Global Privacy Control (GPC): What Clinic Sites Must Honor

Clinic websites that sell or share personal information and belong to a business the CCPA covers must honor a Global Privacy Control (GPC) signal as a valid request to opt out, and from January 1, 2027, California requires browser makers to offer a setting that sends such a signal. California's Attorney General says GPC "must be honored by covered businesses as a valid consumer request to stop the sale or sharing of personal information" (California AG), and the new law, AB 566, is "operative on January 1, 2027" (AB 566). Curve Compliance treats Global Privacy Control as a decline of advertising and honors it in every region, alongside the server-side conversion tracking it runs under the BAA it signs on every plan.

Book a call. See which of your tags would keep sending data after a visitor turns on GPC, and how Curve Compliance holds them back. Book a call with Curve.

What Global Privacy Control is

GPC is a browser setting. When it is on, the browser tells every site it visits that the person does not want their data sold or shared. The Chrome feature entry on chromestatus describes the mechanics: "automatic transmission of the Sec-GPC HTTP header with a value of "1" on all outgoing requests when enabled," and a "navigator.globalPrivacyControl property allowing websites to detect the user's GPC preference" (chromestatus).

California's Attorney General calls it a "stop selling or sharing my data switch" that is "available on some internet browsers, like Mozilla Firefox, Duck Duck Go, and Brave, or as a browser extension" (California AG). Your server sees the header on each request, and your page scripts can read the property.

California: an opt-out you must honor

The CCPA covers a for-profit "business" that does business in California and meets one of three thresholds, such as annually buying, selling or sharing the personal information of "100,000 or more consumers or households" (1798.140(d), CCPA text). It gives consumers the right to "direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer's personal information" (Civil Code 1798.120, CCPA text). "Sharing" here means giving personal information "to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration" (1798.140). That is ad targeting based on activity "across businesses, distinctly branded internet websites, applications, or services," which is what retargeting pixels are built for.

The regulations turn GPC into a request you must act on. A business that sells or shares personal information "shall process any opt-out preference signal" that meets the rules "as a valid request to opt-out of sale/sharing," and an acceptable format is "an HTTP header field or JavaScript object" (section 7025(b), CCPA regulations). The opt-out applies "for that browser or device and any consumer profile associated with that browser or device, including pseudonymous profiles" (7025(c)(1)). Posting a "Do Not Sell or Share My Personal Information" link does not replace it: "Even if the business posts the above-referenced links, the business must still process opt-out preference signals" (7025(e)).

For what California law covers on a clinic site more broadly, see CMIA and CCPA for healthcare marketing.

January 1, 2027: browsers must offer an opt-out signal (AB 566)

AB 566, the "California Opt Me Out Act," was approved on October 8, 2025, as Chapter 465 and adds Civil Code 1798.136 (AB 566). Its core line: "A business shall not develop or maintain a browser that does not include functionality configurable by a consumer that enables the browser to send an opt-out preference signal to businesses with which the consumer interacts through the browser." The setting must be "easy for a reasonable person to locate and configure," and the signal is one that "communicates the consumer's choice to opt out of the sale and sharing of the consumer's personal information." The section "shall become operative on January 1, 2027."

The law is aimed at browser makers, not clinics. Its effect on clinics is volume: once a setting ships in every major browser, more of your visitors can send the signal your site already has to process.

Where Chrome, Safari and other browsers stand

Each row quotes the browser maker's own page as it reads today; for Chrome, that is its public feature entry on Chrome Platform Status. We make no prediction about release dates.

Browser	What its own page says
Chrome	The entry lists "No milestones specified" and an active stage of "Prototype a solution." Its stated motivation: California "obligates the browsers to provide ability to communicate do-not-sell-or-share preference before 2027," and "Currently, Chrome allows to send GPC header only via an extension which may be not sufficient to be compliant with the bill" (chromestatus)
Firefox	Firefox 120 added a setting "to enable Global Privacy Control." "With this opt-in feature, Firefox informs the websites that the user doesn't want their data to be shared or sold. This feature is enabled in private browsing mode by default." (Firefox 120 notes)
Apps built on WebKit (Safari 27.0 release)	WebKit's Safari 27.0 notes list, under WKWebView, a setting that lets "a native app enable or disable sending the Global Privacy Control (GPC) Sec-GPC HTTP header on outgoing requests for a given page load" (WebKit)
Brave	"For versions of Brave that have GPC implemented, the feature is on by default." (Brave)
DuckDuckGo	"The GPC setting is enabled by default" in its browser and extension (DuckDuckGo)

Showing visitors their signal was honored

The regulations in force since January 1, 2026 say a business "must display whether it has processed the consumer's opt-out preference signal as a valid request to opt-out of sale/sharing on its website." Their example is a line that reads "Opt-Out Request Honored" when a browser with the signal visits, plus a toggle or radio button showing the opt-out (section 7025(c)(6), CCPA regulations). The rules also say a business "shall not interpret the absence of an opt-out preference signal after the consumer previously sent an opt-out preference signal as consent to opt-in" when it knows the consumer (7025(c)(5)). The CCPA risk assessment guide covers this display rule too.

More rules may come. CalPrivacy lists opt-out preference signals among its preliminary topics: "The preliminary comment period closed on April 6, 2026," and such proposals "have not yet advanced to formal rulemaking" (CalPrivacy).

