Global Privacy Control is game changer .... if only you knew it was working

General
1

GPC is now a legal requirement for many companies. As recently as January 1, 2026, companies that are required to comply must display an indicator on their site that they honored your GPC request. The problem is that GPC is just a “hand raise” to tell the company to opt you out. But are they? In many cases they say they are, but they aren’t.

This is testable, but it’s laborious and even the most privacy-minded surfers can’t be bothered to fully validate a site is working as they say it is.

I was facing this problem as I operated a large website and was face-to-face with the daily challenges of implementing privacy controls, ensuring they were still working, and displaying accurate information to our users.

There simply wasn’t a way for me to quickly test whether GPC was being honored at scale. So I built my own solution. I scan a site with and without GPC and log all the trackers, categorize them, and see which are still leveraged with GPC enabled. Immediate red flags.

So I have this tool that’s useful to me, but I don’t know what to do with it now. Is this useful for consumers? Businesses? Regulators?

Or does this tool already exist out there already?

1 Like
2

No.

3

Sorry, no what? There isn’t a tool that does this?

4

Using GPC just makes you stand out from the crowd.

5

IMO that’s an oversimplification to the point of being wrong. The GPC is a binary preference (either on or off) neither option inherently makes you stand out more than the other assuming there are sufficiently large buckets of users in both camps.

Which side has the bigger “crowd” will depend on the browser. GPC is currently the default for:

  1. Tor Browser
  2. Mullvad Browser
  3. Brave Browser
  4. Firefox in Private Browsing Mode
  5. Cromite
  6. Librewolf
  7. Duckduckgo Browser
  8. Any browser following Betterfox’s template (e.g. Zen Browser)
  9. Any browser following Phoenix’s template (e.g. Ironfox)

IMO the practical advice for users is: if your primary concern is fingerprinting, leave GPC set to whatever your browser defaults to. But if your primary concern is fingerprinting. you are almost certainly already using one of the browsers that enables GPC by default (because you’ll already be using Tor Browser and/or Mullvad Browser).

3 Likes
6

This sounds interesting and potentially useful, at the very least for research or testing. Is the project on github or codeberg or somewhere?

1 Like
7

I’ve certainly never seen it as a default in Brave myself. And I use all the versions.

8

Brave sets GPC by default: https://support.brave.app/hc/en-us/articles/360017989132-How-do-I-change-my-Privacy-Settings

1 Like
9

No code publicly available, but here’s a screenshot of the report.

sample
sample2880×5834 1.22 MB

10

Apparently, it was changed at some point.

11
3 Likes
12

Let’s switch it on.

13

It is enabled.

I believe it’s been enabled by default since version 1.18 (~2021ish) [release notes]. I know this applies to Desktop and Android, not sure about iOS

14

I must have just turned it off myself and remembered wrong. My bad.

1 Like
15

I have never seen such an indicator. Would you mind sharing an example?

16

I don’t have image upload permissions, but you can go to sephora.com and click Your Privacy Choices in the footer and should see a big red line of text (if you have GPC enabled). Or gmfinancial.com in the footer you’ll see, “GPC Opt-Out Request Honored”.

17

But worth mentioning, all those “we’re honoring your request” indicators just have to be trusted. It’s not a programatic guarantee, but the companies are legally obligated to honor it. Most just aren’t doing it well.

18

I have begun to notice this, I can’t recall where specifically, but in the last few weeks, I’ve begun to occasionally notice GPC notices on sites.

My recollection is I’ve mostly encountered these indicators in the Tor Browser which probably indicates that my (and your) daily-driver browser’s content blocker is blocking the indicators.

edit: I just did some experimenting, and it seems like there are at least a couple variables.

  1. your adblocker might be blocking the indicators
  2. you may not be shown the indicator if you don’t appear to the website to be in California (It’s the California law that required an indicator by 1/1/2026)

I think it is shown universally on nytimes.com and whitepages.com , whereas giants.com is an example of a website that only shows it when it detects you are in California.

19

You can test your browser if it’s enabled by default by visiting the official Global Privacy Control website.

20

I know most people here trust Brave, but whenever I’ve had it installed, they have regularly changed defaults and also my actual settings. It creeped me out, so I stopped using it.