Do Ad Blockers Send the GPC Signal?

Checking what your browser sent when you loaded this page

An ad blocker is built to stop tracking. There is a signal that stops tracking by law in twelve states. It costs one line of code to send, and almost no ad blocker sends it.

Ad blockers are not using the one signal the law enforces for do not track

Here is what the largest ad blockers in the Chrome Web Store look like today, and whether they send GPC.

Extension	Users	Sends GPC
AdBlock	59M	No
Adblock Plus	37M	No
uBlock Origin Lite	17M	No
AdGuard	16M	No
DuckDuckGo	3M	Yes
Ghostery	2M	No
Privacy Badger	1M	Yes

Add that up and about 3% of these installs send the signal. The other 97% send nothing.

The exact numbers are not the point, and I cannot speak to their accuracy. They are rounded figures straight off the store listings. The ratio is the point, and 3% is pitiful. The tools that do send it are the small, privacy-specific ones, and the official list of GPC implementers reflects that: Brave, DuckDuckGo, Firefox, Privacy Badger, Disconnect, OptMeowt, Abine. Not one mainstream ad blocker is on it.

So the tools with the largest privacy-minded install base on the internet are not using the one privacy mechanism that carries actual legal weight.

Can a Chrome extension even send GPC?

If Chrome extensions cannot send the GPC signal, the conversation stops here. So can they send it?

The GPC signal is a header, and yes, they can send it. An extension on Manifest V2 can rewrite request headers through the webRequest API. An extension on Manifest V3 can do it through declarativeNetRequest, which is a more restricted API but explicitly supports adding headers to requests. This is not theoretical. uBlock Origin Lite already ships the ability to send Sec-GPC, and it is often described as roughly the only capability where Lite exceeds classic uBlock Origin.

For the JavaScript property, it is harder. Setting navigator.globalPrivacyControl means injecting a script into the page before anything else reads it. Mozilla decided to expose the property as read-only, which makes it awkward for extensions to set at all. Manifest V3’s Lite model does not inject page scripts. And as we covered in the last article, an injected value can land after your tags have already looked, which is its own mess.

The main signal is the header. The JavaScript variable is a record that it was sent. It exists so code running inside the page can see what the header already did on the way in, which is why the spec defines its value entirely in terms of whether a Sec-GPC header would be sent. We covered how that works in detail in the GPC explainer.

So a blocker that sends only the header has not shipped a partial feature. It has created a legally binding opt-out on every request that leaves the browser, and the receiving server sees it whether or not any script in the page ever does. The missing JavaScript value costs you visibility for tags running inside the page. It does not cost you the opt-out.

What one prominent ad blocker developer thought of the issue

uBlock Origin is an interesting case to look at, because its author explained his reasoning in public, and the reasoning is thoughtful.

In November 2021, asked whether uBO would send GPC by default, Raymond Hill gave two arguments. The first was about defaults:

in my opinion it’s no different than DNT header, which I never saw as a good approach, sites should assume no tracking/data mining is wanted by default, and a header should be sent to whoever wants to be tracked/data mined, i.e. this should be opt-in.

The second was about verification:

Just like DNT header, there is no way for users to find out whether a site respects GPC or not, so safest assumption is that it’s not respected, just like DNT was not.

Both of those are thoughtful positions. The first is a principled objection to the whole shape of opt-out privacy, and he is right that asking people to opt out of surveillance is a worse world than not being surveilled by default. That is the ideal case and it makes sense as one.

It is not the world we live in, though, and we have to deal with the world we live in. Every US state privacy law is built the other way around, with tracking legal until the person says stop. Declining to send an opt-out because the law should not have required one does not change the law. It just means the people running the blocker never say stop.

The second argument is the DNT lesson, learned the hard way by everyone who watched that standard get ignored for a decade.

In the same thread, a member of the uBO team pushed back on the claim that GPC was legally binding, and quoted the GPC FAQ to do it:

GPC on its own does not create any legally binding obligations.

They were correct. In November 2021, that sentence was accurate.

GPC has become legally binding

What made the arguments above correct previously is now changing.

The verification argument said there is no way to know whether a site respects GPC. There is now, and it comes with dollar figures attached. California’s first CCPA enforcement action, the $1.2M Sephora settlement, cited GPC signals that had no effect on the site. The California Privacy Protection Agency’s first settlement, $632,500 from Honda, ordered the company to honor GPC as part of the fix. California’s regulations now require businesses to visibly confirm that they processed the signal, which is a verification mechanism written directly into law.

The legally binding argument was true and is no longer. Twelve states now require businesses to honor GPC as an opt-out of sale: California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, and Texas. A site that receives the signal has to treat it the same as a click on its Do Not Sell or Share My Personal Information link.

And the “leave this to the browser” argument is about to be overtaken. California’s AB 566 requires every browser shipped to Californians to include an opt-out signal setting by January 1, 2027, and requires it to be easy for a reasonable person to find. The browsers are being compelled to do the thing extensions were told to leave to them.

The DNT comparison is the part that deserves the most revisiting, because the comparison is exactly backwards now. DNT failed for one reason: no law stood behind it, so ignoring it cost nothing. GPC is the same idea with the missing piece supplied. Treating them as equivalent made sense when both were unenforceable. It stops making sense once one of them carries fines.