Also on January 1, 2027

Rule	What the text says	More
Oklahoma SB 546	"This act shall become effective January 1, 2027." A controller may not "Process the sensitive data of a consumer without obtaining the consumer's consent" (enrolled text)	Oklahoma and Louisiana guide
Louisiana Act 502	"This Act shall become effective on January 1, 2027." A consumer may name an authorized agent to opt out for them "using a technology, including a link to a website, an internet browser setting or extension, or a global setting on an electronic device," and that technology "May not make use of a default setting" (Act 502)	Oklahoma and Louisiana guide
California ADMT rules	A business using automated decisionmaking for a significant decision "must be in compliance with the requirements of this Article no later than January 1, 2027" (section 7200(b), CCPA regulations)	ADMT and telehealth quizzes

California's pen register bill has its own page: SB 690 and CIPA for healthcare websites.

GPC, consent banners and HIPAA

GPC is a state privacy signal, not a HIPAA tool. The CCPA does not apply to "protected health information that is collected by a covered entity or business associate" (1798.146(a)(1), CCPA text), so a covered clinic's PHI sits under HIPAA instead. Website data outside that exemption can still be personal information under the CCPA, so talk to your counsel about where your site's data falls.

Honoring GPC also does not fix a HIPAA problem. A visitor with GPC off has not authorized you to send PHI to Meta or Google. See when ad tracking needs a HIPAA marketing authorization and whether a cookie banner is enough for HIPAA.

What changes in your tracking

• List what fires. Curve's free website scan shows the pixels and trackers on a page, so you know what GPC has to stop.
• Read the signal everywhere. Check the Sec-GPC header on the server and the browser property on the page. Server-side sends need the same check as browser pixels.
• Stop sharing for that browser and its profiles. Section 7025(c)(1) reaches pseudonymous profiles tied to the browser, which can include ad audiences and server-side events.
• Show the status. Add an "Opt-Out Request Honored" style message or toggle where visitors manage privacy choices.
• Test it. Load your site in Firefox, Brave or DuckDuckGo with GPC on and confirm which requests still leave the page. See consent banner settings for clinic sites.

How Curve Compliance helps

Curve Compliance runs consent management and conversion tracking together. It applies the right rule for each visitor's region, with a row for every US state. It treats Global Privacy Control as a decline of advertising, honors it in every region, and holds back tracking and ad forwarding until each visitor's choice allows it. When a visitor declines advertising, Meta and TikTok receive the event with contact fields removed and marked as limited use, and Google Ads click conversions, Microsoft and LinkedIn are not sent at all. Every accept, decline, change and withdrawal is recorded in an append-only audit log you can export as CSV.

Conversions go to ad platforms server-side, and Curve strips PHI before data reaches an ad platform. Curve signs a BAA on every plan, is SOC 2 Type II, and Curve's team does the setup, typically live in about a week. For replacing browser pixels, see HIPAA-compliant Meta pixel alternatives and server-side tracking tools.

Sources, checked October 26, 2026: AB 566 bill text; CCPA statute, effective January 1, 2026 (CalPrivacy); CCPA regulations, effective January 1, 2026 (CalPrivacy); CalPrivacy, Laws and Regulations; California Attorney General, CCPA; chromestatus, Global Privacy Control; WebKit, Safari 27.0; Firefox 120 release notes; Brave, Global Privacy Control; DuckDuckGo, GPC; Oklahoma SB 546 enrolled; Louisiana Act 502.

Frequently Asked Questions

Do clinic websites have to honor Global Privacy Control?

Yes, if a business the CCPA covers runs the site and sells or shares personal information: California's regulations require a business that does so to "process any opt-out preference signal" as a valid opt-out (CCPA regulations). PHI collected by a HIPAA covered entity or business associate falls outside the CCPA (1798.146).

What is Global Privacy Control?

A browser setting that sends a Sec-GPC header and exposes a browser property telling sites the person does not want their data sold or shared (chromestatus). California's Attorney General treats it as a valid opt-out request (California AG).

What does AB 566 require from January 1, 2027?

Businesses that make browsers must include a setting, easy to find and configure, that sends an opt-out preference signal to the sites a person visits (AB 566). Sites already have to process the signal; AB 566 makes the setting widely available.

Does Chrome support Global Privacy Control?

Not as a built-in setting yet. Chrome's feature entry lists "No milestones specified," and says Chrome sends the GPC header "only via an extension" (chromestatus).

Which browsers send GPC today?

Firefox has a setting, on by default in private browsing (Firefox). Brave and DuckDuckGo say it is on by default (Brave; DuckDuckGo). From the Safari 27.0 release, apps built on WebKit can turn the header on for a page load (WebKit).

Does server-side tracking have to honor GPC?

Yes, when what the server sends is a sale or sharing. Section 7025 applies "for that browser or device and any consumer profile associated with that browser or device" (CCPA regulations), and nothing in it limits the duty to browser pixels. Curve Compliance treats GPC as a decline of advertising for both.

Is GPC the same as a cookie banner?

No. A banner asks the visitor on your site; GPC arrives with every request from a browser where the person turned it on. You need to respect both, and a banner is not a HIPAA authorization either. See consent management vs HIPAA authorization.

Does honoring GPC change HIPAA obligations?

No. GPC answers state privacy law. HIPAA has its own limits on sending PHI to an ad platform, including when marketing needs a patient's authorization, so keep PHI out of what ad platforms receive. See when ad tracking needs a HIPAA marketing authorization and HIPAA-compliant Meta pixel alternatives.

Talk to Curve Compliance

Book a call. See how Curve Compliance honors Global Privacy Control in every region and sends conversions server-side with PHI removed before anything is sent to an ad platform, under the BAA it signs on every plan. Book a call with Curve.