Skip to content

No Global Privacy Control (GPC) acknowledgement

Global Privacy Control (GPC) is a setting built into some browsers that automatically sends a signal to websites saying the user does not want their data sold or shared. Some US state privacy laws, including California's and Colorado's, require covered businesses to treat it as an opt-out request. Whether they apply to you depends on your size, the data you handle and where your visitors are.

Why this matters

If CCPA/CPRA or similar US state laws apply to you, failing to detect and act on GPC signals may be a compliance risk, and some state regulators have announced enforcement activity on GPC. Check with a privacy adviser whether these laws apply to your business.

How to fix it

Ask your developer to add server-side or JavaScript logic that checks for the GPC signal (the Sec-GPC request header or navigator.globalPrivacyControl property) and, when present, suppresses data-sharing and ad-targeting for that visitor.

Turn website findings into an action plan

Create an account to start a Full Audit of your website, with supporting evidence and a prioritised action plan.

Start Full Audit