#1265: WG New Spec: Global Privacy Control (GPC)
Discussions
Log in to see TAG-private discussions.
Comment by @hadleybeeman Aug 19, 2026 (See Github)
Hi @npdoty @pes10k @SebastianZimmeck @j-br0 @aramZS. We're just starting to look at this. For our files (well, for our GitHub labels), is this work happening in a W3C working group or community group? We can still look at it if not, but it would help us to get that straight.
Many thanks!
Comment by @SebastianZimmeck Aug 19, 2026 (See Github)
Thank you, @hadleybeeman!
The work is happening in the Privacy Working Group.
Discussed
Aug 31, 2026 (See Github)
Brian: Heather and I commented on this in the private thread. It seems pretty good. Heather had a comment about workers that I don't think is answered here. They say it's based on what the top-level page sends, but what if you have a shared worker? It seems like a simple start on a better version that is working how Do Not Track was intended to. The spec is much simpler. You can advertise that you support this via a well-known URL. A user can say 'hey, don't sell my information' via a single setting. If you give the signal, there are many places in the world, especially states in the US that are passing laws that can be enforced once you have this in place. There already are lawsuits that are influencing actors on how they work. The spec is super short. I enjoyed reading it.
Christian: So we're waiting for info from the others, but sounds positive so far.
Brian: For me, yes, and for Heather mostly too I think. Heather had that question, we should ask.
Comment by @bkardell Sep 2, 2026 (See Github)
Discussing this with @hlflanagan and she noticed that it seems globalPrivacyControl is exposed on WorkerNavigator, but its normative value is defined in terms of the gpcAtNavigation value of the top-level browsing context. It isn't clear to us how this is intended to work for shared or service workers that may not correspond to a single top-level browsing context. Could this be clarified?
Discussed
Sep 21, 2026 (See Github)
Ehsan: I posted a draft comment. Included Heather's comment. I added a bit about them covering private browsing.
Jeffrey: The GPC is very focused on the specific American laws that say "do not sell or share," and it's not very well-focused on the European laws. I told them that they ought to architect it so that it can incorporate other privacy practices, adn they did not take that advice. There's another [MISSING REFERENCE] that is that flexible, but is maybetoo flexible. I thin kwe want something in between: the syntax of ADPR (https://www.dataprotectioncontrol.org/spec/) and the semenatics defined in another specification. If the rest of the TAG wants to say the same thing, then that's fine, but I'm not going to insist on it because I've already had my say.
Jeffrey: I don't think Do Not Track had a more flexible syntax, but I'm not sure: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/DNT
Lola: I support getting them to work with the ADPR folks. I was ollowing this a long time ago, so I'm not sure what's changed in the time since. At the time, it was not just American-focued but specifically California-focused. They acknowledged that they needed to think about GDPR, but that was six years ago, so it's kind of disappointing.
Comment by @SebastianZimmeck Sep 28, 2026 (See Github)
@bkardell, that is a good point. We discussed it among the editors. We think that removing GPC from service workers would be the easiest approach. So, if a site is using service workers, they would need to request the GPC status from the domain. We still would want to maintain the signal in other kinds of workers (that are tied to a single origin).
(cc'ing @pes10k, @j-br0, @AramZS, and @dmarti)
Discussed
Oct 5, 2026 (See Github)
Lola: Think this is open for tracking?
Heather: Brian had a comment that you wanted to rewrite it to be shorter. Wasn't 100% sure what "this" was. And did you see my comment?
Brian: Can merge Heather's comment.
Lola: Agree that the comment can be shorter than Ehsan's.
Jeffrey: I think merging Heather's and Brian's comments is the way to go
OpenedAug 14, 2026
Specification
https://w3c.github.io/gpc/
Explainer
https://w3c.github.io/gpc/explainer
Links
The specification
Where and by whom is the work is being done?
Feedback so far
You should also know that...
- As of August 14, 2026, 385,000+ websites declare compliance with GPC as indicated via the GPC .well-known support resource
- Per Amazon's Additional State-Specific Privacy Disclosures, "In 2025, Amazon received approximately 349.5 million cross-context behavioral advertising opt-out requests. The large majority of those requests are from visits to our website with GPC already enabled."
- GPC is required by law in at least five US states: California, Connecticut, Colorado, Oregon, and New Jersey. It is actively enforced. See, e.g., Connecticut, California and Colorado Announce Joint Investigative Privacy Sweep.
- Starting on January 1, 2027 every browser is required to have a GPC setting under the California Opt Me Out Act, an amendment to the California Consumer Privacy Act.
- Under its proposed amendment of the General Data Protection Regulation with privacy preference signals in a new Art. 88b under the European Union's Digital Omnibus, the European Commission expressed interest to adopt GPC.
- Research showed that "enabling the Global Privacy Control (GPC) signal initially reduces the number of intractable cookies by 30% on average, with a further 32% reduction possible on subsequent visits by rejecting the banners."
<!-- Content below this is maintained by @w3c-tag-bot -->Track conversations at https://tag-github-bot.w3.org/gh/w3ctag/design-reviews/1265