The GPC Signal Is Not a Banner Setting. Test It Like a Request.
A tracking pixel collects personal data the moment an email is opened: the time, an IP address, and usually a device fingerprint, tied to an address you already hold. In the EU that collection needs a lawful basis and a clear notice before the first tracked send, and consent records that only mention the signup form do not cover it.
Global Privacy Control sends Sec-GPC: 1 with every request from a browser that has it on. Under the CCPA that signal is a valid opt out of sale and sharing, and the business has to stop selling and sharing as soon as feasibly possible and no later than 15 business days. A cookie banner alone cannot process it, because the banner governs collection and GPC governs sale and sharing.
What the signal actually is, and who sends it
GPC is a browser setting, not a cookie choice. When it is on, the browser adds the Sec-GPC: 1 header to each request and sets navigator.globalPrivacyControl to true for scripts on the page. Brave, DuckDuckGo and Firefox build it in, and California's Opt Me Out Act, signed in October 2025, requires browsers to offer a built in opt out preference signal setting from January 1, 2027, so the volume of GPC traffic is set to grow rather than fade.
The signal carries no identity by itself. It arrives per browser or device, and the CCPA regulations say the opt out has to reach any profile the business can associate with that browser by reasonable means, including a logged in account. A site that honors GPC only for anonymous sessions and keeps selling the same person's data once they log in has honored the header and missed the request.
The deadlines and the enforcement record
California has required businesses to honor qualifying opt out preference signals for years, with the attorney general confirming GPC in July 2021. Colorado put GPC on its approved list from July 1, 2024 and Connecticut from January 1, 2025. Twelve states now require covered businesses to recognize qualifying signals. The California regulations also require the business to show on its website whether it has processed the signal, for example with an Opt Out Request Honored message, from January 1, 2026.
Enforcement has teeth and a paper trail. The 2022 Sephora settlement, 1.2 million dollars, included the company's failure to process opt outs sent through GPC. In September 2025 the California Privacy Protection Agency and the attorneys general of California, Colorado and Connecticut announced a joint sweep of businesses that do not honor GPC. In August 2026 the CPPA board voted to begin formal rulemaking that would name GPC expressly in the CCPA regulations.
Running the test on your own site
Turn GPC on in a test browser and load the site. Watch the network panel for Sec-GPC: 1 on the page request, then check what the site does next. Does a tag manager rule catch the signal and suppress sale and sharing tags, or does the banner pop up as if nothing happened. Does the site display any confirmation that the signal was processed. Does the opt out reach the account when the same test browser logs in.
Log the result with the date and the browser used, and keep it with the consent records. If the test shows the signal is ignored, the fix sits in the consent platform and the tag manager, not in the banner copy. A banner that offers a Do Not Sell link while the GPC request goes unprocessed is the exact gap the September 2025 sweep was looking for.
Keep reading: Email Tracking Pixels Are a Consent Problem, Not a Privacy Footnote, What a Consent Audit Finds Inside the Tag Manager, and When Purposes Change, Consent Has to Be Asked Again cover the nearby cases in this series.
Frequently asked questions
Does GPC replace the cookie banner?
No. GPC opts the visitor out of sale and sharing of personal information. The banner collects consent for cookies and other storage. A site needs both, and a banner alone does not process a GPC signal, because the two cover different processing.
How fast must a business act on a GPC signal?
Under the CCPA, as soon as feasibly possible and no later than 15 business days. That clock runs from receipt of the signal, not from the next site release, so a fix queued for the next quarter is already late.
Does GPC apply outside California?
Yes, in a growing list of states. Colorado has required it since July 1, 2024, Connecticut since January 1, 2025, and Oregon from January 1, 2026. The exact scope differs by state, but treating the signal as valid everywhere is cheaper than maintaining a per state map.
What should the site show a visitor who sends GPC?
A visible confirmation that the opt out preference signal was processed, as the California regulations require from 2026. The message should name what was honored, sale and sharing, rather than a generic privacy statement.