Global Privacy Control
Global Privacy Control is a specification, published in 2020, that lets a browser or extension send an opt-out signal on the visitor’s behalf. Several US state privacy laws make honouring it mandatory, which gives it legal force without making it a statute. It arrives with the request, before your banner has rendered.
- A browser signal, not a law
- Required by several US states
- Arrives before any click
From €10 a month. No credit card, no per-visitor billing.
What honouring it involves
The obligation comes from the state laws that reference the signal, not from the specification itself.
- Detect the signal on the first request, not after an interaction
- Treat it as a valid opt out of sale and sharing
- Apply it without asking the visitor to confirm
- Do not override it with a later banner interaction
- Record that the request was received and applied
This page explains what the law asks for and what our software does about it. It is not legal advice, and it cannot tell you whether your organisation is compliant, because that depends on everything else you process.
What Consent Studio does about it
Reads it on the first page load
In the regions where you honour it, the signal is applied before any tag would fire and without waiting for a banner interaction, which is the only point at which honouring it is possible. A tool that acts only on clicks has already let the advertising tags run by the time it looks.
- Per region, before any tag fires
- No click required
- Per visitor
Does not ask the visitor to say it twice
A visitor sending GPC has already expressed a preference, so re-prompting them and treating a dismissal as consent would override a request the law requires you to honour. The banner respects the signal rather than competing with it.
- No re-prompting
- Signal wins
- Recorded as a request
Applies it alongside the regional defaults
GPC is an opt-out signal and Europe is an opt-in regime, so it supplements the banner rather than replacing it. One configuration handles both: prior consent for EU visitors, and the signal honoured wherever it arrives.
- By visitor region
- One configuration
- Opt in and opt out
Where GPC goes unhonoured
The tool only listens for clicks
This is the structural failure and it is silent. If a consent tool applies preferences after a banner interaction, it never observes a signal that arrived in the request itself, and the site believes it is honouring opt outs while having seen none of them.
The banner overrides the signal
A visitor sending GPC gets shown a banner, dismisses it, and the dismissal is recorded as acceptance. That inverts a request the law requires you to honour, and it looks like normal behaviour in every log you have.
It is assumed to cover Europe
GPC communicates an opt out, and the EU and UK require opt in before anything non-essential loads. Honouring the signal is correct and it does not remove the need to ask a European visitor first.
Essential
€10/month
For a single site that has to be compliant, and stay that way.
- Unlimited pages and displays
- 200,000 consent actions a month
- The full stack, not a starter tier
Professional
€36/month
For growing teams that run on data, and the agencies serving them.
Try Professional for FreeEnterprise
From €250/month
For a volume, or an obligation, a standard plan cannot answer.
Explore EnterpriseAgencies & Resellers
Buy at a partner rate and resell client sites at your own price.
Discover Partner ProgrammePublic Sector
Government, healthcare and education run on Enterprise.
See Enterprise
Running under rules like these, in more than one country
Other rules that may apply to you
Common questions about GPC
Is Global Privacy Control legally binding?
The specification is not a law, and several US state privacy laws require universal opt-out mechanisms to be honoured, which in practice means GPC. So the obligation is real and it comes from the statutes rather than from the specification. California was first to make it explicit.
How does GPC differ from Do Not Track?
Do Not Track was a request with no legal backing that the industry declined to honour, and browsers eventually removed it. GPC is referenced by binding state law, which is the difference that matters: honouring it is an obligation rather than a courtesy.
Does GPC replace a cookie banner?
No. It is an opt-out signal, and the EU and UK operate an opt-in regime where nothing non-essential may load before the visitor agrees. Honouring GPC and showing a consent banner are both required, in the places each applies.
How do I know if my current tool honours it?
Ask when it applies preferences. If the answer is after a banner interaction, it cannot be honouring a signal that arrived with the request. Testing is straightforward: send a request with the signal set and check whether advertising tags fire before anything is clicked.
Does Consent Studio make us compliant?
No single tool can, and any vendor saying otherwise is selling you something. Consent Studio handles the part a consent platform can handle: asking properly, holding every tag to the answer, keeping the record, and telling you when the site changes. What you process elsewhere is yours.
Where is our consent data stored?
In Amsterdam, on infrastructure owned and operated by Scaleway, a French company. Ownership matters more than location here: Scaleway is independently French rather than a European subsidiary of a US parent, so neither they nor we fall under the US CLOUD Act. Consent Studio itself is built and owned in the Netherlands.
Get Started with the Full Consent Stack
Everything you need in one bundle. Consent Studio provides you with a consent banner, scanner and client-side tag manager that guarantees no data ever gets transferred overseas.
Read the documentation
Our help center walks through every integration, plugin and template step by step, with screenshots. It is written and kept current by the people who build Consent Studio.