Headers: Sec-GPC

Sec-GPC header

Limited availability

This feature is not Baseline because it does not work in some of the most widely-used browsers.

Want more support for this feature? Tell us why.

Learn more
See full compatibility

Experimental: This is an experimental technology
Check the Browser compatibility table carefully before using this in production.

The HTTP Sec-GPC request header is part of the Global Privacy Control (GPC) mechanism to indicate whether the user consents to a website or service selling or sharing their personal information with third parties.

The specification does not define how the user can withdraw or grant consent for website.

Header type	Request header
Forbidden request header	Yes (`Sec-` prefix)

Syntax

Sec-GPC: <preference>

Directives

<preference>: A value of 1 means the user has indicated that they prefer their information not be shared with, or sold to, third parties. Otherwise, the header is not sent, which indicates that either the user has not made a decision or the user is okay with their information being shared with or sold to third parties.

Examples

Reading Global Privacy Control status from JavaScript

The user's GPC preference can also be read from JavaScript using the Navigator.globalPrivacyControl or WorkerNavigator.globalPrivacyControl property:

navigator.globalPrivacyControl; // "false" or "true"

Specifications

Specification
Global Privacy Control (GPC)> # the-sec-gpc-header-field-for-http-requests>

Browser compatibility

	Desktop					Mobile
	Chrome	Edge	Firefox	Opera	Safari	Chrome Android	Firefox for Android	Opera Android	Safari on IOS	Samsung Internet	WebView Android	WebView on iOS
`Sec-GPC`	No	No	120 Opt-in to GPC using the Website Privacy Preference setting (`about:preferences#privacy`) checkbox 'Tell websites not to sell or share my data', or by setting the preference `privacy.globalprivacycontrol.enabled` to `true`.	No	No	No	122 Opt-in to GPC using the Enhanced Tracking Protection toggle 'Tell web sites not to share & sell data', or by setting the preference `privacy.globalprivacycontrol.enabled` to `true`.	No	No	No	No	No