I’m Alan Chapell. Over the past 20+ years, I’ve worked as outside privacy counsel to hundreds of digital media companies and have brought over 40 of them to successful exits. I write a monthly syndicated report called The Chapell Regulatory Insider, and I’m also a regulatory analyst for The Monopoly Report.
The latest Monopoly Report podcast! This week, I welcome James Rosewell of the Movement for an Open Web. We talk about James’ crusade to save the open web—and how I wish the rest of the adtech community were nearly as engaged in collective action.
Anyone else see a problem here?
GPC is coming to a browser near you this January
Starting in January, thanks to the California Opt-Me Out Act, all browsers will be required to support an opt-out preference signal such as the Global Privacy Control (GPC). GPC isn’t the only type of opt-out preference signal, but it is the most popular one—and it’s likely most browsers simply use the GPC spec.
As I’ve outlined here, the Global Privacy Control (GPC) is an opt-out choice tool that enables a user to indicate that they don’t want to be tracked, targeted, or profiled. Several state privacy laws require that those of us operating in the ads space respect these signals as valid opt-out requests. In some states, including California, GPC signals also stop the sale and sharing of data, as well as any ad targeting, profiling, or automated decision-making.
Accordingly, when we see the GPC signal in a digital media data flow, we need to treat the applicable user as having opted out of all of these aforementioned activities.
CalPrivacy has recently published updated draft guidance on GPC with lots of great examples, which should give you a pretty good sense of how our nation’s most active privacy regulator believes GPC should be honored.
How will the browsers support GPC?
The Opt-Me Out Act only applies in California, which I suppose opens the door to some browsers offering GPC in the U.S. only. There is some precedent, as Safari currently offers a different experience to EU users, including:
Browser choice screens
Enabling non-WebKit browser engines on iOS
A kinder-gentler version of ATT—all for the benefit of EU data subjects.
So while most of us are assuming that all browsers will support GPC globally, if a browser can find an advantage by offering GPC more locally, it would almost certainly consider it.
Will browsers enact GPC by default or use it to preference?
Of the major browsers, DuckDuckGo and Brave currently turn on GPC by default. This, despite rules in Colorado, Connecticut, and even California stating that GPC may not be the default setting. A number of us have asked CalPrivacy to clarify its position and/or to craft specific rules around how GPC may be presented—as required under California law. For better or worse, CalPrivacy has failed to do so.
My home state of Connecticut has even enacted anti-preferencing measures as part of the Connecticut Privacy Law. Anti-preferencing measures are designed to ensure that browsers don’t use privacy signals to advantage their own advertising offerings. But I’m not sure the Connecticut or Colorado laws provide sufficient headwinds to prevent browser shenanigans.
It sure would be helpful for CalPrivacy to “ensure that the manufacturer of a platform or browser or device that sends the opt-out preference signal cannot unfairly disadvantage another business.” It’s right there in the statute. But again: It has not. Perhaps as part of the next draft guidance?
All that said, here’s how I think the major browsers will enact GPC over the next 18-24 months. Keep in mind, some browsers restrict cookies and have “anti-fingerprinting” measures in place, which would seemingly render their GPC policies as somewhat moot.
Edge: Way back in the day, Microsoft opted to turn on Do Not Track by default and almost single-handedly blew up the whole DNT initiative. And that was long before it bought Xandr. Anyway, MSFT will keep GPC off by default.
Mozilla: It will also keep GPC off by default; it’s in Mozilla’s ethos.
Safari: My sense is that Apple won’t turn on GPC initially, but I don’t have much confidence in that prediction. And in any event, who cares about opt-outs when most players in the ads space are just trying to figure out whether their tech will be blocked by Safari?
Chrome: I continue to believe that we haven’t heard the last from Google on third-party cookie deprecation. But I’ll also note that two different Googlers have recently pinky-sworn me that TPC deprecation is no longer on the roadmap. Anyway, Google isn’t turning GPC on by default in 2027.
Here’s what I like about GPC
The browser ads space has a privacy choice problem. It’s not new; it dates back over two decades. But also, it’s gotten progressively worse over time.
Cookies are a crappy way to record opt-outs. While the browser and anti-virus communities have certainly done the adtech community no favors (i.e., by treating all cookies as a security exploit), the idea that we’ve built an industry on the promise of choices that we know for a fact persist for a relatively short time is a huge problem. Maybe this wasn’t such a big deal when our collective ability to persist our targeting capabilities was equally poor. But today? Please.
Given today’s regulatory environment, I’d be careful about going all-in on an opt-out page that either doesn’t work at all or that generally persists for fewer than 30 days.
GPC provides an alternative choice tool that is both easy to use and persistent.
Here’s why GPC makes me nervous
I made this point during my recent talk at the Prebid Summit. One of the reasons I’m bearish about the efficacy of the Google adtech antitrust remedies is that they (sort of) address yesterday’s issue of auction manipulation. Tomorrow’s issue will much more likely involve addressability manipulation.
In short, I worry that GPC gives the browsers a free pass to manipulate addressability.
If there’s an area that you want to see covered on these pages, if you agree or disagree with something I’ve written, if you want to tell me you dig my music, or if you just want to yell at me, please reach out to me on LinkedIn or in the comments below.
Will you be at CES 2027? Join us for Hot Takes & Happy Hours.
This January, Marketecture is bringing a little throwback Vegas magic to CES, with a retro revival built for Ad Tech’s biggest week.
If you’ll be in Vegas the first week of January, we’d love to have you bring your perspective to Marketecture’s Fabulous Hot Takes, our series of quick-hit interviews with the people driving the industry forward.
Then keep the conversation going at AdTechGod® Retro Revival, an evening of cocktails, connections, and old-school Vegas glamour.
Ready to make your mark?
Celebrate old Vegas and new legends with us.
Marketecture Live IV Speakers and Early Bird Pricing are LIVE 👀
The room every marketer wants to be in is returning to New York City and now, we have our first look at who will be driving the conversations on stage this spring.
On March 9-10, 2027, Marketecture Live will be back at The Glasshouse NYC for a two-day event that will convene leading executives across brands, agencies, publishers, and adtech.
Wondering what the hype is all about? Marketecture Live takes a different approach: expertise first, no panels, no filler, no fluff. Across more than 40 sessions and breakouts, every conversation is designed to be sharp, relevant, and worth your time.
The event has consistently sold out, so don’t wait to lock in your ticket at the best price you’ll find.
Get to know our speakers and register today.
We're hiring for two (2) full-time roles to help us make an even bigger impact across the advertising ecosystem.
Know someone great? Send them our way! Think that's you? Check our Careers page and apply. We'd love to hear from you!
