Global Privacy Control (GPC) and GA4: Are You Actually Honoring It?

Global Privacy Control (GPC) is a browser-level signal, enabled in Brave by default and available as an extension or setting in Firefox, Chrome (via extension), and others, that broadcasts “this user does not want their data sold or shared” to every site they visit, automatically, without requiring a click on any individual site’s banner. Several US states now treat a GPC signal as a legally binding opt-out request. Most GA4 implementations don’t check for it at all.

Where GPC actually has legal force

• California (CCPA/CPRA) — the CPPA’s regulations explicitly require businesses to treat a valid GPC signal as a request to opt out of sale/sharing, with no separate confirmation required.
• Colorado (CPA) — as of July 1, 2024, honoring a universal opt-out mechanism like GPC is a hard requirement for in-scope businesses, covered in our Colorado guide.
• Connecticut — recognizes universal opt-out mechanisms similarly to Colorado.
• Texas — the TDPSA requires businesses to accept universal opt-out requests via a mechanism like GPC as of January 1, 2025; see our Texas TDPSA guide.
• Virginia, Montana, Oregon, and others increasingly reference or require universal opt-out recognition as their regulations mature.

If any meaningful share of your traffic comes from these states, and GA4’s Google Signals is running without checking for GPC, you almost certainly have a live compliance gap, not a theoretical one.

How to actually detect GPC

The signal is exposed to JavaScript as a simple property:

const gpcActive = navigator.globalPrivacyControl === true;

That’s the entire detection mechanism, there’s no server round-trip or third-party API needed. The work is in what happens next: gpcActive needs to feed into the same consent-state logic that controls Google Signals and ads-linked GA4 features, ideally by setting Google’s Consent Mode signals (ad_storage, ad_user_data, ad_personalization) to denied automatically when GPC is detected, before any GA4 tag fires, not after.

Where this usually breaks in practice

• The consent banner is checked, GPC is not. A lot of implementations wire up the visible “Do Not Sell” toggle correctly but never added a GPC check at all, leaving GPC-enabled visitors with the default “allowed” state.
• GPC is detected but only logged, not acted on. Some setups record that a GPC signal was seen (for audit purposes) without actually changing the Consent Mode state as a result.
• Timing. If the GPC check runs after GTM has already fired the GA4 tag with default consent state, you’ve sent the ads-linked data before the opt-out took effect. The check needs to run in the consent-initialization step, before tags fire, not as an afterthought.

Testing it yourself

1. Install a Global Privacy Control browser extension, or use Brave, which ships GPC enabled by default.
2. Load your site in an incognito/private window with the extension active.
3. Open dev tools and check navigator.globalPrivacyControl in the console, it should return true.
4. Check the Network tab for GA4 requests: they should fire without ads-linked parameters, or not fire the ads-linked collection call at all, depending on your Consent Mode configuration.
5. Compare against the same test with GPC off, you should see a clear difference in what’s sent.

This guide is educational and not legal advice. Confirm your specific technical implementation with a developer and current legal requirements with a privacy attorney, GPC recognition requirements vary by state and continue to expand.