Global Privacy Control and Live Visitor Tools

What GPC is

GPC is a setting in a browser, or in a browser extension, that a person turns on once. After that, the browser sends the preference to every site. The official site, globalprivacycontrol.org, says it lets people communicate their privacy preference "just by browsing", and it is intended to convey a Do Not Sell or Share request under laws such as the California Consumer Privacy Act and similar state laws. Its page also describes the intent under the GDPR as a general request that data controllers limit the sale or sharing of the user's personal data.

The technical rules are in the Global Privacy Control specification, published by the W3C. In short:

Part	What it does
Sec-GPC: 1 header	Sent with HTTP requests when the setting is on
navigator.globalPrivacyControl	A property that scripts on the page can read

How a page can detect it

A script can read the browser property:

if (navigator.globalPrivacyControl) {
  // the visitor has asked not to have their data sold or shared
}

A server can read the Sec-GPC header. Check the specification above for exact details rather than relying on this summary.

What whoisbrowsing does with it

Browsers with Global Privacy Control are never shown. If a visitor's browser sends the signal, they do not appear in the owner's live view: no cursor, no side panel line, no count.

The check happens in the visitor's own browser, before anything else. When navigator.globalPrivacyControl is true, the whoisbrowsing script stops before it opens a connection, so nothing from that visit is sent at all, not even the page they are on. There is no setting to turn this off.

Together with the other privacy rules, this is the whole picture of who is never shown:

• visitors from the EU/EEA, UK and Switzerland;
• browsers with Global Privacy Control.

We do this because the signal expresses a preference and we would rather honour it than argue about it. We do not claim it is required for a tool like ours, and we do not claim it makes anyone compliant.

What you will notice as a site owner

If you test your site with a browser that has GPC turned on, you will not appear as a visitor. This confuses people. When you test:

1. Use a Chrome Incognito or Safari private window with GPC off. Your own regular browser is never counted anyway.
2. If you do not appear, check whether the browser or an extension is sending GPC.
3. Remember that visitors from the EU/EEA, UK and Switzerland are not shown either, so testing through a VPN endpoint there will show nothing.

Because GPC browsers are skipped, the live count is a lower bound, not a total. The GPC site lists the browsers and extensions that support the signal.

Check the rule yourself

You can see the exclusion work yourself. Turn GPC on in a browser or extension that supports it, open your site in a private window while you watch, and you will not appear: no cursor, no line, no change in the count. Turn GPC off, reload, and you appear as a normal visitor. It is also a simple way to show a client or a colleague that the rule is real rather than a line on a policy page.

What the browser still sends

For visitors who are shown, the rule is the same as everywhere: your visitors' browsers send the page, pointer position, clicks, scroll, device type, source, browser and operating system, and time on site. Never keystrokes, form values or page text. Nothing about your visitors is stored on our servers. No cookies on your visitors. See the privacy page and Is live visitor tracking GDPR-safe?.

When whoisbrowsing is NOT the right tool

If you need a complete count of everyone on your site regardless of their privacy settings, use an analytics product and read its own policy on GPC. A live view that skips GPC browsers will always undercount.

Related

GPC is one reason a live view can be quiet. Another is that cookieless is not consent-free. For how the product works end to end, see How it works. It is free, no credit card, and you can try it with no account.