Connecticut GPC & Universal Opt-Out Guide
How to detect and honor Global Privacy Control (GPC) signals and implement universal opt-out mechanisms under the CTDPA.
What Is Global Privacy Control (GPC)?
Global Privacy Control (GPC) is a browser-level signal that communicates a user's privacy preferences to every website they visit. When enabled, GPC sends an HTTP header (Sec-GPC: 1) and a JavaScript property (navigator.globalPrivacyControl) that tells websites the user opts out of selling or sharing their personal data.
GPC is supported by browsers like Firefox, Brave, and DuckDuckGo, and extensions are available for Chrome and other browsers.
Does Connecticut Require GPC Compliance?
The CTDPA explicitly requires websites to honor GPC signals as a valid opt-out of the sale and sharing of personal data.
The CTDPA does not currently require support for universal opt-out mechanisms beyond standard opt-out links.
How GPC Works (Technical Overview)
Browser sends signal
The browser includes Sec-GPC: 1 in HTTP request headers and sets navigator.globalPrivacyControl = true.
Website detects signal
Your cookie consent tool checks for the GPC signal on page load, before any non-essential cookies are set.
Opt-out is applied
Marketing and advertising cookies/trackers are automatically blocked. The user's opt-out preference is recorded in the consent log.
Third parties notified
Google Consent Mode signals are updated to reflect the opt-out, preventing ad platforms from collecting data.
What Your Website Must Do
| Action | Details |
|---|---|
| Detect GPC signal | Check navigator.globalPrivacyControl on page load |
| Block marketing cookies | When GPC is detected, suppress all advertising and tracking cookies |
| Update consent state | Record the GPC-based opt-out in your consent log with a timestamped entry |
| Signal to Google CM | Send ad_storage: denied and ad_user_data: denied via Google Consent Mode |
| Don't override | Do not ask the user to reconsent or override their GPC preference with a banner prompt |
How LegalBanner Handles GPC Automatically
LegalBanner detects GPC signals automatically on every page load. No extra configuration needed:
- ✓Checks
navigator.globalPrivacyControlbefore any cookies are set - ✓Automatically blocks marketing and analytics cookies when GPC is detected
- ✓Updates Google Consent Mode v2 signals in real time
- ✓Logs the GPC-based opt-out with a compliance-grade audit trail
- ✓Respects the signal without showing an intrusive consent banner
Set up CTDPA compliance in 5 minutes
LegalBanner handles Connecticut privacy requirements automatically — cookie banner, opt-out links, and GPC support included.
Frequently Asked Questions
What is GPC and does Connecticut require it?
Global Privacy Control (GPC) is a browser signal that communicates a user's opt-out preference. Yes, the CTDPA requires websites to honor GPC signals as a valid opt-out of the sale and sharing of personal data.
How do I test if my site honors GPC?
Install the GPC extension in your browser (available for Chrome, Firefox, and others), then visit your website. Check that: (1) marketing cookies are not set, (2) your consent tool shows the user as opted out, and (3) ad platforms report denied consent signals.
Does GPC override user consent choices?
Under most state laws, GPC represents a legally binding opt-out preference. The CTDPA treats GPC as equivalent to the consumer directly submitting an opt-out request. If a user explicitly opts in after seeing a GPC signal, that choice typically takes precedence.
What is a "universal opt-out mechanism"?
A universal opt-out mechanism is a technical signal (like GPC) that communicates a consumer's opt-out preference globally, rather than requiring them to opt out on each website individually. While not required under every state law, supporting universal opt-out is increasingly expected.