CCPA mentioned but no /.well-known/gpc.json discovery file referenced
A /.well-known/gpc.json file is a small, standard text file that formally declares a site supports Global Privacy Control (GPC), so tools and regulators can check GPC support programmatically instead of guessing from behaviour alone. This check looks for that file when the privacy policy mentions CCPA (California Consumer Privacy Act). On this site, CCPA is mentioned, but no gpc.json discovery file was found.
Why this matters
A /.well-known/gpc.json file is a way to declare that your site supports Global Privacy Control, and it can help regulators and automated tools programmatically confirm how the site handles GPC. It is not necessarily a legal requirement in every state, so check with a privacy adviser what applies to you. Without it, you have less evidence to point to if your GPC handling is ever reviewed.
How to fix it
Your developer should publish a /.well-known/gpc.json file declaring GPC support, with a gpc field set to true and a lastUpdate field holding today's date in ISO format (YYYY-MM-DD). This is one of the fastest fixes in this whole audit, around five minutes of work for a developer who already has hosting access.
Turn website findings into an action plan
Create an account to start a Full Audit of your website, with supporting evidence and a prioritised action plan.
Start Full Audit