Enabling GPC and Understanding the Settings
Enabling GPC and Understanding the Settings
Global Privacy Control (GPC) is a browser signal that visitors use to tell every website they visit: "Do not sell or share my data." As of January 2026, ignoring the GPC signal is an actively-enforced violation in 11 US states. This guide explains what GPC does, how to turn it on in Cookie Compliance, and what each setting means.
If you only need the steps, jump to How to enable GPC below.
What GPC actually is
GPC is a single header (Sec-GPC: 1 ) and a corresponding JavaScript property that browsers send on every request when the user has the signal enabled. It's built into Firefox, Brave, and DuckDuckGo and can be added to other browsers as an extension. Roughly 150 million people use a GPC-enabled browser today.
Under California's CPRA and equivalent laws in 10 other US states, when a visitor's browser sends the GPC signal, the site must treat that visitor as having opted out of the sale or sharing of their personal information for advertising and personalization purposes. The visitor does not need to interact with your banner. The signal alone is legally sufficient.
When you must honor GPC
You're legally required to honor GPC if your site is accessed by residents of any of these US states:
California, Colorado, Connecticut, Texas, Oregon, Montana, Virginia, Utah, Delaware, Iowa, New Hampshire.
Your business does not need to be based in the US. Any US visitor triggers the obligation. If you can't geofence reliably (and most sites can't), the safest posture is to honor GPC for every visitor.
In the EU, GPC is not yet a statutory requirement but it is increasingly recognized as a valid expression of the GDPR Article 21 right to object. The W3C formalized GPC as a standard in November 2024, and the EU Digital Omnibus is exploring mandatory browser-level signals. Honoring GPC now is consistent with where the regulation is moving.
How GPC fits with Purpose Categories and Access Levels
GPC is not a geofence and not consent by itself — it is a preference signal that acts before any interaction and narrows what is allowed by default:
- Purpose Categories — GPC pushes Ad Personalization (and any categories you associate with sale/sharing or cross-site tracking) to off by default. Basic Operations stay on; Site Optimization and Content Personalization follow your policy posture.
- Access Levels — the visitor can still choose Private, Balanced, or Personalized. With GPC present, Private and Balanced behave as usual; Personalized remains available but runs only if the visitor explicitly accepts it.
In short: GPC sets the guardrails, and the visitor's selection makes the final call within those guardrails. It does not change your category mapping or silently accept or reject on the visitor's behalf.
How to enable GPC
- Sign in at app.hu-manity.co.
- Open Configuration → Consent.
- Find the Global Privacy Control section.
- Toggle GPC Support to On.
- Pick a notification mode (explained below).
- Click Save Changes.
That's the entire setup. There is no separate snippet to install, no DNS change, and no need to modify your site code. Changes propagate to your live banner within a few seconds.
For WordPress sites: the same setting is also reachable from your WordPress admin under Compliance → Protection → Consent Modes → Browser Signals → GPC Support. The web application and the WordPress plugin write to the same setting, so you only need to change it in one place.
Notification modes — what each one does
When a visitor with GPC enabled arrives at your site, Cookie Compliance honors their opt-out automatically. The notification mode controls what they see on screen.
Passive notice (recommended)
A small, auto-dismissing confirmation appears briefly to tell the visitor that their GPC signal was received and honored. The visitor doesn't have to click anything. This is the most common choice because it satisfies the CPRA requirement to "acknowledge" the signal without disrupting the visit.
Silent
No on-screen indicator. Cookie Compliance still honors the signal in the background and records the opt-out in your consent logs, but the visitor sees nothing. Choose this if you've already disclosed GPC handling elsewhere on the page (for example, a static "We honor GPC" note in your privacy policy or footer) and you want the smoothest possible user experience.
Full banner
The standard consent banner still appears, with GPC reflected in the default state (sale and sharing purposes are pre-set to off and the visitor can still adjust their other choices). Choose this if your design system or legal counsel prefers the visitor to actively confirm or override the GPC-driven defaults.
What happens behind the scenes
When GPC is enabled and a visitor's browser sends the signal, Cookie Compliance:
- Detects the
Sec-GPC: 1header or the equivalent JavaScript property before any tags fire. - Sets sale-related and sharing-related purposes (typically Ad Personalization) to off as the visitor's starting state.
- Displays the notification mode you selected.
- Writes an entry to Consent Logs with the source marked as
GPCso you have a record of the automatic opt-out for audit purposes. - Updates Google Consent Mode, Meta Consent Mode, and Microsoft Consent Mode (if enabled) so platform tags respect the opt-out without custom code.
The visitor retains the ability to manually opt back in to specific purposes via the Preferences or Revoke Consent controls.
Fines for ignoring GPC
The California Privacy Protection Agency (CPPA) began actively enforcing GPC violations in January 2026. Penalties under the CPRA:
- $2,500 per affected consumer for unintentional violations
- $7,500 per affected consumer for intentional violations (including ignoring GPC after you've been made aware of it)
The 30-day cure period that previously allowed sites to fix violations before being fined was eliminated in July 2023. Regulators can issue fines on the first incident.
Other states have similar structures. Colorado, for example, caps civil penalties at $20,000 per violation. The same site can be exposed to multiple state-level actions for the same underlying conduct.
Frequently asked questions
Will turning on GPC reduce my advertising revenue?
It can, but only for visitors who have explicitly enabled GPC in their browser — which is a self-selected privacy-conscious segment. For everyone else, your banner and consent flow work exactly as before. Most sites see a single-digit percentage of GPC-enabled visitors. The trade-off is fines versus a small ad-revenue impact.
Does GPC override my banner?
GPC overrides the default state for sale and sharing purposes. The banner still appears (unless you've chosen Silent mode), and the visitor can still adjust their preferences. They can even opt back in to the purposes that GPC opted them out of — but the choice has to be explicit and active.
I'm a Pro customer who had GPC enabled before. Will I be grandfathered if I disable it?
If your account already had GPC enabled, you keep access to the feature even on the free tier. However, if you disable GPC and later try to re-enable it on a free plan, you'll need to upgrade to Pro. We recommend leaving it on.
How do I verify GPC is working?
Open your site in Firefox and check that GPC is enabled (about:config → privacy.globalPrivacyControl.enabled = true ). Or use Brave, which has GPC on by default. Reload the site. In your application's Compliance Behavior panel and your Consent Logs, you should see GPC reflected. No third-party "GPC checker" tool is officially recognized — these are the reliable verification methods.
My site is not in the US. Do I have to enable GPC?
If any visitors from the 11 enforcing US states reach your site, yes. The obligation attaches to the visitor, not to where you're hosted or incorporated. The safest posture is to enable GPC for all visitors.
Does GPC apply to logged-in users differently?
GPC applies to all visitors equally, signed in or not. If you have a logged-in user who has previously consented to specific data uses, that consent stands until they actively change it or until they send a GPC signal in a subsequent session.