Global Privacy Control: Is Your Banner Listening to the Signal?
Millions of browsers send a GPC signal asking to opt out of sale and sharing. Many banners ignore it while claiming compliance. How to test what your site does when the signal arrives.
A visitor arrives with Global Privacy Control switched on. Her browser sends one clear instruction, do not sell or share my personal information, in a header and a JavaScript property your site can read in milliseconds. Your banner then asks her the question she already answered, and if she dismisses it, your tags share her data anyway. That gap, between the signal sent and the site's behaviour, is now an enforcement topic, not a theoretical one.
California's regulator has treated honouring GPC as a legal requirement under the CCPA as amended, and a well known settlement with a major retailer turned on exactly a business failing to honour opt-out signals. This post explains what the signal is, how to detect what your own banner does with it, and the configuration standard to hold your consent platform to.
What the signal is and who sends it
Global Privacy Control is a technical specification, developed by privacy researchers, browser makers, and publishers, that lets a user set one preference at browser or extension level, transmitted to every site as a Sec-GPC header with the value 1 and a matching navigator.globalPrivacyControl property. Privacy focused browsers ship it on or offer it prominently, and several mainstream extensions send it, so the share of your traffic arriving with the signal is larger than the share of visitors who could describe it.
Under California law, a business must treat the signal as a valid request to opt out of sale and sharing for that browser or device. Other state laws have moved the same way, Colorado's rules recognise it as a universal opt-out mechanism, and the direction of travel is uniform: more states recognising the signal, none unrecognising it.
Testing your own banner in ten minutes
Use a browser or extension that sends the signal, clear cookies, and visit your site with the network panel open. Three observations answer the audit. Does the banner still demand an answer to a question already answered? What state does your consent tool record for this session, and do advertising and sharing tags fire before any interaction? And does the site acknowledge the opt-out anywhere the visitor can see, as good implementations do with a small notice that their signal was honoured?
The failure pattern to expect is partial: the consent platform honours GPC in its enterprise configuration but the store is on a plan or an older template where the setting is off, or the banner respects the signal while a separately installed marketing tag, added through a tag manager, never got the memo. Test the tags, not the banner's promises.
The standard to set
Signal on means: no sale or sharing for that session and device, advertising tags in their denied or limited state from the first page, no banner nagging for a contradictory answer, and a record in your consent log showing the signal as the source of the state. Put that sentence in writing to your consent vendor and test against it quarterly. It is the kind of requirement that is trivial to meet once and embarrassing to explain later.
Related reading: Consent Banners on a One Page Checkout: No Second Screen to Fix a Bad Choice, Reject Buttons That Move, Shrink, or Fade: Reading a Banner Like a Regulator, A Practical Audit Checklist for Consent Mode Signals.
Frequently asked questions
What is Global Privacy Control in plain terms?
A browser level setting that automatically tells every website not to sell or share the visitor's personal information. It arrives as an HTTP header and a JavaScript property. Instead of hunting for a do not sell link on each site, the user states the preference once.
Are we legally required to honour GPC?
In California, yes: the CCPA regulations treat GPC as a valid opt-out request that businesses must honour, and enforcement has addressed failures to do so. Colorado recognises it as a universal opt-out mechanism, and other states are following. Treat honouring it as required practice, not a courtesy.
How do I know if my consent platform honours the signal?
Test it yourself with a GPC sending browser: clear state, load the site, and check the consent record created and whether sharing related tags fire. Do not rely on the vendor's feature list, because the setting is plan and configuration dependent on several platforms and may be off in your account.
Should the banner still appear when GPC is on?
Ideally the site should not ask for a contradictory choice. A brief notice that the visitor's privacy signal was honoured is good practice. Re-presenting the full banner and recording dismissal as consent to share reverses the visitor's stated instruction and is the behaviour regulators object to.