Sec-GPC

Privacy & Consent IANA provisional reached by regulation

Global Privacy Control is a browser-set request header that carries one bit: the person on the other end does not consent to the sale or sharing of their personal information. Sec-GPC: 1 and nothing else.

What makes it exceptional is that it is not a convention. The California Attorney General and the CPPA treat GPC as a legally binding opt-out signal under the CCPA as amended by the CPRA, and Colorado and Connecticut recognise it through their universal-opt-out mechanism lists. It is, as far as I can tell, the only HTTP header in existence that a regulator has said you must honour.

It is declared by no provider in this catalog. That is partly structural — it is a request header set by a user agent, and there is nothing for an API contract to declare — but it is also a fair summary of how much attention the API layer has paid to it. The obligation attaches to the business, not to the browser, and an API that quietly ignores an inbound Sec-GPC is where the obligation goes to die.

The registry

Listed in the IANA HTTP Field Name Registry as a provisional entry — registered, but not through a standards-track document. Defined in Global Privacy Control (GPC).

In the catalog

Registered with IANA and declared by not one of the 26,641 providers in the API Evangelist catalog. A registered field with no observed use is still part of the vocabulary — it just is not part of the practice.

Reached by regulation

This header is mandated: the law, or a technical standard the law makes binding, names it directly. It is observable at the edge: an unauthenticated request is enough to see whether a provider sends it.

Using it

Read it on every inbound request that could result in personal information being sold or shared, propagate it into whatever downstream system makes that decision, and record that you did. The legal exposure is not in failing to parse the header; it is in parsing it and then not acting on it.