Global Privacy Control on a Small Site: Honouring the Signal Without a Legal Department
Global Privacy Control is a browser or extension setting that sends a signal, on every request, saying the visitor opts out of the sale or sharing of their personal information. It sounds abstract until a state regulator treats it as legally binding, which California does: the signal counts as an opt out request that businesses must honour, and an enforcement action has already been built on a company ignoring it. For a small site, the good news is that honouring it is mostly a configuration exercise. The bad news is that most small sites have never checked whether they do.
The signal arrives as a header and a browser property, Sec-GPC with a value of 1, and navigator.globalPrivacyControl on the client side. Whether anything on your site reads it is a separate question from whether your visitors are sending it, and the gap between those two is the whole issue.
What honouring it actually requires
When the signal is present, the visitor must be treated as having opted out of sale and sharing: no disclosing their identifiers to ad and analytics third parties in the ways those regimes define as sale or sharing, and no asking them to opt out again through a form as a condition of respecting it. A site that shows a Do Not Sell page while its tag manager ignores the signal has built the paperwork and skipped the behaviour.
In practice for a small site this lands in the consent tool. Most maintained consent platforms can read GPC and set the visitor's state to opted out for the relevant purposes automatically, often with a setting that needs switching on rather than assuming it. If yours cannot, the fallback is at the tag level: suppress the advertising and sharing tags when the signal is present. Either way, the test is behavioural, not documentary. Load the site with the signal on and watch what fires.
Do not build a banner argument out of it
Two mistakes recur. The first is treating GPC as satisfied by displaying the cookie banner and letting the visitor click, which reintroduces exactly the friction the signal exists to remove. The second is the opposite overreach: treating the signal as a blanket rejection of everything, including strictly necessary processing and any analytics your jurisdiction does not count as sale or sharing. The signal has a defined scope. Stay inside it in both directions and you are defensible. Improvise beyond it and you are either non compliant or needlessly blind.
Also keep the human door open. A visitor who opted out by signal can still make a different choice directly with you where the law allows it, and your privacy page should explain the signal, that you honour it, and what it covers, in sentences a normal person can finish. Regulators read that page. So, increasingly, do enterprise customers doing vendor reviews of very small companies.
A one hour implementation check
Turn the signal on in a browser that supports it or an extension that sends it, load your key pages in a clean profile, and record which third party requests still fire. Compare with the signal off. Then read your consent tool's documentation for its GPC setting rather than assuming the default, because defaults in this corner have historically been off, quiet, and discovered during someone else's audit.
Write down what you found and what you changed, dated. For a small site, that one page of notes is most of what good faith looks like in this area: you checked, you configured, you tested behaviour instead of trusting a settings page. It will not settle every question a regulator could ask. It settles the first one, which is whether you were paying attention at all.
Related reading: Consent for WordPress Contact Forms: The Checkbox Is Not the Whole Job, What a Useful Consent Record Contains, and What It Omits, WordPress Consent on Donation Forms: Trackers Fire Before the Gift.
Frequently asked questions
What is Global Privacy Control?
A browser level signal, sent as the Sec-GPC header, by which a visitor opts out of the sale or sharing of their personal information across sites. In California it is legally binding as an opt out request that must be honoured.
How do I know if my site honours the GPC signal?
Test behaviour, not settings. Load your key pages in a clean profile with the signal enabled and watch third party requests. If advertising and sharing tags still fire as if no opt out existed, the signal is being ignored.
Does my consent banner satisfy GPC on its own?
No. The point of the signal is that the opt out arrives without the visitor having to click anything. The consent tool usually needs its GPC handling enabled so the signal sets the visitor's state automatically.
Does GPC block all cookies and analytics?
No. Its scope is sale and sharing of personal information as defined by the applicable state laws. Strictly necessary processing is outside it. Honour the defined scope rather than treating it as a reject everything switch.