Specification

https://w3c.github.io/gpc/

Explainer

https://w3c.github.io/gpc/explainer

Links

• The WG's request for this TAG review: https://github.com/w3c/gpc/issues/138 <!-- If the WG didn't express consensus to ask the TAG for a review, use the "Other Specification Review" template instead, at https://github.com/w3ctag/design-reviews/issues/new?template=015-other-spec-review.yaml. This is usually a deep link into minutes or an email thread. -->
• Previous early design review, if any: N/A <!-- https://github.com/w3ctag/design-reviews/issues/#### -->
• An introduction to the feature, aimed at unfamiliar audiences: https://w3c.github.io/gpc/#introduction <!-- Can be the specification's or explainer's introduction, or another section. -->
• A description of the problems that end-users were facing before this proposal: https://w3c.github.io/gpc/#introduction <!-- See https://w3ctag.github.io/explainer-explainer/#end-user-need -->
• Alternatives considered: https://w3c.github.io/gpc/explainer#6-alternatives-considered <!-- See https://w3ctag.github.io/explainer-explainer/#alternatives -->
• Examples of how to use the proposal to solve the end-users' problems: https://global-privacy-control.vercel.app/ <!-- See https://w3ctag.github.io/explainer-explainer/#describe-proposal -->
• What do the end-users experience with this proposal: https://w3c.github.io/gpc/explainer#5-user-experience-considerations-and-recommendations <!-- See https://w3ctag.github.io/explainer-explainer/#describe-proposal -->
• User research you did to validate the problem and/or design, if any:
  • https://petsymposium.org/popets/2023/popets-2023-0052.php
  • https://petsymposium.org/popets/2024/popets-2024-0015.php
  • https://www.usenix.org/conference/usenixsecurity25/presentation/hausladen
• Web Platform Tests: See previous bullet point. <!-- Or other tests if this is not a web platform feature. -->

The specification

• Follows the Web Platform Design Principles.
• Includes Security and Privacy Considerations sections based on answers to the Security/Privacy Questionnaire.

Where and by whom is the work is being done?

• GitHub repo: https://github.com/w3c/gpc
• Primary contacts:
  • Nick Doty (@npdoty), Center for Democracy and Technology, Privacy Working Group Chair
  • Christine Runnegar, Privacy Working Group Chair, Invited Expert
  • Peter Snyder (@pes10k), Brave, Privacy Working Group Chair and GPC Spec Editor
  • Sebastian Zimmeck (@SebastianZimmeck), Wesleyan University, GPC Spec Editor
  • Justin Brookman (@j-br0), Consumer Reports, GPC Spec Editor
  • Aram Zucker-Scharff (@aramzs), The Washington Post, GPC Spec Editor
• Organization/project driving the specification: GPC group with contributors from:
  • Academia (e.g., Wesleyan University)
  • Civil society organizations (e.g., Consumer Reports and Center for Democracy and Technology)
  • Browser vendors (e.g., Brave, DuckDuckGo, and Mozilla)
  • Web publishers (e.g., The Washington Post and Digital Content Next)
  • Tech companies (e.g., Google)
  • And other web stakeholders ...
• This work is being funded by:
  • National Science Foundation
    • #2618248 SaTC 2.0: RES: Enforcing Privacy Opt-out Compliance for a Trustworthy Web
    • #2055196 SaTC: CORE: Small: Improving Internet Privacy with Global Privacy Control
  • Alfred P. Sloan Foundation Grant under the Program for Universal Access to Knowledge
  • Wesleyan University
    • Grants in Support of Scholarship
    • Anil Fernando Endowment
• Primary standards group developing this feature: Privacy Working Group
• Incubation and standards groups that have discussed the design:
  • Privacy Working Group, Minutes <!-- Include a link to minutes or issues in this group if possible. -->

Feedback so far

• Active horizontal reviews: TBD <!-- Link to an issue like https://github.com/webmachinelearning/webnn/issues/239, https://github.com/WebAssembly/spec/issues/1804, or https://github.com/w3c/did/issues/885, which itself links to the other horizontal reviews. If you haven't started the rest of the horizontal reviews, please consider doing so. -->
• Multi-stakeholder feedback:
  • Chromium comments: TBD
  • Mozilla comments: TBD https://github.com/mozilla/standards-positions/issues/NNN <!-- And/or other places they've given feedback -->
  • WebKit comments: TBD https://github.com/WebKit/standards-positions/issues/NNN <!-- And/or other places they've given feedback -->
  • Feedback/review from developers, implementers, civil society, and others}}
    • A usability survey found that 94% of the participants would turn on GPC and 81% showed a correct understanding of what GPC does ensuring that their intent is accurately represented by their choice.
• Major unresolved issues with or opposition to this specification: None
• Status/issue trackers for implementations: <!-- Include links to [Chrome Status](https://chromestatus.com/), [Mozilla's](https://bugzilla.mozilla.org/), [WebKit's Bugzilla](https://bugs.webkit.org/), and trackers for other implementations if those are known to you. -->
  • Chrome status: TBD
  • Firefox status: Mozilla Support Global Privacy Control
  • Safari status: Apple Developer Documentation globalPrivacyControlEnabled
  • Brave status: Brave Help Center How do I change my Privacy Settings?
  • DuckDuckGo status: Global Privacy Control (GPC) Enabled by Default in DuckDuckGo Apps & Extensions

You should also know that...

• As of August 14, 2026, 385,000+ websites declare compliance with GPC as indicated via the GPC .well-known support resource
• Per Amazon's Additional State-Specific Privacy Disclosures, "In 2025, Amazon received approximately 349.5 million cross-context behavioral advertising opt-out requests. The large majority of those requests are from visits to our website with GPC already enabled."
• GPC is required by law in at least five US states: California, Connecticut, Colorado, Oregon, and New Jersey. It is actively enforced. See, e.g., Connecticut, California and Colorado Announce Joint Investigative Privacy Sweep.
• Starting on January 1, 2027 every browser is required to have a GPC setting under the California Opt Me Out Act, an amendment to the California Consumer Privacy Act.
• Under its proposed amendment of the General Data Protection Regulation with privacy preference signals in a new Art. 88b under the European Union's Digital Omnibus, the European Commission expressed interest to adopt GPC.
• Research showed that "enabling the Global Privacy Control (GPC) signal initially reduces the number of intractable cookies by 30% on average, with a further 32% reduction possible on subsequent visits by rejecting the banners."

<!-- Content below this is maintained by @w3c-tag-bot -->

---

Track conversations at https://tag-github-bot.w3.org/gh/w3ctag/design-reviews/1265