JavaScript Navigator globalPrivacyControl Property

What You’ll Learn

navigator.globalPrivacyControl is a Boolean Global Privacy Control (GPC) signal for sell/share consent. Learn true vs false, the Sec-GPC header, how it differs from deprecated DNT, five examples, and try-it labs.

Introduction

Privacy laws often talk about “do not sell” or “do not share” personal information. Global Privacy Control (GPC) is a browser signal that expresses that preference for the current website.

navigator.globalPrivacyControl is read-only. When the API exists, it returns a Boolean that mirrors the Sec-GPC HTTP header — so both your front end and your server can see the same preference.

Understanding the globalPrivacyControl Property

Think of GPC as a site-scoped “please don’t sell or share my data” switch the user (or their browser/extension) can turn on.

• true — user explicitly does not consent to sell/share with third parties.
• false — user grants consent or has not indicated a preference (MDN).
• Missing property — browser does not support GPC in JS — feature-detect.
• Sec-GPC — the matching HTTP header for server-side handling.

📝 Syntax

General form of the property:

navigator.globalPrivacyControl

Value

• A Boolean: true or false when the property is supported.

Common patterns

// MDN-style log:
console.log(navigator.globalPrivacyControl);
// true if the user opted out of sell/share; otherwise false (when supported)

// Safe feature-detect:
if ("globalPrivacyControl" in navigator) {
  if (navigator.globalPrivacyControl === true) {
    // Disable sell/share integrations for this visit
  }
} else {
  // Fall back to your consent banner / legal defaults
}

Examples Gallery

Examples follow MDN Global Privacy Control / navigator.globalPrivacyControl patterns. Prefer Try It Yourself to inspect your browser. Use View Output for expected messaging.

const supported = "globalPrivacyControl" in navigator;
console.log(supported ? "GPC available" : "GPC missing");

GPC missing
(or "GPC available" in a supporting browser)

if (!("globalPrivacyControl" in navigator)) {
  console.log("unsupported");
} else {
  console.log(navigator.globalPrivacyControl);
}

unsupported
(or true / false when supported)

function gpcLabel() {
  if (!("globalPrivacyControl" in navigator)) {
    return "GPC: unsupported";
  }
  return navigator.globalPrivacyControl
    ? "GPC: do not sell/share"
    : "GPC: consent or no preference";
}

console.log(gpcLabel());

GPC: unsupported
(or one of the other two labels)

function mayShareWithPartners() {
  if ("globalPrivacyControl" in navigator &&
      navigator.globalPrivacyControl === true) {
    return false;
  }
  // Otherwise use your consent banner / defaults
  return true; // demo default — replace with real consent state
}

console.log("may share?: " + mayShareWithPartners());

may share?: true
(false when GPC is explicitly true)

function privacySignals() {
  return {
    globalPrivacyControl:
      "globalPrivacyControl" in navigator
        ? navigator.globalPrivacyControl
        : "unsupported",
    doNotTrack: navigator.doNotTrack, // deprecated — diagnostic only
    advice:
      "Prefer GPC when present; do not build new logic on DNT"
  };
}

console.log(JSON.stringify(privacySignals()));

{"globalPrivacyControl":"unsupported","doNotTrack":null,"advice":"Prefer GPC when present; do not build new logic on DNT"}

🚀 Common Use Cases

• Disable ad / data brokers — when GPC is true, skip sell/share tags.
• Consent UI — pre-set “do not sell” toggles from the signal.
• Server + client — honor Sec-GPC and the JS property together.
• Migration from DNT — replace deprecated doNotTrack branches.
• Privacy dashboards — show users what signal their browser sends.

📝 Notes

• Experimental and not Baseline — support is limited.
• Not Deprecated or Non-standard on MDN (unlike doNotTrack).
• true = explicit do-not-sell/share; false = consent or no preference.
• Mirrors the Sec-GPC HTTP header.
• Related: doNotTrack, gpu, JavaScript hub.

💡 Best Practices