---
title: "Treat the privacy signal as a no · Agent Wranglers"
url: https://agentwranglers.se/playbook/website/privacy/global-privacy-control
updated: 2026-10-20
licence: "All rights reserved"
---

# Treat the privacy signal as a no

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Recommended
- Chapter: [Privacy](https://agentwranglers.se/playbook/website/privacy)
- Rule: Treat a `Sec-GPC: 1` signal as an opt-out of selling or sharing data, and say so in the privacy policy.
- How: Read the `Sec-GPC: 1` header and `navigator.globalPrivacyControl`. Treat either as an opt-out of sale and sharing. Several US states, including California and Colorado, require this by law. Publish `/.well-known/gpc.json` to say you honour it.
- Check: Load the site with GPC turned on. No requests go to advertising or sharing partners, and `/.well-known/gpc.json` answers with `"gpc": true`.

Example:

```http
GET /.well-known/gpc.json HTTP/1.1
Host: example.com
Sec-GPC: 1

HTTP/1.1 200 OK
Content-Type: application/json

{ "gpc": true, "lastUpdate": "2026-01-15" }
```

```js
if (navigator.globalPrivacyControl) {
  // Visitor opted out: load no sharing or ad scripts
}
```

```python
# Flask: read the header on the server, before any sharing happens
@app.before_request
def global_privacy_control():
    g.opted_out = request.headers.get("Sec-GPC") == "1"
```

```php
$optedOut = ($_SERVER['HTTP_SEC_GPC'] ?? '') === '1';
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/privacy/global-privacy-control`.

- Previous: [Store nothing extra without a yes](https://agentwranglers.se/playbook/website/privacy/cookie-consent)
- Next: [Host everything yourself for privacy](https://agentwranglers.se/playbook/website/privacy/third-party-scripts)
- [Privacy](https://agentwranglers.se/playbook/website/privacy)