GPC on Your Own Site: The Three-Line Check That Proves You Honor It
Most teams that say they honor Global Privacy Control have never tested it. The CMP dashboard has a toggle, the toggle is on, and that is the whole verification. Then a regulator loads the site with GPC enabled, watches the pixels fire anyway, and the toggle does not help. California's rules now require the site to show whether it processed the signal, not just to process it quietly. The check takes three lines in a browser console, and most sites fail the second one.
GPC is a browser setting, not a banner. When it is on, the browser adds a Sec-GPC: 1 header to every request and sets navigator.globalPrivacyControl to true for scripts on the page. In California, Colorado, Connecticut, and a growing list of states, the law treats that signal as a valid opt-out of sale or sharing and of targeted advertising. The business does not get to ask the visitor to click anything. The signal is the request.
Send the signal
First, send one. Install a browser extension that sets GPC, or open developer tools and check what your site reads. The simplest test is to load your homepage with GPC on and type navigator.globalPrivacyControl into the console. If it returns true, the browser is doing its half. If your CMP has a GPC setting, confirm it is actually enabled for your live configuration and not just available on a pricing page. Several CMPs ship GPC support gated to a paid tier, and the toggle in the dashboard can sit one plan above the one you bought.
Read what comes back
Second, read what the site shows. Since the updated California regulations took effect on January 1, 2026, a business must show whether it has processed the signal, for example with an "Opt-Out Request Honored" message or a settings toggle showing the opt-out. A site that honors the signal silently and shows nothing is now failing a visible requirement. The message does not need to be elaborate. It needs to exist, and it needs to be true.
Third, check the conflict rule. If a visitor accepted cookies last month and turns GPC on today, the signal wins over the earlier banner choice. Load the site with GPC on after a prior accept and watch whether the consent state flips to opted out. If the banner's stored accept survives, the CMP is treating the banner as the record and the signal as a suggestion. The regulation treats it the other way around.
Follow the data, not the banner
The fourth check is the one that cost Disney $2.75 million in February 2026. Open the network tab with GPC on and watch the third-party pixels. The opt-out has to reach the embedded ad-tech, not just the CMP's own cookie. If the pixels still fire with sale and sharing flags on, the banner is compliant and the site is not. The settlement's details were specific: GPC opt-outs limited to a single device even when the consumer was logged in, and opt-out tools that did not reach embedded third-party ad-tech. Both failures are testable in a browser in five minutes.
Run the same test logged in and logged out, on desktop and on mobile. The device-only gap is the most common failure, and it is invisible from the dashboard. The whole point of the exercise is that the dashboard is not the site. The browser is.
Keep reading: The YouTube Embed That Tracks Before Anyone Presses Play, How Long a Yes Lasts: The Six-Month Consent Clock, White Label Cookie Consent: What It Is and How to Choose a Platform cover the nearby cases in this series.
Frequently asked questions
How do I send a GPC signal to test my own site?
Use a browser extension that sets Global Privacy Control, or a browser with a built-in GPC setting. Load your site and check navigator.globalPrivacyControl in the developer console. It should return true, and your CMP should record an opt-out.
What should the site show after it processes the signal?
Since January 1, 2026, California's regulations require the business to show whether it processed the signal, for example an Opt-Out Request Honored message or a settings toggle showing the opt-out. Silent honoring is no longer enough.
Does GPC apply if we only do targeted advertising, not sale?
It depends on the state. In California the signal covers sale and sharing. In Colorado it covers sale and targeted advertising, and Colorado has required honoring universal opt-out mechanisms since July 1, 2024. Check each market instead of copying the California setup.
What if our CMP has no GPC setting?
Then the CMP is not doing the job, and the duty still sits with you as the business. Either move to a CMP that handles GPC, or implement the signal handling in your tag manager so the Sec-GPC header and the navigator flag both trigger an opt-out before any sale or sharing tags fire.