Global Privacy Control is coming to Chrome. In Chrome 157, eligible users can turn on a setting that makes Chrome send a Sec-GPC: 1 header with their requests and set navigator.globalPrivacyControl to true. Firefox, Brave and DuckDuckGo already support the signal.
This post explains what the signal is, how Chrome is rolling it out, and how to detect it on the server and in the browser. It also covers how to hand it to a consent banner or tag manager, and how to test it.
The short version: the signal is one request header and one JavaScript property. Your site can read either one with a few lines of code. Chrome’s own entry says only "eligible users" get the setting, and the rollout ramps up over time, so do not expect every Chrome visitor to send it on day one. Add detection now, log how often you see it, and decide with your client what their tags should do when it is present.
Where Chrome 157 stands
Chrome’s Chrome 157 release notes on Chrome Platform Status read "Scheduled Stable Release November 3, 2026." The page was still marked "Preview" when we checked on November 2.
As of November 2, Chrome’s release schedule lists November 3, 2026 as the Chrome 157 stable date. It lists early stable on October 21 and the first stable refresh on November 10. Our post on Chrome’s two-week release cycle explains how the new cadence affects QA.
The release note says eligible users can enable a setting that sends the header and sets the property. It points users and IT admins to Chrome’s Help Center for details, without a link. We could not find that Help Center article on November 2.
How Chrome is rolling out Global Privacy Control
The feature’s Chrome Platform Status entry is titled "Global Privacy Control in Chrome." It says that starting in Chrome 157, eligible users will have a new privacy setting to send an opt-out request to websites about the use of their data.
The entry adds a few details as of November 2:
- Platforms: desktop, Android and iOS, all from version 157.
- Rollout plan: listed as one where experiment users ramp up over time.
- Who decides eligibility: not stated. The entry does not define “eligible.”
- Reviews: security and privacy review both show “Pending.”
The practical point: Chrome traffic with the header will start small and grow. Your logs will show the trend better than any announcement.
How the Global Privacy Control signal works
The signal is defined in the W3C Global Privacy Control specification. The GPC project site says it became a work item of the W3C Privacy Working Group in November 2024. The spec describes it as a person’s request that sites not sell or share their personal information with third parties.
The spec sets these rules:
- One header, one value. When the setting is on, the browser sends `Sec-GPC` with a value of exactly `1`.
- No header when off. The browser must not send `Sec-GPC` at all when the setting is off. There is no `Sec-GPC: 0`.
- Ignore other values. A server must treat any value other than `1` as if the header were missing.
- Set per page load. The value is fixed when a top-level page starts loading. If the user changes the setting, it applies on the next navigation.
- A JavaScript twin. `navigator.globalPrivacyControl` is a read-only boolean on `Navigator` and `WorkerNavigator`. It is `false` if no header would be sent.
Because the name starts with Sec-, MDN’s Sec-GPC reference lists it as a forbidden request header. Page scripts cannot set or fake it. Only the browser adds it.
On legal context, the spec notes that at least four U.S. states have identified GPC as a valid way to exercise opt-out rights.
Which browsers send Global Privacy Control
The GPC project site lists Brave and DuckDuckGo as on by default and Firefox as available in settings. Mozilla’s Firefox 120 release notes, dated November 21, 2023, added the setting under Privacy & Security.
| Browser | GPC support | Source |
|---|---|---|
| Chrome | Setting for eligible users from version 157, rolling out over time | Chrome Platform Status |
| Firefox | Setting under Privacy & Security since version 120 | Mozilla release notes |
| Brave | On by default | GPC project site |
| DuckDuckGo | On by default | GPC project site |
MDN marks the header as not Baseline, meaning it does not work in some widely used browsers. Safari is not on the GPC project’s list. Our post on browser engines in 2026 covers which engines sit under which browsers.
How to detect the signal on the server
On the server, read the request header and check for the exact value 1. In PHP, request headers appear in $_SERVER with an HTTP_ prefix, dashes turned into underscores.
$gpc = isset($_SERVER['HTTP_SEC_GPC']) && $_SERVER['HTTP_SEC_GPC'] === '1';The same check works in any stack. Look for the Sec-GPC header and compare it to the string 1.
