VaferGlobal Privacy Control is an opt-out the shopper never has to click. It is a browser-level signal — a Sec-GPC: 1 header and a navigator.globalPrivacyControl flag — that tells every site “do not sell or share my data.” In California and a growing list of US states, honouring it is not optional.
How the signal reaches your store
Shoppers enable GPC once — Firefox and Brave have it built in, Chrome gets it via extensions — and their browser then asserts it everywhere, automatically. On your storefront it is readable in one line of JavaScript, which means there is no technical excuse for missing it.
What honouring it means in practice
- Treat it as an opt-out of sale/sharing — the same effect as clicking the “Do Not Sell or Share” link, with no interaction required.
- Enforce it — on Shopify that means writing
sale_of_data: false(and sensibly, marketing consent off) to the Customer Privacy API and holding marketing trackers. - Record it — log the decision with a method of
gpc, so your audit trail shows automatic opt-outs as what they are. - Don't nag — a visitor whose browser already said no should not be interrogated by a banner asking again; a quiet way to change their mind later is enough.
Is it legally binding?
California's regulator has treated ignoring GPC as a CCPA violation since the Sephora settlement in 2022, and states including Colorado and Connecticut wrote universal opt-out signals into their laws explicitly. The direction of travel is one-way. In the EU the signal has no special legal status — GDPR's opt-in model makes it mostly redundant there — but honouring it globally costs nothing and reads as good faith.