GPC (Global Privacy Control) is a technical signal that automatically transmits a user's privacy preference at browser level. With a single setting, it tells every visited site 'do not sell or share my data'. Under California's CCPA/CPRA enforcement practice, honoring the signal is treated as mandatory; under EU law and Turkey's KVKK it has no binding status.
GPC is an open specification that works as an HTTP header and a JavaScript property: the user switches the preference on once in a browser or extension, and the browser sends the signal automatically to every site. The idea is not new; its predecessor, the Do Not Track (DNT) signal, was widely ignored because no enforcement mechanism required sites to honor it, and it effectively failed. GPC grew out of that lesson: tie the signal to a legal obligation. That link was established in California, where CCPA/CPRA enforcement treats GPC as a valid way for consumers to opt out of the sale and sharing of their data, and regulators have acted against businesses that ignore it. Several other US state laws also recognize universal opt-out signals.
On the EU side there is no obligation under the GDPR or the ePrivacy framework to honor GPC, and Turkey's KVKK attaches no legal consequence to the signal either. The practical meaning therefore depends on your audience: a site selling into California and subject to the CCPA/CPRA should detect the signal and stop selling or sharing data for that visitor. For sites focused on Turkey and the EU, consent management still runs through the banner; recognizing GPC is not an obligation but a step that respects user preference. Consent management platforms can read the signal and reflect it in stored preferences.
Frequently asked questions
What is the difference between GPC and Do Not Track (DNT)?
Technically both are preference signals sent by the browser; the difference is legal force. No legislation ever required sites to honor DNT, so it was ignored and effectively died. GPC, by contrast, became binding in California through CCPA/CPRA enforcement: a business receiving the signal is treated as obliged to stop selling and sharing that visitor's data.
Do websites in Turkey have to honor the GPC signal?
No. Turkey's KVKK and related regulations attach no legal obligation to the GPC signal; in Turkey, consent is collected through an active action on the cookie banner. However, if your site has visitors from California and falls under the CCPA/CPRA, you need to take the signal into account. For sites outside that scope, recognizing GPC is a voluntary good practice, not an obligation.
This content is for information only and is not legal advice.