Safari in the iOS 27.3 beta has a new Global Privacy Control setting that asks websites not to sell or share your data. The setting is off by default, and most websites do not honor the signal yet.
9to5Mac spotted the new setting in Safari’s Advanced tab. Apple warns that some websites may not work properly with it turned on. iOS 27.3 is expected in December, and the same beta also added Safari vertical tabs and an Adaptive Dark Mode.
Global Privacy Control sits in Advanced
To turn it on, open Settings, tap Apps, choose Safari and scroll to Advanced. The toggle is called Use Global Privacy Control, and Apple describes it as a way for Safari to ask websites not to sell or share your data. You have to switch it on yourself.
Once it is on, Safari sends the Sec-GPC: 1 request header and turns on the navigator.globalPrivacyControl property, which are the two ways a website can read your choice. Apps that load web pages get a matching control too, since iOS 27 added a WebKit setting for apps that stays off unless the app turns it on. When an app does turn it on, the signal covers the main page, its embedded frames and the resources they load.
Most sites do not honor it yet
The signal is only a request, so it helps only on websites that choose to respect it. Some sites have added support, but most have not, which means you will still see cookie banners on many pages. Unlike Safari fingerprinting protection, which Safari applies on its own, this setting depends on the website cooperating.
Third parties ignored the old Do Not Track header, but Global Privacy Control is meant to carry legal force. It is also a work item at the W3C Privacy Working Group, where it is being standardized. Websites can publish an optional file at /.well-known/gpc.json that says whether they honor the signal.
Global Privacy Control already carries legal weight in five US states, and California requires businesses to treat it as a do-not-sell request under the California Consumer Privacy Act. Starting January 1, 2027, a California law known as AB 566 also requires browsers operating in the state to include a setting that sends an opt-out signal like this one.
Safari joins Firefox, Brave and the DuckDuckGo browser, which already support the signal. Brave and DuckDuckGo turn it on by default, while Firefox offers it as a setting.
