The fix, in one snippet
Settings > Privacy & Security > scroll to
"Website Privacy Preferences" > tick "Tell websites not to sell
or share my data"
Or: About:config > privacy.globalprivacycontrol.enabled = true
Brave has it on by default. Chrome needs an extension.Illustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
The server checks for the Sec-GPC: 1 request header and the page reads navigator.globalPrivacyControl. The check passes when both are present. GPC is sent natively by Firefox (setting available since version 120), Brave (on by default) and the DuckDuckGo browser, and by extensions such as EFF's Privacy Badger. Chrome, Edge and Safari have no built-in GPC setting as of this writing. We also report a mismatch between the header and the JavaScript property, which usually means an extension sets one but not the other.
Why it matters
GPC is a "do not sell or share my personal information" signal. Unlike Do Not Track it has legal backing: the California Privacy Protection Agency's regulations treat it as a valid opt-out under the CCPA, and Colorado and Connecticut law require businesses to honour universal opt-out mechanisms. In 2022 the California Attorney General settled with Sephora for, among other things, ignoring GPC signals. Without it you have to find and use each site's own "Do Not Sell" link. The limit is that GPC is a legal instruction, not a technical block: it does nothing on sites outside those jurisdictions and does not stop a tracker from loading.
How to fix it
Firefox: Settings > Privacy & Security > Website Privacy Preferences > "Tell websites not to sell or share my data". Brave: enabled by default under Shields. Chrome and Edge: install Privacy Badger, which sends both GPC and DNT and also blocks trackers. Safari: no built-in option; if the signal matters to you, use Firefox, Brave or the DuckDuckGo browser. Pair the signal with a content blocker so that tracking is prevented technically as well as requested legally. Guides: Do Not Track vs Global Privacy Control and getting data brokers to delete your profile.
Where this fits
Global Privacy Control signal is check 11 of 16 that the browser security & privacy check runs under browser privacy and policy enforcement, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
Fix this one first
Above it in the same category sits Full referrer sent cross-site (low), where when you follow a link to another site, your browser sends the full address of the page you came from, including its path and query string. An attacker who has that does not need this, so it is the better use of the same hour.
What fixing this still leaves open
Global Privacy Control signal closes one route in. Immediately below it: WebGL renderer exposure, where scripts can read your graphics card model and driver details through WebGL, a strong and long-lived identifying signal; Do Not Track signal, where your browser is not sending the DNT: 1 header; Hardware details exposed to scripts, where scripts on any page can read your CPU core count, approximate memory, screen geometry, touch capability and in some browsers battery and network state, all of which feed a fingerprint.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: Global Privacy Control signal (low severity)
Scanner check id: global-privacy-control
What this check tests: Your browser is not sending the Global Privacy Control signal, so sites that are legally required to honour opt-outs will not receive yours automatically.The rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
References
Related guides
8 min read · Updated Sep 16, 2026
Do Not Track vs Global Privacy Control: Which Signal Sites Actually Have to Honour
Do Not Track was ignored for a decade; Global Privacy Control has legal force in some jurisdictions. Both signals, how to send them,...
Read the guide
8 min read · Updated Sep 15, 2026
Data Brokers: Who Has Your Personal Information and How to Get It Removed
Data brokers assemble profiles from public records, purchases and tracking, then sell them. Where the data comes from, the opt-out...
Read the guide