How to Enable Global Privacy Control in Every Browser (and Why You Should)

Security-wise, most browsers are an open door, happy to reveal your screen size, operating system, language preferences, or GPU model when a website asks. But telling those websites to stop selling your data to third parties is still more confusing than it should be. 

Although about a dozen U.S. states—including California, Delaware, New Jersey, and Texas—now require businesses to honor consumers’ privacy preferences online, most browsers do not offer a native opt-out option that lets you signal those preferences by default. Now, the California Opt Me Out Act, which goes into effect on Jan 1, 2027, is making it mandatory for browsers to do so. 

Still, for now, native support for a global privacy opt-out remains inconsistent among web browsers. TSome privacy-forward browsers like Brave, DuckDuckGo, and Mozilla Firefox enable this feature by default, while others, like Chrome or Edge, require you to install third-party extensions such as the EFF Privacy Badger. Since coverage and setup vary wildly, I’ll walk you through the exact steps to enable this feature on every major browser. 

What is Global Privacy Control?

Global Privacy Control (GPC) is an open-source consumer privacy protocol developed jointly by several universities, media organizations, and privacy-focused tech companies. Instead of having to hunt for a manual “Do Not Sell” or “Refuse Third-Party Cookies” link on every website and app, you enable this feature once in your browser to send a legal notification to every online destination you visit that you’d like to opt out of all data sharing and targeted advertising features. 

On a technical level, GPC combines an HTTP header (Sec-GPC) with a JavaScript property (navigator.globalPrivacyControl) that your browser sends with every website fetch request to let website owners know that they are not supposed to share or sell your data. 

Unlike previous iterations like Firefox’s Do Not Track, GPC issues a specific request that’s backed by leading data protection legislation, including the General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA), making websites and businesses more likely to honor them. With over 150 million users and more than 66,000 participating websites, the GPC project has garnered support and participation from the Mozilla Foundation, The Washington Post, Automattic, Electronic Frontier Foundation (EFF), The New York Times, and others. It has even been made into an official work item at the World Wide Web Consortium (W3C). 

Unfortunately, even when enabled, GPC isn’t foolproof. USENIX found that about 45% of the 11,708 websites they surveyed did not honor privacy signals even when regional laws required them to do so. Still, it’s better than having no legal privacy opt-out at all, since cookie and tracker blockers work client-side and may end up breaking functionality on certain sites.

How to enable Global Privacy Control on your browser

When it comes to GPC support, web browsers fall broadly into two camps. There are privacy-focused platforms like Brave Browser, DuckDuckGo, and Firefox that offer native support using a built-in toggle, or just enable it by default. Then there are mainstream browsers like Chrome, Edge, and Safari that offer limited support through third-party extensions, or sometimes none at all. Here are the exact steps to follow to enable Global Privacy Control on Firefox, Chrome, Edge, Brave Browser, and others:

Brave

Being a privacy-first Chromium-based web browser, Brave has GPC enabled by default on Windows, macOS, and Android. However, due to certain platform limitations on iOS, Brave can only enable the feature through the JavaScript API and not the HTTP header on iPhones. 

You don’t need to do anything to enable GPC on Brave Browser, but there’s an easy way to confirm whether it’s active and running: 

1. Launch Brave. In the address bar, type in “brave://flags/#brave-global-privacy-control-enabled” and hit Enter. 

2. Confirm that the Settings page reads Default or Enabled, not Disabled. 

3. To disable GPC on your browser, navigate to Settings > Brave Shields and Privacy to find the corresponding toggle. 

DuckDuckGo

DuckDuckGo, like Brave Browser, enables GPC by default on Windows, macOS, Android, iOS, and iPadOS. There’s no built-in toggle to disable it, which tells you just how seriously this browser takes its privacy implementation. (There's even a DuckDuckGo Search & Tracker Protection extension you can add to Chrome, Edge, and Firefox to enable GPC on those browsers, too!)

If you’d like to confirm that GPC is on when you’re using DuckDuckGo, there’s an easy way to do that: 

1. Open a new tab on DuckDuckGo Private Browser and visit the Global Privacy Control website. 

2. Check the notification banner at the very top to see if it reads “GPC signal detected.” 

To avoid breaking certain websites on Android, iOS, and Mac devices, DuckDuckGo only sends the GPC signal to websites that are known to respect it. However, you still get full coverage on Windows or if you use the Chrome extension. 

Firefox

Firefox has offered GPC support since version 120. However, it’s not enabled by default, and you need to hunt for a specific toggle to switch it on. 

1. Click on the menu button on your Firefox app, then navigate to Settings. 

2. Access the Privacy & Security tab from the panel on the left.

3. Keep scrolling until you see Additional protections. On Android version 122+, look for a section that says Enhanced Tracking Protection.

4. You should see a checkbox next to an option that reads “Tell websites not to sell or share my data.” This is what you’re looking for. 

5. Make sure you check the option to enable GPC, then relaunch Firefox. 

Chrome

As of this writing, Google Chrome does not offer a built-in toggle or native support for GPC. However, you can install a third-party browser extension like the Privacy Badger by EFF or DuckDuckGo Search & Tracker Protection to enable Global Privacy Control very easily. 

1. Search for Privacy Badger on the Chrome Web Store. 

2. Once you find it, click Add to Chrome. Make sure to enable any required permissions for the extension to work too.

3. That’s it, GPC is enabled on all sites now. You don’t need to fiddle around with the settings since everything comes pre-configured. 

Edge 

As with Chrome, Microsoft Edge users must also rely on third-party extensions to enable Global Privacy Control. And like before, you can choose between Privacy Badger or the DuckDuckGo extension to activate this feature. 

1. Open the Edge Add-ons store and look for Privacy Badger. EFF’s website lists both Edge and Edge for Android as supported browsers for the extension. 

2. Click Get, followed by Add extension. 

3. GPC is now on by default. You don’t need to configure anything else. 

The difference between GPC and an ad blocker

At this point, you might be wondering if there’s any difference between this and just using an ad or cookie blocker extension on your web browser. Well, there are a few important distinctions. 

First, GPC is a signal. It merely informs websites of your privacy preferences, but does nothing to actively block or prevent tracking or sharing of your data. Second, GPC is narrower in scope because it only covers selling or sharing your data with third parties, not collecting or storing data for a website’s own use. 

Finally, ad blockers are very likely to break functionality on websites that rely on certain cookies or trackers to work as intended. Since GPC is a request rather than a blocking mechanism, it preserves existing functionality while sending a legal notification to websites that they may not share your data with anyone. 

When you’re enabling Global Privacy Control instead of using an anti-tracking app or ad blocker, you’re trading coverage and effectiveness for convenience. You’ll have to just trust that websites will honor your privacy preferences, which many don’t, even when they are required to. For example, Disney just settled a $2.75 million lawsuit with the California AG’s office because it didn’t honor opt-out requests for logged-in users on every device like it was supposed to.