How to Verify Global Privacy Control Is Honoured at Runtime

A banner that says “GPC detected” is a UI claim. Honouring Global Privacy Control (GPC) is what still fires — and what stays gated — on a navigation that carried Sec-GPC: 1. This is a practitioner test protocol for that difference. It is not legal advice.

For early header reads, tag gates and account scope on the server, see Honouring Global Privacy Control in a Self-Hosted CMP. The protocol below asks whether the live site behaves like it.

What “honoured at runtime” means in this test

In this protocol, “honoured” is an observable outcome on one URL, under two clean browser profiles:

1. You proved the user agent sent Sec-GPC: 1 on the document request.
2. You compared cookies, storage, and third-party / marketing requests with GPC off versus GPC on.
3. Sale/share-related tags and identifiers that appear under GPC-off stay absent, blocked, or clearly redacted under GPC-on — without a manual Reject or Do Not Sell click.

The W3C GPC specification defines the signal, not your pass criteria. Under California’s CCPA framework, an opt-out preference signal (OOPS) such as GPC is a request to stop selling and sharing personal information associated with the browser or device, linked profiles and — if known — the consumer (CPPA OOPS guidance). A front-end Network pass does not prove account-wide application. Colorado has required controllers to honour GPC as a Universal Opt-Out Mechanism since 1 July 2024, and GPC is currently the only UOOM the Colorado Attorney General recognises (Colorado Department of Law).

Preconditions: prove the signal reached the page

Do not start the cookie or Network diff until the signal was present on the “GPC-on” run.

1. Open a clean profile (no prior cookies for the site under test).
2. Enable GPC in a supporting browser or extension (globalprivacycontrol.org lists current options).
3. Navigate to the URL under test.
4. DevTools → Network → document request → Request Headers. Confirm Sec-GPC: 1.

Per the W3C field definition, the field-value is exactly the numeric character 1. If your “GPC-on” capture lacks this header, stop: you tested the wrong condition.

Secondary cross-check: navigator.globalPrivacyControl === true (DOM property). The DOM property mirrors the header: the spec says “The value of globalPrivacyControl MUST be the top-level browsing context’s gpcAtNavigation” — the same boolean that decides whether Sec-GPC: 1 is sent.

Serving /.well-known/gpc.json with {"gpc": true, "lastUpdate": "YYYY-MM-DD"} is a GPC support resource. Under the spec it means the server “intends to abide by GPC requests at least to the extent it is legally obligated to do so” — the site’s declaration, not a promise to honour GPC everywhere. It is not evidence that this visitor sent the signal or that tags gated on this load.

Protocol: paired GPC-off vs GPC-on runs

Run the same URL twice. Change only the GPC preference. Keep region, viewport and login state constant. For account-scope follow-up, run a second authenticated pair.

Run A — GPC off. Clean profile; GPC disabled. Load the URL with no consent click (first paint / first idle). Capture cookies, storage keys and Network third-party hosts. Confirm there is no Sec-GPC: 1 on the document request.

Run B — GPC on. New clean profile; GPC enabled. Same URL; same no-click rule. Confirm Sec-GPC: 1 on the document request before interpreting any other surface. Capture the same surfaces. Screenshot the banner / CMP chrome.

Diff. Compare cookie names, storage keys, and third-party hosts and paths. Write one finding sentence per failure mode (example: “GPC-on still loaded connect.facebook.net with fbevents.js while both runs gained _fbp“).

What to inspect: cookies, storage, third-party requests

Cookies. Under GPC-on, look for marketing identifiers that appear under GPC-off and that your tagging map associates with sale or share — for example _fbp or _gcl_au — only if they appeared in your GPC-off baseline. Separate opt-out-recorded CMP cookies from ad-tech browser IDs.

Storage. Check localStorage and sessionStorage for keys written by tag managers, CDPs or pixel bootstraps. A gate that clears cookies but leaves IDs in storage looks clean on Cookies and dirty on the next navigation.