To test from the command line, send the header yourself:
curl -s -o /dev/null -D - -H "Sec-GPC: 1" https://example.org/Watch your cache. If the server changes the page based on the header, send Vary: Sec-GPC in the response. MDN’s Vary reference says this keeps responses cached separately for each header value. Without it, a CDN or page cache can serve one visitor’s version to everyone.
The spec also warns that the header rides on every request a page makes. Do any heavy work once per visit and keep the per-request check cheap.
How to detect Global Privacy Control in JavaScript
In the browser, read the property. Browsers that do not support the signal leave it undefined, so compare to true.
const gpc = navigator.globalPrivacyControl === true;Put it in a small inline script in your WordPress or Drupal theme. Run it before any analytics or ad tags load.
How to pass the signal to tags and consent tools
What your site does with the signal is a decision for the client. The code below only shows how to hand the value to your tag setup.
Google consent mode. Google’s consent mode guide says the default consent call must run before any command that sends measurement data. If the client decides GPC should deny ad storage and ad data, set that in the default call:
if (navigator.globalPrivacyControl === true) {
gtag('consent', 'default', {
'ad_storage': 'denied',
'ad_user_data': 'denied',
'ad_personalization': 'denied'
});
}Our Google Consent Mode v2 guide explains how consent mode works.
Tag managers. Push the value into the data layer so triggers can read it:
window.dataLayer = window.dataLayer || [];
window.dataLayer.push({ gpc: navigator.globalPrivacyControl === true });Consent platforms. Many consent tools have their own GPC switch. Check your vendor’s settings before writing custom code, so the two do not conflict.
Say what you support. The spec defines an optional file at /.well-known/gpc.json with a gpc value of true or false and a lastUpdate date. The spec says it shows the site’s awareness of GPC. It does not confirm that a given request was honored.
How to test Global Privacy Control
Use a mix of real browsers and scripted checks.
- Firefox: turn on the setting under Privacy & Security, then load your site.
- Brave or DuckDuckGo: both send the signal by default, per the GPC project.
- Chrome 157: check for the setting once the rollout reaches your profile. Chrome has not published where it lives in a page we could find.
- DevTools: open the Network panel and look for `Sec-GPC: 1` under request headers. In the Console, type `navigator.globalPrivacyControl`.
- Server logs: log the header value for a few weeks to see how much traffic sends it.
- Automated tests: the spec defines WebDriver commands to set and read the GPC preference for a test session. Check whether your test driver supports them.
The spec also notes that exposing the signal can add a small amount of fingerprinting data. That is one more reason not to store or share the raw value beyond what you need.
For more on browser changes this quarter, see our Q4 2026 platform calendar.
Frequently Asked Questions
What is Global Privacy Control?
A browser signal, defined in a W3C specification, that tells sites a person does not want their data sold or shared with third parties. It is sent as the `Sec-GPC: 1` header and exposed as `navigator.globalPrivacyControl`.
When does Chrome add Global Privacy Control?
In Chrome 157. As of November 2, 2026, Chrome’s schedule lists November 3, 2026 as the stable date. The setting reaches eligible users and ramps up over time.
Does Chrome turn the signal on by default?
Chrome describes it as a setting eligible users can enable. Its release note does not say it is on by default.
Who counts as an eligible Chrome user?
Chrome has not said. The feature entry uses the word “eligible” without defining it, as of November 2.
Can JavaScript set or remove the Sec-GPC header?
No. MDN lists `Sec-GPC` as a forbidden request header because of its `Sec-` prefix. Only the browser adds it.
What value does the header have when the setting is off?
There is no header at all. The spec says browsers must not send `Sec-GPC` when the setting is off, and the JavaScript property is `false`.
How do I check for the signal in PHP?
Read `$_SERVER[‘HTTP_SEC_GPC’]` and compare it to the string `1`. Treat any other value as no signal.
Do I need to change my page cache?
Only if the server returns different content when the header is present. In that case, send `Vary: Sec-GPC` so caches store the versions separately.
What is the gpc.json file?
An optional file at `/.well-known/gpc.json` where a site states whether it supports GPC, with a `gpc` true or false value and a `lastUpdate` date.
