webtracking.org
tools

Is Your Browser Sending GPC? Test Your Global Privacy Control Signal

Test whether your browser sends the Global Privacy Control (GPC) signal, see legacy Do-Not-Track flags, and learn how to enable GPC — free, fully client-side.

last verified 2026-07-18

Global Privacy Control is the one browser privacy signal with legal teeth: under California’s CPRA, a business must treat it as a valid opt-out of the sale or sharing of personal data, and the Colorado and Connecticut privacy laws recognize it similarly. But GPC is also invisible. It’s a request header and a JavaScript property, not a banner or an icon, so most people who think they’ve enabled it have no way to confirm the signal is actually going out — and most people who haven’t enabled it don’t know their browser is sending nothing at all.

The free GPC & Do-Not-Track Signal Tester answers that question in one page load. It reads the privacy signals your own browser exposes to every site, renders a plain-English verdict on your GPC status, shows the raw values it read, and walks you through enabling GPC in each major browser. It runs entirely client-side: no analytics, no cookies, no network requests of any kind — it even works offline.

What it does

The tester gives you four things on a single page:

  • A GPC verdict card. A three-state verdict on navigator.globalPrivacyControl: your browser is sending GPC, supports GPC but has it switched off, or doesn’t implement the GPC API at all. Each state comes with a one-line explanation of what it means and a raw readout of the actual property value.
  • A Do-Not-Track card. It reads the three legacy DNT properties (navigator.doNotTrack, window.doNotTrack, and the old IE-era navigator.msDoNotTrack) and tells you whether your browser still transmits the flag — along with the honest framing that DNT carried no legal weight, almost no sites honored it, and GPC is the signal that matters now.
  • Browser-by-browser enable instructions. Expandable sections for Firefox (a built-in checkbox), Brave and DuckDuckGo (GPC on by default), Chrome and Edge (extension required — no native toggle), and Safari (no native support; the practical route is a browser that ships GPC).
  • A table of other readable signals. Four additional privacy-relevant flags: a User-Agent reduction heuristic, whether the UA Client Hints API (navigator.userAgentData) exists, the navigator.cookieEnabled flag, and whether the Storage Access API (document.hasStorageAccess) is present. A “raw values” expander shows everything the page read, verbatim.

How it works

Everything happens in one inline script with no dependencies. A single readSignals() function snapshots the relevant properties from navigator, window, and document, and three render functions turn that snapshot into the verdict cards and the table. Clicking Re-check signals simply runs the whole pipeline again.

The GPC verdict is a three-way branch:

  1. Signal detected. The spec says navigator.globalPrivacyControl should be the boolean true, but the tester also tolerates non-spec shims that expose 1 or "1" — an extension injecting a value like that almost certainly accompanies a sent Sec-GPC header. Any of the three yields the green verdict.
  2. Supported, switched off. The property exists on navigator (checked with "globalPrivacyControl" in navigator) but isn’t truthy. Your browser implements GPC; the preference just isn’t enabled.
  3. Not implemented. The property is absent entirely. The browser doesn’t expose the GPC API, so it is almost certainly not sending the Sec-GPC header either.

The DNT check treats the signal as “being sent” if any of the three legacy properties is "1", "yes", 1, or true — covering the inconsistent values browsers historically used — and prints each property’s raw value in a monospace readout so you can see exactly which one fired.

The User-Agent row is explicitly labeled a heuristic. When navigator.userAgentData exists, the tester matches the UA string against the frozen Chromium pattern (Chrome/<major>.0.0.0) to report whether the browser is sending a reduced UA; when the Client Hints API is absent (Firefox and Safari lineages), it reports that UA reduction simply isn’t verifiable from JavaScript in that browser.

One design point worth knowing: GPC is transmitted two ways — the Sec-GPC: 1 request header on every request, and the JavaScript property. A client-side page cannot read the headers of the request that fetched it; that would require a server echoing them back, and this tool deliberately talks to no server. So the verdict reads the JS property and infers the header from it. In mainstream implementations both are set together from the same preference, so the inference is usually reliable. The page states this limitation on-screen rather than papering over it.

How to use it

  1. Open the GPC & Do-Not-Track Signal Tester. It runs immediately on load — there is nothing to paste or configure.
  2. Read the top verdict card. Green (“signal detected”) means every site you visit is receiving a machine-readable opt-out of sale/sharing. Amber (“supported, switched off”) or red (“not implemented”) means you’re broadcasting nothing.
  3. If the verdict isn’t green, expand the section for your browser under How to turn GPC on: Firefox is Settings → Privacy & Security → "Tell websites not to sell or share my data"; Brave and DuckDuckGo send it by default; Chrome and Edge need an extension such as Privacy Badger; Safari has no native option.
  4. Reload the page after changing a setting. The Re-check signals button re-reads everything in place, but most browsers apply GPC on the next page load, so reload if re-checking shows no change.
  5. Optionally expand Raw values read by this page to see the verbatim value of every property the tool inspected, including your full User-Agent string — all rendered locally.

Limitations

  • It infers the header from the JS property. An extension can add the Sec-GPC header without injecting navigator.globalPrivacyControl, in which case the tester under-reports. Confirming the header itself would require a server round-trip, which this tool refuses to make.
  • It shows what you send, not what sites do with it. A green verdict means the opt-out is being broadcast; whether any given site honors it is a separate audit of that site’s behavior.
  • It reads only coarse flags, by design. The tool deliberately does not fingerprint you: it inspects a handful of signals, renders them locally, and stores and transmits nothing.
  • The UA-reduction row is a heuristic, based on pattern-matching the UA string, and is labeled as such in the table.
  • JavaScript is required. The tool reads browser properties via JS; with scripts disabled there is nothing for it to read (and, either way, it makes no network requests).

FAQ

Is GPC legally binding? In several US states, yes. California’s CPRA requires businesses subject to it to treat GPC as a valid opt-out of the sale or sharing of personal data, and the Colorado and Connecticut privacy laws recognize the signal similarly. That is the key difference from Do-Not-Track, which never carried a legal obligation.

Does GPC block tracking? No. It’s an opt-out signal covering “sale” and “sharing,” which under these laws includes most cross-context advertising. It does not, by itself, stop first-party analytics or processing you’ve otherwise consented to. For blocking, see the tracking-prevention tester and the privacy guides.

Why does the tester say my browser “supports GPC but it’s switched off”? The globalPrivacyControl property exists on navigator in your browser but its value isn’t true. Firefox is the common case: the API ships built in, and a single settings checkbox turns the signal on.

Should I still enable Do-Not-Track? The tester’s verdict is blunt: DNT is a legacy flag, not protection. No law requires honoring it, almost no sites ever did, and major browsers have removed the setting. Spend the effort on GPC.

Does the tool send my data anywhere? No. It is 100% client-side — no analytics, no cookies, no requests of any kind. The raw-values expander shows you the complete list of properties it read.