Which Browsers Send the GPC Signal, and Why Volume Is Rising

Global Privacy Control started life as something you had to go looking for. That is no longer the shape of it. Ask which browsers send the signal today and you get three different kinds of answer: some send it for every user on every tab with nothing switched on, some ship a setting that has to be found and checked, and some have no native support at all and rely on an extension to supply it.

Those three tiers are more useful than an alphabetical roll call, because the tier tells you something a flat list hides: how deliberate the visitor had to be. Someone on a default-on browser never made a decision about your site, or about GPC at all. Under California's Regulation 7025 that visitor still counts as having opted out of the sale and sharing of their personal information, exactly like the one who hunted through a settings menu. What follows is where each major browser sits, how to confirm your own browser is sending the signal, and why the share of visits carrying it keeps growing.

Three tiers of browser support

Sort browsers by what the user has to do rather than by vendor, and the landscape collapses into three groups.

• Tier one, on by default. The browser sends Sec-GPC: 1 from first launch. The user takes no action and, in many cases, never learns the signal exists.
• Tier two, a toggle in settings. The browser supports GPC natively but ships it switched off. Someone has to open preferences and check a box.
• Tier three, extension required. No native support. The signal arrives only if the user installs an extension that adds it.

The tiers matter to a site owner for one reason: the regulation does not have tiers. A qualifying opt-out preference signal is a qualifying opt-out preference signal whether the visitor chose it, inherited it from a browser default, or picked it up as a side effect of installing a tracker blocker. Your site cannot tell those three apart, and it is not meant to.

On by default: Brave and DuckDuckGo

Brave sends GPC for every user and every tab with no configuration. It was one of the earliest browsers to ship the signal natively, and there is no switch to hunt for because there is no switch: a fresh install is already sending it.

DuckDuckGo covers two surfaces. Its own browser sends the signal from install, and so does its Privacy Essentials extension for Chrome, Firefox, and Edge. That second surface is the interesting one, because it means a Chrome user can end up in tier one without ever having read the words "Global Privacy Control". Neither surface has a separate GPC switch to enable.

This is the tier that quietly does the most work. Every user of a default-on browser is a GPC user, so the population sending the signal is the whole population of the browser rather than the subset of it that goes looking through privacy settings.

A toggle in settings: Firefox

Firefox supports GPC natively and ships it switched off. On desktop, open Settings, choose Privacy & Security from the sidebar, scroll to Website Privacy Preferences, and check the box labelled "Tell websites not to sell or share my data". That box is GPC.

Firefox retired the older Do Not Track setting in version 135 and treats GPC as its supported successor, which is worth knowing if you are looking for a control you remember from an older release and cannot find it. Browser settings menus do change over time, so if the labels above do not match what is on your screen, check your browser's own privacy documentation before concluding the feature has gone.

Extension required: Chrome, Edge, and Safari

None of these three ships a native GPC toggle, so the signal has to come from an extension. Two well known sources: the Electronic Frontier Foundation's Privacy Badger, which sends GPC automatically once installed, and the DuckDuckGo extension described above.

Nothing about the extension route makes the resulting signal weaker or more optional. The header on the request is the same header, and a site receiving it carries the same obligation. The practical difference sits on the testing end rather than the sending end: on a default install of one of these browsers there is no signal at all, so a check run there produces a clean result every time, because the test never ran.

Confirming your browser is actually sending it

Three checks, in increasing order of directness.

1. Visit globalprivacycontrol.org. The page reads the signal your browser sent and tells you whether it found one. Fastest confirmation available, and it needs no tooling.
2. Read the request in DevTools. Open the Network panel, load any page, select the document request, and look for Sec-GPC: 1 among the request headers. If it is absent, the browser is not sending it and nothing downstream of that is a valid test.
3. Ask the page directly. In the JavaScript console, evaluate navigator.globalPrivacyControl. A browser sending the signal returns true; one that is not returns undefined or false.

Then the correction that makes this section worth the trouble: all three confirm your browser's behaviour, and none of them confirm the site's. A green result on globalprivacycontrol.org plus a visible header in DevTools proves the request left correctly and arrived. Whether anything on the receiving end changed is a different question, and it is answered by watching what the page loads next.

Why the volume of GPC traffic keeps rising

Three forces push in the same direction, and describing them takes no forecast.

Default-on browsers convert their whole user base. In tier one there is no funnel. Adoption of the browser is adoption of the signal, so the sending population grows at the rate the browser grows rather than at the far slower rate at which people change privacy settings. Every new install adds a sender who never opted in to sending anything.

More states are folding recognition into statute. This one does not add senders. It adds weight to each one. A request that was a preference in one jurisdiction becomes a legally operative opt-out in another as each new law takes effect, so the consequence attached to mishandling any single signal keeps rising even across a period where the number of senders held still.

Extensions carry GPC in alongside other features. People install a tracker blocker because they want fewer ads or a faster page, not because they set out to send a universal opt-out. GPC rides along. That ties the signal's growth to tracker-blocker installs, which is a much broader and better motivated population than the one seeking out privacy signals by name.

Put the three together and the shape is clear: the sending population grows without deliberate opt-in, the legal weight of each signal grows as statutes accumulate, and the strongest driver of new installs is a benefit that has nothing to do with privacy signalling. No step in that chain waits on consumers learning what GPC is.

What rising volume means for a site owner

Every one of those visitors is a compliance test you did not schedule. A free GPC check runs the same test on purpose, from a clean browser session.

The two tests are otherwise the same test. Both load your pages with the signal attached and both observe what fires afterwards. The only structural difference is that you see the result of the one you ran yourself, while the unscheduled version reports its findings to somebody else, or to nobody, or eventually to a regulator.

One thing rising volume does not license is asking the visitor to confirm. For a business on the frictionless path, Regulation 7025(f)(3) is explicit: no notification, pop-up, text, graphic, animation, sound, video, or interstitial in response to the signal, with narrow exceptions for showing the resulting opt-out status and for linking to a privacy settings page. The signal arrives, the behaviour changes, and the page reports the outcome without staging an interruption around it.

Testing from a browser is only half the test

Confirming your browser sends GPC settles the sending half. The receiving half divides into two questions worth reading separately: what the signal carries on the wire covers the header, the JavaScript property, and what a correct response from a site actually consists of. And what to check when the site does not react works the causes in order of likelihood, starting with the browser itself.

Keep the tiers in mind while you test. A result gathered in Chrome with no extension installed is not a pass, it is a test that never ran. Set the signal deliberately, from a session you control, and check the result again after any change that can move a tag: a theme update, a new template, a vendor script pasted straight into a page.