Honoring Global Privacy Control: Testing Whether Your Site Actually Stops the Sale
Somewhere in your database there is probably a row that says consent: true, with a timestamp. That row feels like evidence. Put it in front of a regulator, or a judge, or an angry customer with a screenshot of a different banner than the one you run now, and it turns into a claim you cannot support.
The burden sits with the controller. Under GDPR Article 7, the organisation relying on consent has to be able to demonstrate that the person gave it. Demonstrate is a records problem, not a design problem, and the receipt is where most consent programmes are thinnest, because the banner got the budget and the log got whatever the default settings kept.
Global Privacy Control is a browser or extension signal that tells a site not to sell or share the visitor's personal information. Honoring it means the signal is detected on arrival, written to the consent record, and passed to every tag and vendor whose activity counts as a sale or share under state law.
What the signal is and is not
The signal arrives as a simple header and a browser property, set once by the person and sent to every site they visit. It is not a cookie banner answer and it does not negotiate. Under California regulations it must be treated as a valid opt out of sale and sharing, and Colorado and a growing list of states recognise it as a universal opt out mechanism with their own effective dates.
What it does not do is cover everything. It speaks to sale, sharing, and targeted advertising uses. It does not withdraw consent for analytics a law treats separately, and it does not replace the opt out links a site must still offer people whose browsers send no signal at all.
Where honoring breaks down in practice
The common failure is detection without propagation. The site reads the signal, shows a notice saying preferences are respected, and then fires the same advertising pixels as before, because nobody wired the signal into the tag manager conditions. The second failure is ordering: tags fire on page load before the consent script checks the signal, so the sharing happened in the first second and the opt out applied to a visit already shared.
Third, the signal gets lost between systems. The website honors it, the data platform never hears about it, and the person appears in an audience segment exported next week. Each handoff, site to consent platform, platform to tag manager, warehouse to activation tool, is a place the opt out has to survive in writing.
Running the end to end test
Use a browser profile with the signal switched on and visit the site as a stranger would, in a private window, from a relevant state location if your banner is geo targeted. Record network requests and list every vendor call that could count as sharing. Then check the consent record the visit created: it should show the opt out source as the signal, with a timestamp, without you touching a banner.
Repeat the test after every tag manager publish and every consent platform update, and file the request list with the date. The test takes twenty minutes. The version of this conversation nobody wants is explaining to a regulator why the notice on the site said the signal was honored while the tag container from that month shows it was never read.
Keep reading: Consent Receipts: The Six Fields That Make a Yes Provable Later, Withdrawing Consent Should Cost the Same Clicks as Giving It: Run the Parity Test, and Consent for AI Chatbots: What a Chat Notice Has to Say Before Anyone Types cover the nearby cases in this series.
Frequently asked questions
Which laws require honoring Global Privacy Control?
California regulations require it for sale and sharing opt outs, and Colorado's universal opt out rules recognise it, with other states adding it on set effective dates. The list changes, so the safe approach is to honor the signal everywhere rather than by state.
Does the signal replace the Do Not Sell link?
No. The link or opt out page must remain for people whose browsers send no signal. The signal is an additional, automated route to the same right, not a substitute for the manual one.
How can a visitor tell if a site honored the signal?
A site that honors it should not need a banner interaction to record the opt out, and some show a short notice confirming the preference was applied. Behind the scenes, the test is whether advertising and sharing tags stay silent on that visit.
What should the consent record show for a signal based opt out?
It should show the opt out state, the source recorded as the privacy control signal, the time it was received, and the scope it was applied to. A record that only shows a banner answer cannot prove the signal was ever detected.