GPC Is Not a Banner Setting: What the Global Privacy Control Signal Actually Does
Global Privacy Control is a signal the browser sends, not a setting in your banner. When a visitor arrives with GPC turned on, the site is supposed to treat that as an opt-out of sale and sharing, whether or not the visitor ever sees a banner or clicks anything. Most sites do nothing with the signal at all. The banner loads, the visitor ignores it, and the site keeps selling and sharing as if the signal never arrived. That is the gap the CPPA has been fining.
The legal basis is straightforward. California's CCPA, as amended by the CPRA, requires businesses to honor opt-out preference signals, and GPC is the signal the regulations name. The CPPA's enforcement has focused on exactly this failure: a site that collects the signal and does nothing with it. The Disney settlement, $2.75 million, turned on how opt-out choices were presented and carried through. A GPC signal that arrives and is ignored is an opt-out choice the site received and did not honor, and the record will show it.
What honoring GPC actually requires
Three things, and the banner is not one of them. First, the site has to detect the signal. GPC arrives as a Sec-GPC header and a navigator.globalPrivacyControl value in the browser, and the site has to read one of them on every page load, not just the homepage. Second, the site has to apply the opt-out to the data flows that count as sale or sharing under California law: the ad platforms, the analytics vendors, the data enrichment tools. Third, the site has to record it, with the same timestamp and scope as a banner choice, so the record shows the signal arrived and was honored.
The hard part is the second one. A GPC signal that stops the banner from showing but lets the tags keep firing is worse than ignoring the signal entirely, because the site now has a record of receiving an opt-out and a network log showing the data kept flowing. The fix is in the tag manager: GPC sets the same denied defaults as a banner rejection, before any tag fires, and the same propagation path carries it to the vendors.
The test, and the common failure
Turn GPC on in your browser, visit the site in a fresh session, and watch the network. Any request carrying an identifier to an ad or analytics vendor after the signal is a failure. Then check the consent log: the GPC opt-out should appear as a choice with a timestamp, not as an absence. The common failure is a site that honors GPC on the homepage and forgets the checkout, the app, and the server-side tags, which is the same subdomain problem that breaks banner consent, wearing a different name.
GPC is not a feature to add to the banner. It is a signal from the visitor, and the visitor has already chosen. The site's job is to listen, and to prove it listened.
Keep reading: Global Privacy Control: The Browser Signal Your Banner Cannot Ignore, The Store Locator That Pings Google Before Consent: Maps Are Trackers Too, and Testing Your Cookie Banner Without Breaking the Law: What You Can A/B Test cover the nearby cases in this series.
Frequently asked questions
What is Global Privacy Control?
It is a browser signal that tells websites the visitor opts out of the sale and sharing of their personal information. It arrives as a Sec-GPC header and a navigator.globalPrivacyControl value.
Do I have to honor GPC if I have a cookie banner?
Yes. Under California law, businesses must honor opt-out preference signals, and GPC is the signal the regulations name. The banner does not replace it.
How do I test whether my site honors GPC?
Turn GPC on in your browser, visit the site fresh, and watch the network. Any request carrying an identifier to an ad or analytics vendor after the signal is a failure.
Does GPC apply outside California?
California is where the requirement is explicit, but the signal is a real opt-out choice from a real visitor. Honoring it everywhere is simpler than geo-fencing it, and it is the defensible position.