attorney General has said that he believes GPC is “a technical\nstandard that would make it easier for consumers to stop the sale of their\npersonal information” and that he is\n“\u003ca href=\"https://twitter.com/AGBecerra/status/1313884769478828032?s=20\"\u003eheartened\u003c/a\u003e to\nsee a wave of innovation in this space.”\u003c/p\u003e\n"},{"key":"ExistingDNS","data":{"title":"How does GPC interact with companies' existing Do Not Sell links?"},"html":"\u003cp\u003eThe California AG has determined that businesses must honor two methods of\nsubmitting opt-outs. GPC is meant to provide users with an additional option\nfor objecting to the sale of their data, and it functions identically to\nclicking a “Do Not Sell My Personal Information” link provided by a business.\u003c/p\u003e\n"},{"key":"Conflict","data":{"title":"What if there is a conflict between a GPC signal and a user-selected privacy preference?"},"html":"\u003cp\u003eSome jurisdictions allow businesses to sell user data when there is a conflict\nbetween global and site-specific preferences — for instance, if a user has\nprovided specific permission to a website to sell their data. The \u003ca href=\"https://privacycg.github.io/gpc-spec/#bib-ccpa-regulations\"\u003eCCPA\nRegulations\u003c/a\u003e\n§999.315(c)(2) state that when a GPC signal conflicts with the existing privacy\nsettings a consumer has with the business, the business shall respect the GPC\nsignal but may notify the consumer of the conflict and give the consumer an\nopportunity to confirm the business-specific privacy setting or participation in\na financial incentive program.\u003c/p\u003e\n\u003cp\u003eA conflict between GPC and site-specific privacy preferences may be resolved\ndifferently in other jurisdictions.\u003c/p\u003e\n\u003cp\u003eAdditionally, some implementations of GPC allow users to consent to the sale or\nsharing of their data on an individual basis.\u003c/p\u003e\n"},{"key":"Default","data":{"title":"Can GPC be enabled by default?"},"html":"\u003cp\u003eThe GPC preference expression should accurately reflect the users’ privacy\npreferences. The threshold for obtaining user consent differs between\njurisdictions. GPC strives to honor those differences while still providing\nusers with choice about how businesses use their data. In some jurisdictions,\nthe presence of GPC in a user’s browser may constitute an adequate signal to not\nsell their data, while regulations in another jurisdiction may require the\nuser’s explicit consent in order to send a GPC signal.\u003c/p\u003e\n\u003cp\u003eWhat constitutes a deliberate choice may differ between regional\nregulations. For example, regulations in one jurisdiction may consider the use\nof a privacy-focused browser to imply a GPC preference, such as under the CCPA\n\u003ca href=\"https://oag.ca.gov/sites/all/files/agweb/pdfs/privacy/ccpa-fsor-appendix-e.pdf\"\u003eFinal Statement of Reasons - Appendix E\n#73\u003c/a\u003e\n(\"\u003cem\u003eThe consumer exercises their choice by affirmatively choosing the privacy\ncontrol […] including when utilizing privacy-by-design products or\nservices\u003c/em\u003e\"), while regulations in another jurisdiction may require explicit\nconsent from the user to send a GPC signal.\u003c/p\u003e\n"}]},"__N_SSG":true},"page":"/faq","query":{},"buildId":"mrN_tD8pj6JtI-9KzqZN1","isFallback":false,"gsp":true,"scriptLoader":[]}</script></body></html>