iOS 27.3 Has a 'Don't Sell My Data' Switch. Will Websites Respect It?

Every website I've worked on in the last few years had the same meeting at some point. Someone asks, "Do we need the cookie banner?" Someone else says, "Legal says yes." Then we spend a week making a popup that every visitor closes as fast as they can.

So when I read that Apple is adding a setting that could make those popups pointless, I paid attention. Then I read the word "eventually" in the headline.

What Apple is adding

9to5Mac reported on November 11 that the iOS 27.3 beta has a new toggle: Settings > Apps > Safari > Advanced > Use Global Privacy Control.

Apple's description is short. With it on, Safari asks websites not to sell or share your data. Apple also adds a warning that this "may cause some websites to not function properly or work at all." The support page linked in the beta isn't live yet, so expect more detail when the update ships to everyone.

Global Privacy Control (GPC) isn't an Apple invention. It's an open signal that some privacy-focused browsers and extensions already send. What's new is that it's coming to Safari on the iPhone, a browser a huge number of people use without ever thinking about it.

The mailbox sticker

Here's how I'd explain it to someone who doesn't write code.

GPC is a "No junk mail" sticker on your mailbox. You put it up once and every mail carrier can see it. That's much better than running out to the street fifty times a day to tell each carrier no.

But a sticker is only a request. A carrier who ignores it can keep stuffing your mailbox. In some places the law says carriers must respect the sticker. In most places it doesn't.

That's GPC today. According to 9to5Mac, the signal has legal backing in only a handful of US states, and most websites haven't added support. Nick Heer of Pixel Envy, quoted in the same article, called it "effectively a replacement for Do Not Track with legal muscle." If you remember Do Not Track, you know why that comparison is both hopeful and a little worrying. DNT was a sticker with no law behind it, and the industry ignored it until it faded away.

Why the popups won't disappear next week

Cookie banners, especially in Europe, exist because sites need to ask for consent before tracking you. As far as I know, a GPC signal isn't yet treated as a full answer to that question under EU rules. So a European site might still show you the banner even with the switch on.

And in places where honoring GPC is optional, many ad-funded sites have every reason to keep ignoring it. Nobody turns down free data out of goodwill.

My take is that this is still a real step. Do Not Track failed because nobody had to respect it. GPC already has some laws behind it, and now it will be one tap away for iPhone users. Each of those makes the next one more likely.

What I'd do as a regular user

When 27.3 reaches your phone, turn it on and see what happens. If a site you rely on breaks, you can switch it off in five seconds. I expect most of the internet won't notice either way, and that's the sad part.

What I'd do as a developer or site owner

This is the practical part, and it's smaller than it sounds:

• Browsers with GPC on send an HTTP header: Sec-GPC: 1.
• In JavaScript you can read navigator.globalPrivacyControl, which is true when the signal is on.
• If your site already has a "Do not sell or share my info" opt-out, treat a GPC signal as that opt-out being clicked. Don't fire the ad and marketing pixels that sell or share data, and remember the choice.
• Test it in a browser that already supports GPC, and in Safari once 27.3 is out.

For most small products I've seen, this is an afternoon of work. You also get an honest line for your privacy page: "We respect your browser's privacy signal." For a new product trying to look trustworthy, that line is worth more than another badge in the footer.

The other side is real too. If your business runs on ad revenue, honoring GPC costs you money, and I won't pretend that's nothing. I've been on the side of the table where the ad revenue pays the salaries. Still, I'd rather choose this now than have a regulator choose it for me later.

The question

I'm curious where people land on this. If your iPhone offered the switch tomorrow, would you turn it on, even knowing a few sites might act strangely? Why?