How to Implement GPC Correctly (and the Five Ways Teams Get It Wrong)
Updated 2026-08-05 · 3 enforcement actions cited · 5 official sources
Honoring Global Privacy Control is not hard, but it fails in predictable places: the signal is read too late, the tag manager is configured to suppress cookies instead of blocking scripts, and the downstream advertising platforms never learn about the opt-out at all. Here is the implementation that actually holds up under a live audit.
TL;DR
- Read `Sec-GPC` server-side on the initial document request, before any HTML is sent — that is the only way to reliably gate tags that load in <head>.
- Suppressing cookies is not the same as blocking the script. The network request itself is the disclosure.
- Propagate the opt-out downstream: Google Consent Mode v2 (`ad_storage`/`ad_user_data`/`ad_personalization` = denied), Meta Limited Data Use, and a GPP string with the California section.
- Show an acknowledgement. It is permitted, it improves user trust, and it is the clearest evidence of compliance in an audit screenshot.
- Re-test on every release. Marketing teams reintroduce tags constantly.
See whether your own site honors GPC. $99, runs in a real California browser.
Step 1 — Detect the signal at the earliest possible point
The header arrives on the very first request for your HTML document. Read it there. In a server-rendered app this means checking `request.headers.get('sec-gpc') === '1'` in your document handler or middleware and passing the result into the rendered page as a first-class piece of state, before any script tag is emitted.
Also read `navigator.globalPrivacyControl` on the client as a belt-and-braces check, because some extensions inject the JavaScript property in contexts where the header does not reach your origin (for example behind certain caching layers that strip unknown request headers). Treat either source being true as an opt-out.
If you are behind a CDN, verify that `Sec-GPC` is forwarded to origin and — critically — that it is part of your cache key. A cached HTML response generated for a non-GPC visitor served to a GPC visitor is a compliance failure that will not reproduce in local testing.
Step 2 — Block the tags, don't just clear the cookies
The most common defect in real deployments: a consent management platform configured in 'cookie blocking' mode. It deletes or refuses cookies for a vendor while still allowing the vendor's script to load and beacon. Under the CCPA, the outbound request carrying the visitor's IP address, user agent, page URL, and referrer to an advertising third party is itself the share. Deleting the cookie afterwards does not undo it.
The correct configuration keeps advertising and cross-context behavioral tags out of the DOM entirely when GPC is present. In Google Tag Manager that means a blocking trigger evaluated from a data-layer value you set server-side, not a tag sequencing rule that runs after the tag has already fired.
Strictly necessary and first-party analytics that you do not disclose to third parties for cross-context advertising can generally continue. The line is the disclosure, not the measurement.
Step 3 — Propagate the opt-out to your platforms
Your obligation extends to third parties you already sold or shared data with, so the signal must travel. For Google, set Consent Mode v2 with `ad_storage`, `ad_user_data`, and `ad_personalization` denied, and enable Restricted Data Processing on any server-side conversion calls. For Meta, set the Limited Data Use flag (`dpo` parameters) on both the pixel and any Conversions API events. For programmatic partners, publish a Global Privacy Platform (GPP) string containing a US National or California section that reflects the opt-out.
If you use server-side tagging, this is the step most often skipped: the client tag is blocked, the marketing team routes the same event through the server container instead, and the data flows anyway with no privacy flags attached.
Not sure where your site stands? Find out in a few minutes.
Step 4 — Reflect the state in the UI
The regulations permit you to notify the consumer that their preference signal was honored. Do it. A small, persistent line near your cookie banner or in your privacy center reading 'We detected your Global Privacy Control signal and opted you out of the sale and sharing of your personal information' costs nothing and is the single most legible piece of evidence in any audit or screenshot review.
Equally important: when GPC is present, your privacy preference toggles for sale/sharing and targeted advertising should render in the OFF position by default, and your cookie banner should not present 'Accept All' as the prominent primary action as though no signal had been received.
Step 5 — Test it the way a regulator would
Load your site from a California IP address with GPC enabled. Capture every outbound network request. Compare against a control load with GPC off. Any request to a known advertising or cross-context behavioral domain that appears in both runs is a finding. Then screenshot the cookie banner and privacy center in the GPC run and confirm the state visibly reflects the opt-out.
Run it on a schedule, not once. The most common regression path is a marketing team adding a new tag through a tag manager that sits outside the consent gate.
Key enforcement actions
In re Todd Snyder, Inc.
Cal. Privacy Protection Agency, May 2025, $345,178A misconfigured third-party consent tool meant opt-out requests were never processed for 40 days. The business, not the vendor, was held responsible — the direct argument for continuous verification rather than one-time setup.
Read the official source ↗In re American Honda Motor Co., Inc.
Cal. Privacy Protection Agency, Mar. 2025, $632,500Cookie interface required two clicks to reject and one to accept. A UI-symmetry finding that maps directly to how your banner should render when GPC is detected.
Read the official source ↗People v. Sephora USA, Inc.
Cal. Att'y Gen., Aug. 2022, $1,200,000Trackers continued to load and transmit despite GPC signals. The originating enforcement action for the 'block the tag, not the cookie' principle.
Read the official source ↗FAQ
Can I honor GPC entirely client-side?
You can, but it is fragile. Any tag that loads synchronously in <head> may fire before your client-side logic evaluates the signal. Server-side detection on the document request is the only way to guarantee ordering.
Should I apply GPC to non-California visitors?
Most teams apply it globally. It is simpler to operate, several other states now require honoring universal opt-out mechanisms, and geolocation-based gating introduces its own accuracy problems for VPN and mobile traffic.
Does GPC require me to stop first-party analytics?
Not inherently. The obligation is about sale and sharing. First-party analytics you do not disclose to a third party for cross-context behavioral advertising is generally outside the opt-out — but check what your analytics vendor's contract and default configuration actually permit them to do with the data.
My CMP says it supports GPC. Am I done?
No. Vendor support means the feature exists; it does not mean your instance is configured correctly or that tags added outside the CMP are gated. The Todd Snyder decision is exactly this scenario. Verify with a live test.
Official sources
- GPC specification (header and JS property) ↗— GPC Working Group
- CCPA Regulations § 7025 — opt-out preference signals ↗— California Privacy Protection Agency
- Google Consent Mode v2 developer docs ↗— Google
- Global Privacy Platform (GPP) specification ↗— IAB Tech Lab
- Cal. Civ. Code § 1798.135 ↗— California Legislative Information
Related reading
This guide is general information about California privacy law and the Global Privacy Control signal, not legal advice. Enforcement actions are summarized from official regulator publications; verify before relying on them. Consult qualified counsel for your specific situation.