How to Turn On Firefox’s ‘Tell Websites Not to Sell or Share My Data’ Option

Firefox hides the data-sharing opt-out checkbox under Privacy & Security > Additional protections, not inside the Enhanced Tracking Protection block. Readers scroll right past it and assume the option has gone missing.

Here is where the checkbox sits, how to switch it on from Settings or about:config, what to check when the row is greyed out or absent, and how to confirm the Sec-GPC header is really leaving the browser.

In this guide, I have covered:

What Firefox’s Global Privacy Control Signal Actually Does

You ticked the box, or you are still hunting for it, and you want to know what it actually changes. Firefox adds a Sec-GPC: 1 header to every page request you make in a normal window.

Participating sites read that header as an opt-out from the sale or sharing of your personal information under laws such as California’s CCPA/CPRA. It is a request, not an enforcement, so what a given site does with it varies.

One quirk catches people out. Firefox sends GPC inside Private Browsing windows whether or not the box is ticked. The Settings toggle only governs regular windows, so a quick test in a private window can make a broken setup look perfectly fine.

If you keep expecting the option inside the Enhanced Tracking Protection block, you will not find it there. It sits one section lower, under Additional protections.

Enable “Tell Websites Not to Sell or Share My Data” in Firefox Settings

You want the supported way in: no about:config, no guesswork, and a setting that survives updates. It takes about half a minute.

1. Click the menu in the top-right corner of Firefox and choose Settings. On macOS, open the Firefox menu and pick Settings instead, or type about:preferences in the address bar and press Enter.
2. Select Privacy & Security in the left sidebar.
3. Scroll past the Enhanced Tracking Protection block to Additional protections.
4. Tick the box next to Tell websites not to sell or share my data.
5. Close the tab. Firefox saves the preference itself and starts sending the header on your next page load.

You’ll know it worked when the checkbox stays ticked after you close and reopen Settings. If it flips back on its own, something is overriding it, and the next section covers the usual suspects.

Turn It On via about:config

Sometimes the checkbox is missing, locked, or greyed out. The preference behind it still works, and about:config is where you reach it.

1. Type about:config into the address bar and press Enter.
2. Click the Accept the Risk and Continue button on the warning page.
3. Search for privacy.globalprivacycontrol.
4. Click the toggle button at the right edge of the row so the preference reads true.

This flips the same internal state as the Settings checkbox, so you get the same Sec-GPC: 1 header. Mozilla’s about:config support page explains what the editor does and how to undo a change you regret.

Why the Option Might Not Show Up

You have scrolled Privacy & Security twice and the row is still not there. Work through these four causes in order. The first one fixes it for most people.

You are looking in the wrong place

The toggle is not inside the Enhanced Tracking Protection picker (Standard, Strict, Custom) and not inside Cookies and Site Data. It has its own row inside Additional protections, directly below the tracking-protection block on the same page. Scroll the page instead of scanning the top of it.

An enterprise policy is overriding the setting

IT-managed Firefox installs can pin the setting through a policies.json entry that uses the EnableGlobalPrivacyControl key. When that policy is active, the checkbox either disappears or locks to the administrator’s value. Check the policies.json file in your Firefox install directory, or ask your IT team, before blaming the browser.

Other settings on a managed machine often grey out the same way. Our walkthrough for the greyed-out Report Broken Site option in Firefox covers that pattern.

A content blocker is stripping the header

Extensions such as uBlock Origin, Privacy Badger, or NoScript can rewrite or strip the Sec-GPC header before it leaves the browser. The checkbox stays ticked and the site never sees a thing. Open about:addons, disable your extensions for a moment, reload the page, and check again.

Your Firefox build is out of date

Firefox releases that shipped before the GPC checkbox reached general availability do not have the row at all. Open the Help menu, choose About Firefox, and let the browser update. After the restart, go back to Settings and see whether the section has appeared.

Confirm Firefox Is Actually Sending the Header

A ticked box is not proof. You want to see the header leave the browser, and Developer Tools is the quickest place to look.

1. Open a normal window, not a private one.
2. Press F12, or Cmd+Opt+I on macOS, to open Developer Tools.
3. Switch to the Network tab.
4. Reload the page you want to test.
5. Click any request row and open the Headers sub-tab.
6. Scroll to Request Headers and look for Sec-GPC: 1.

If the line is there, Firefox is signaling GPC correctly. If it is missing, either the box is off, a policy is blocking it, or an extension stripped it. Walk back through the troubleshooting above.

TIP: The same DevTools screen also confirms whether your other privacy headers (DNT, Referer policy, and so on) leave Firefox. One place to rule out extension interference for every browser signal at once.

When Sites Honor Opt-Out Even With the Setting Off

Here is a result that confuses people: a site honors your opt-out while your Firefox setting is still unchecked. That is not a bug, and it does not mean the toggle failed.

• The site operates in a jurisdiction that requires a default opt-out (CCPA/CPRA and similar state laws) and applies it to every visitor.
• The site still reads the older Do Not Track header and complies with either signal.
• Its own preference center defaults everyone to opt-out until they choose otherwise.

Spotting a working “Do Not Sell or Share My Personal Information” link while your box is unchecked usually means the site is doing the right thing on its own. A setting that looks broken is often just a site obeying the law.

RELATED: Clear Browser Cookies and Cache from the Mozilla Firefox