Third-party requests. In Network, group by host. Filter for sale/share-adjacent surfaces present in your baseline — for example Meta (facebook.com/tr, connect.facebook.net) and Google Ads (googleads.g.doubleclick.net, pagead2.googlesyndication.com). Also watch first-party paths that forward to ad platforms (server-side GTM, conversion APIs, /collect reverse proxies).

For each host in Run A, classify Run B as: absent, blocked, reduced payload, or identical. Identical sale/share fan-out under Sec-GPC: 1 is the failure mode this protocol catches.

Pass / fail patterns (observational)

Test outcomes, not legal conclusions.

Banner claims vs gated tags

Treat every CMP string (“We respect GPC”, “Opt-out preference signal applied”) as a claim. Honouring is proven only when the Network and cookie diffs move with the header.

Two failure shapes show up repeatedly:

1. Detect without gate. Client script reads navigator.globalPrivacyControl, updates banner copy, and leaves pre-loaded pixels alone.
2. Late gate. The header was available on the first request; tags in <head> already queued beacons; a consent update fires after first paint and does not retract what already left the browser.

Account scope is backend

Browser DevTools cannot finish the scope test the CPPA describes. When a consumer is logged in, the business “must apply the OOPS to all personal information associated with the consumer’s account” (OOPS guidance). The California Attorney General’s 11 February 2026 Disney settlement ($2.75 million) states the GPC allegation:

“For consumers who opted out via the Global Privacy Control (GPC), Disney limited the request to the specific device the consumer was using, even when the consumer was logged into their account.”

Run an authenticated GPC-off / GPC-on pair if the product has accounts; note whether ad cookies and pixels still bind to the logged-in session under GPC-on; and hand backend owners preference-store and partner-suppression checks (CPPA: stop selling and sharing “as soon as feasibly possible, but no later than 15 business days”). See the companion CMP article for implementation architecture.

Frictionless UI checks

The CPPA guidance sets out what “frictionless” processing of an OOPS means. To qualify, a business must not charge a fee for using an OOPS, must not change the consumer’s experience with its product or service, and must not show a notification, pop-up or interstitial in response to the OOPS. It may display the consumer’s opt-out status (OOPS PDF). With the GPC-on screenshot open, check:

1. Did GPC alone trigger a notification, modal, pop-up or interstitial?
2. Did the product experience change because the OOPS arrived (paywall, feature removal)?
3. Does the banner merely display opt-out status (allowed), rather than interrupt?

Status display without a tag gate still fails the honouring test.

What this protocol does not prove

• It does not certify CCPA, CPRA, Colorado CPA or any other regime’s compliance.
• It does not prove deletion or first-party uses outside GPC’s design: the spec says GPC is “not designed to exercise deletion rights” and is “not designed to address data collection or ad targeting within the same context” (W3C introduction).
• A single URL pass does not prove every subdomain, app WebView or CTV surface.
• EU visitors: trackers need prior opt-in consent whether or not GPC is present, and a missing Sec-GPC header is never consent. Where GPC is present, treat it at least as an objection: GDPR Art. 21(5) allows objections “by automated means using technical specifications”, and a Berlin court applied this to Do Not Track (LG Berlin, 16 O 420/19, 24 August 2023, not final). No EU regulator has ruled on GPC specifically.

Re-run after CMP upgrades, tag-map changes and server-side routing changes.

Method

Checked 1 October 2026. Signal surfaces from the W3C Global Privacy Control Editor’s Draft. OOPS scope, the 15-business-day outer bound and the frictionless criteria from the CPPA PDF What Is OOPS And How Does A Business Respond? The Disney GPC device-scope allegation and $2.75 million from the California Attorney General’s press release of 11 February 2026. The Colorado obligation and UOOM listing from the Colorado Department of Law Universal Opt-Out page. Browser availability from globalprivacycontrol.org. Protocol outcomes are observational; they are not legal advice.

The check that matters is what your site does on a request that carries Sec-GPC: 1 — not what the banner says.

This article was written by a contributor and fact-checked by ConsentModeHQ against the primary sources linked above.