Global Privacy Control in Mobile Apps: The Signal Most Teams Forget
The first big GPC enforcement action was about a website that kept sharing data after visitors switched the signal on. App teams read that headline and moved on, assuming a browser header has nothing to do with a native build.
That assumption is getting expensive. The underlying right is an opt out of sale and sharing, and it does not evaporate because the data flows through an SDK instead of a cookie.
Where the signal shows up in an app stack
Privacy focused browsers and in app webviews can pass GPC through, and several mobile operating systems and privacy browsers now expose an equivalent setting. The practical gap is mapping: the web team honors the header on the marketing site, while the app shares identifiers with ad networks through SDKs that never check any opt out state at all.
Start with an inventory. List every SDK in the build that receives an advertising ID, email hash, or event stream, then ask which of them reads a consent or opt out flag before transmitting. In most audits the answer is that the flag exists in the app's own settings screen and is never propagated.
Honoring the signal means stopping the sharing, not showing a banner
GPC is itself the opt out. A user who enabled it has already made the choice, so responding with a fresh consent prompt asking them to choose again defeats the mechanism. The compliant response is silent: set the opt out state, stop sale and sharing flows, and limit ad personalization to contextual.
That includes downstream copies. Toggling off in app sharing while the same identifier continues to flow to a measurement partner through a server side integration is the kind of half measure that enforcement letters quote back at companies.
Test it like an engineer, not a lawyer
Build a test device profile with GPC enabled in its browser, walk the signup flow in a webview, and watch outbound calls. Then repeat with the OS level ad personalization off. Any request carrying an advertising ID to a data broker or ad network after the opt out is a bug, and it belongs in the tracker with a severity, not in a legal memo.
Related reading
These earlier guides cover connected questions in more depth: Global Privacy Control in Mobile Apps: The Signal Most Teams Forget, Data Processing Addendums for Small Vendors: The Consent Clauses That Do the Work, and Consent Receipts: What a Good One Should Contain.
Frequently asked questions
Is Global Privacy Control legally binding or just a suggestion?
In California it is binding. The CCPA regulations list GPC as a valid opt out signal, and the state has enforced against companies that ignored it. Other state laws with universal opt out mechanisms are converging on the same treatment.
Does GPC replace the Do Not Sell or Share link?
No. The link or in app setting serves users who have not enabled a signal. GPC serves users who set their preference once at browser or device level. You need to honor both paths.
What counts as sale or sharing in an app?
Sharing identifiers with ad networks for cross context behavioral advertising is the core case, whether or not money changes hands. Analytics under a proper service provider contract is treated differently, which is why the contract and the data flow both matter.
How often should we re check the signal?
Check at session start and whenever the consent state screen is opened. A user can enable GPC after installing the app, and a check that only ran at first launch will miss it.