GPC vs. Cookie Banners: Why Having a Banner Doesn't Mean You're Compliant

They operate at different points in the request lifecycle

A cookie banner runs after your page loads. By the time the visitor sees it, your HTML has been delivered, your scripts have been parsed, and — in most real-world deployments — at least some third-party requests have already gone out. The banner then retroactively adjusts behavior.

GPC arrives with the very first HTTP request, before your server has produced a byte of HTML. It is available earlier than any client-side mechanism can possibly be, which is exactly why the regulations treat it as the frictionless path and why a compliant implementation reads it server-side.

'They could have clicked Reject All' is not a defense

Section 7025 requires processing an opt-out preference signal as a valid opt-out request and prohibits requiring the consumer to take additional steps. Presenting a banner and waiting for a click is an additional step. The signal has already communicated the request; asking again is at best redundant and at worst a dark pattern, because most visitors dismiss banners without engaging.

The Honda decision reinforced the underlying principle from the interface side: choices must be symmetric, and a design that makes exercising a privacy right harder than waiving it is itself the violation.

What your banner should do when GPC is on

Render the opted-out state. Sale/sharing and targeted-advertising toggles should be OFF and shown as OFF. If your banner has an 'Accept All' button, it should not be the visually dominant primary action in this state, and ideally the banner should be replaced by a short acknowledgement: 'We detected your Global Privacy Control signal and have opted you out of the sale and sharing of your personal information.'

You may still offer the user the ability to affirmatively consent despite the signal — the regulations allow you to inform them of the conflict — but the default must be the opted-out state, and any consent must be a deliberate act.

What an auditor actually checks

The methodology is a differential test. Load the page twice from a California IP: once with GPC, once without. Then compare four things. First, the network request log — does any request still go to an advertising or cross-context behavioral domain in the GPC run? Second, cookies and storage — are advertising identifiers still set? Third, the opt-out signal strings — is the `usprivacy` value or GPP string set to the opted-out value? Fourth, the visible UI — do the screenshots show any acknowledgement, or the same neutral Accept All banner in both runs?

A site that passes only the fourth check (shows a nice message, changes no data flows) fails. A site that passes the first three but shows nothing visible is likely compliant but has no evidence — which is why we recommend adding the acknowledgement.

Where banners still matter

None of this makes consent banners obsolete. You still need an interface for the large majority of visitors who do not send GPC, for the sensitive-personal-information limitation right that GPC does not carry, and for jurisdictions like the EU and UK where opt-in consent is required and GPC's opt-out model is insufficient on its own.

The right mental model is layered: GPC handles the visitors who already decided, the banner handles the ones who have not, and both feed the same downstream suppression and flag-propagation logic.

Key enforcement actions

FAQ

Official sources

• CCPA Regulations § 7025 and § 7004 (symmetry in choice) ↗— California Privacy Protection Agency
• CCPA overview and consumer rights ↗— California Attorney General
• CPPA enforcement announcements ↗— California Privacy Protection Agency
• Global Privacy Control specification ↗— GPC Working Group

Related reading