GPC
Global Privacy Control — a browser signal to opt out of sale/sharing of personal data, not automatically “stop all email.”
Say it out loud
“A browser signal about selling and sharing data. It is not an unsubscribe, and treating it as one is its own mistake.”
GPC is a signal a browser sends on every request. In California and Colorado it must be honoured as an opt-out of sale and sharing, and of certain targeted advertising. It is not an email unsubscribe unless your own policy maps it to one, and inventing a legal ban the statute does not write is as wrong as ignoring the signal.
One header, on every request from that browser. That is the whole mechanism.
Where you declare that you honour it. A JSON file, two fields.
It arrives at your website, not at your email platform. Nothing in Klaviyo will ever show you a GPC signal — the wiring between the two is yours to build.
Yours
Nobody does this for you.
What goes wrong
Two opposite failures, and teams manage both. Ignoring the signal entirely because it never appears in the email tool; or suppressing the person from all email, which is not what the statute asks for and quietly destroys a legitimate subscriber.
The dated rules behind this
A definition is not a citation. These are the pages with the primary source, the date it was published, and what to do about it.
See also
Where this sits
Stop 1, you get the address. Someone hands you an email address, and the terms of that handover decide everything after it.