Sec GPC

Experimental: This is an experimental technology
Check the Browser compatibility table carefully before using this in production.

The HTTP Sec-GPC request header is part of the Global Privacy Control (GPC) mechanism to indicate whether the user consents to a website or service selling or sharing their personal information with third parties.

The specification does not specify how the user can withdraw or grant consent for the website.

Note: The exact methods for users to control their consent are yet to be standardized, and it is advisable to check the latest guidelines for implementing user privacy controls.

Syntax

Sec-GPC:

Directives

A value of 1 means the user has indicated that they prefer their information not be shared with, or sold to, third parties. Otherwise, the header is not sent, which indicates that either the user has not made a decision or the user is okay with their information being shared with or sold to third parties.

Examples

The user’s Global Privacy Control (GPC) preference can be accessed in JavaScript through the properties Navigator.globalPrivacyControl or WorkerNavigator.globalPrivacyControl. These values indicate whether the user has enabled GPC, with possible values being “false” or “true”.

Note: The GPC preference is a browser setting that communicates a user’s desire for privacy regarding online tracking and data sharing. Developers can use this information to respect user privacy choices.

How to Modify Header using Requestly

Requestly is a handy Chrome extension that lets you change HTTP headers, including the Sec-GPC header. Modifying this header helps you check how your website or app reacts to different privacy signals sent by browsers. Steps to Modify the Sec-GPC Header:

1. Install and open the Requestly Chrome extension. You can find it on the Chrome Web Store.
2. Create a new rule: Click on “Create Rule” and choose “Modify Headers” from the list of available rule types.
3. Add a new header modification:
   • Under “Action”, select “Add” or “Override”.
   • In the “Header Name” field, enter Sec-GPC.
   • In the “Header Value” field, enter your desired value (e.g., 1 to indicate “Global Privacy Control” is enabled).
4. Set the URL condition: Specify the URL or pattern where this header change should apply (e.g., https://your-website.com/\*).
5. Save the rule.

After setting this up, Requestly will insert the Sec-GPC: 1 header into all matching requests, helping you test how your site respects users’ privacy preferences and manages tracking signals.