1:09
Privacy and identity, 2026 edition

Ep 5: GPC: the browser’s opt-out signal

1:09 · November 11, 2026

A Denver reader opted out before your banner even loaded.

Lesson notes

A Denver reader opted out before your banner even loaded.

That’s GPC, Global Privacy Control, a browser signal meaning don’t sell or share my data.

She has GPC switched on in Firefox. Her browser sends a header, sec GPC, set to one, with every request, and pages can read the same flag in JavaScript. She lands on game.example. Before any click, your CMP treats the signal as an opt-out of sale, sharing and targeted ads, and records it in the GPP string, which has a GPC field. Prebid passes that to every bidder. Her visit still sells, just without targeting on her data. California and Colorado require businesses to honour it, as do several other states. From January twenty twenty seven, California also makes every browser offer such a signal.

Today, switch on GPC in a test browser, load your site, and check the GPP string shows the opt-out.

Next… the Privacy Sandbox post mortem.

Go deeper · 3 min readNavigating Privacy Regulations: Compliance Strategies for Ad Tech Companies

Up next in this series