We could not find any public reassessment of that position since 2021.

Blocking is a technical fight. GPC is a legal one.

Here is the part which should interest anybody using or building an ad blocker.

There is no law that requires a site to respect your ad blocker. Blocking is a technical measure, and the response to a technical measure is a technical countermeasure. Sites reshuffle domains, move tracking server side, serve first party endpoints, and rotate paths. Filter lists chase them. It is a real arms race, blockers are good at it, and it is also a race you can lose quietly without your users ever knowing.

GPC changes what kind of fight it is. There are now state laws that require a site to respect the signal. Once it arrives, working around it is not clever engineering, and it is not something a SaaS company can build a product around. It is a legal violation. Sephora did not get fined for failing to block a signal. They got fined because the signal arrived and nothing happened.

I can tell you from working in this industry, on both the client side and the SaaS side, that it is rare for a signals engineer to try to break a law once that law is on the books. The vast majority of engineering teams follow the law to the best of their ability. Outsmarting an ad blocker is a game. Outsmarting the GPC signal is a legal violation you will eventually get sued for.

Put these two things together: the ad blocker stops what it can reach, and the GPC signal comes in over the top and takes out anything else. A tracker that evades your filter list still receives a header that makes using the data unlawful in twelve states.

Instead of trying to get around your ad blocker, the site has to stop tracking you. That is a much better outcome than winning the next round of the filter list war.

There is no downside to an ad blocker sending the GPC signal

The objection is that sites will ignore the Global Privacy Control signal and keep going. That treats this as a bet that can be lost. It cannot.

Sending the header costs nothing and removes nothing. The blocker keeps doing every single thing it already does. Filter lists still run, requests still get blocked, nothing is traded away. You are adding a line to requests the extension is already intercepting. There is no scenario where a user ends up worse off because their browser also mentioned that they do not consent to having their data sold.

The reasoning also assumes the outcome is binary, and blocking has never worked that way. No filter list catches everything. Trackers move, and some always get through, and nobody concludes from this that ad blockers are pointless. The standard applied to GPC should be the same standard applied to blocking: does it reduce the amount of tracking happening on this person’s machine? If it does, ship it.

It does. Plenty of sites honor the signal today, and the number keeps climbing, because the compliance tooling now does it automatically. A site running a properly configured consent platform reads GPC and applies the opt-out without anyone at that company thinking about it. It has become the default configuration rather than an advanced feature.

Then there is the part that should be most interesting to a blocker author. The trackers that beat your filter list are precisely the ones GPC still reaches. A tracker that moved server side, rotated its domain, or hid behind a first party endpoint has defeated the blocking, and it has not defeated the header, because the header went out with the request anyway and using that data is now unlawful in twelve states. The one category of tracking your product cannot stop is the category the signal covers.

So the question is not whether every site will honor it. The question is whether some will, at no cost, on top of everything the blocker already does. The answer is obviously yes.

The objections to ad blockers sending GPC

It is another fingerprinting bit. This came up in the original thread and it is the strongest technical objection. An extra bit does help someone fingerprint you, and it is fair to say so.

What matters is weighing the two sides at the scale they actually happen at. The signal reaches every site the person visits, and in twelve states every one of those sites is legally required to stop selling and sharing their data. Set against that, you have the rarer case of a site running fingerprinting, which picks up one more bit, and which is still legally required not to track that person anyway. A better fingerprint held by someone who is barred from acting on it does not weigh much against opting out everywhere at once.

Sites will ignore it. Some will, and it still costs nothing to send, as above. The ones that ignore it are also taking a real risk now. Sephora ignored it and paid $1.2M. Honda ignored it and paid $632,500. Ignoring it is a thing that shows up on a regulator’s desk, which is a different situation from DNT, where ignoring it showed up nowhere.

Regulators are not the only exposure either. California’s CIPA wiretap law carries a private right of action, and it has already produced thousands of lawsuits and demand letters over ordinary tracking technology. Having received a signal that explicitly said do not track me, and having tracked anyway, is not a fact you want to explain to that kind of plaintiff.

Sending it by default is not a real user choice. This is the serious legal question, and it has an answer. Colorado’s rules say a default baked into pre-installed software does not express intent, but deliberately installing a tool that is marketed as exercising your opt-out rights absolutely does. Nobody gets an ad blocker by accident. Installing one is exactly the affirmative choice the regulation describes.

It is not our job. It is exactly the job. An ad blocker exists to stop people being tracked on the internet. GPC does that, with the law behind it, and it does it in the places blocking cannot reach. Sending the signal is not a detour from the product, it is the product working through a second channel.

What an ad blocker sending GPC would actually unlock

Turning GPC on in a browser today is not something a normal person does. In Chrome it sits behind an experimental flag. In Firefox it exists but is tucked away where nobody finds it. The signal has been legally meaningful for years and its distribution has been terrible.

Ad blockers are the widest privacy distribution channel that exists. They are already installed. Their users have already made an explicit choice not to be tracked. Adding a header to requests those extensions are already intercepting is close to free.

Do that, and something like a hundred million people become legally opted out across twelve states, on every site they visit, without changing a single habit. No settings hunt, no per-site footer links, no cookie banner roulette.

There is no other lever in privacy right now with that ratio of effort to effect.

FAQ