Global Privacy Control: Does Your Site Actually Honour the Signal?

Global Privacy Control, GPC, is a browser setting that sends a simple signal with every request: this person does not want their data sold or shared. It is not a cookie preference or a banner choice. It is a machine-readable opt-out, set once in the browser, that follows the person to every site they visit.

California's privacy rules treat GPC as a valid opt-out of sale and sharing. The California Consumer Privacy Act, as amended by the CPRA, requires businesses to honour opt-out preference signals, and GPC is the signal the rules name. A site that ignores it is not making a design choice. It is failing a legal obligation, in a state with an active regulator.

What the signal is

Honouring GPC means stopping the sale and sharing of that visitor's data: no sale to data brokers, no sharing for cross-context behavioural advertising, no passing identifiers to advertising partners. It does not mean showing the banner and asking the visitor to confirm. The signal is the answer. The banner is redundant for that visitor.

That is the part most sites get wrong. They detect the signal, show the banner anyway, and treat the banner click as the decision. A visitor who set GPC has already decided, in their browser, once, for every site. Asking them to decide again is not thoroughness. It is ignoring the signal and hoping they get tired.

What honouring it means in practice

Turn GPC on in your browser, clear your cookies, and load your own site. Watch what happens: does the banner appear, do the advertising pixels fire, do the data broker calls go out? Open the network tab and look for the requests that should not be there. If the pixels fire before any banner interaction, the signal is not being honoured, whatever the privacy policy says.

Then check the record. A GPC opt-out needs the same record as any other: when it arrived, what it covered, and what changed because of it. A site that honours the signal but records nothing cannot prove it honoured anything, and proof is the part an audit asks for.

How to test it in ten minutes

Sephora settled with the California Attorney General in August 2022 for 1.2 million dollars, in a case that included failing to process opt-out requests, including GPC signals. The amount is less important than the fact: a major retailer, a public settlement, and a signal that was ignored. The enforcement is real, and it has already happened.

Keep reading: Third-party scripts that set cookies before consent: the tag audit, Consent renewal after a redesign: when the banner must come back.

The banner is not the answer

The fix is not a bigger banner. It is a check at the front door: if the GPC signal is present, apply the opt-out before anything else loads, record it, and do not ask again. The visitor set a preference once, in their browser, for every site. Honouring it is the cheapest compliance work a site will ever do, and it is the work most sites have not done.

Frequently asked questions

What is Global Privacy Control?

A browser setting that sends a signal with every request saying the person does not want their data sold or shared. It is a machine-readable opt-out, set once in the browser, that follows the person to every site they visit.

Does California law require sites to honour GPC?

Yes. The CCPA, as amended by the CPRA, requires businesses to honour opt-out preference signals, and GPC is the signal the rules name. Ignoring it is failing a legal obligation, not making a design choice.

What does honouring GPC mean in practice?

Stopping the sale and sharing of that visitor's data: no sale to data brokers, no sharing for cross-context behavioural advertising, no identifiers to advertising partners. The signal is the answer, so the banner is redundant for that visitor.

How do I test whether my site honours GPC?

Turn GPC on, clear cookies, and load your site. Check whether the banner appears and whether advertising pixels fire before any banner interaction. If pixels fire, the signal is not being honoured, whatever the privacy policy says.