We make responses to privacy choices transparent and verifiable for everyone.
Today twelve US states require businesses to honor signals, such as the Global Privacy Control (GPC), that tell a website not to sell or share your personal data. These signals are sent by the browser automatically on the user's behalf, and starting January 1, 2027, California will require all browsers to support GPC natively.
A website may claim to support GPC, but it is difficult to determine whether the website respected the opt-out and did not sell or share your personal data. GPC Inspector is a free browser extension that goes beyond what a website claims and shows you exactly what the website did after receiving the signal and what information was shared with third parties. The extension shows you:
- Whether the GPC signal was enabled and whether it was set by the browser, GPC Inspector, or another extension.
- Whether the website claimed GPC support on the page and in its
/.well-known/gpc.jsonfile. - What consent strings and APIs, such as Global Privacy Platform (GPP), US Privacy (USP), Transparency and Consent Framework (TCF) and Google Consent Mode, reported to third parties about your opt-out.
- What third-party advertising and analytics vendors did on the page: who read the signal, who set cookies anyway, and what they sent back.
- Website findings and a full log of events, available for export.
- Nothing is sent to us. Everything stays in your browser, and the code is open source.
Get it for Chrome and Brave Get it for Edge
Featured in the Chrome Web Store with thousands of active users
Why it asks to read every page
The extension has to read the page you are on to list the cookies and requests, which is what the "read and change all your data on all websites" permission means. The store listing's privacy declaration says it does not collect or use your data; that is true today, and we commit to keeping it that way. The extension changes the page in a few ways to enable GPC and determine what happened on the page:
- Sends the GPC signal by adding the
Sec-GPCheader and setsnavigator.globalPrivacyControlto match. - Determines who requested privacy signals by wrapping the relevant JavaScript calls for
navigator.globalPrivacyControl, cookies, and other privacy APIs. The values returned by those calls are unchanged.
What it cannot see
There are numerous limitations on what behavior can be observed in a browser extension. The ones that matter most:
- Requests made outside the tab: service workers, prefetches, other tabs. A vendor contacted only that way is not listed.
- Whether a vendor acted on the signal after reading it. We see what the vendor did on the page and what was sent back. There is no visibility into what happened later on the vendor's servers.
- Tags that run server-side, and vendors deployed on the website's first-party domain. These third-party integrations cannot be reliably told apart from first-party use.
Source, security, licensing
The code is open source under GPL-3.0 at github.com/gpc-inspector/gpc-inspector-extension. Security reports: SECURITY.md. Each store release is tagged in the repository so a build can be compared with the store package. The company names and categories are derived from Disconnect's list, under CC BY-NC-SA 4.0; the functional cookie names come from the Open Cookie Database, under Apache-2.0.