CCPA Compliance Implementation: Global Privacy Control (GPC) is recognized

Overview

This check runs a Web Audit with the browser-level GPC header enabled and confirms that a site treats the presence of that signal as equivalent to a manual "Do Not Sell or Share" click, blocking advertising and sharing tags without requiring any further consumer interaction.

Note: This guide is provided for informational purposes only and does not constitute legal advice. Consult qualified legal counsel regarding your organization's specific CCPA/CPRA compliance obligations.

Why it is important

California's Attorney General and the CPPA have publicly confirmed GPC is a required opt-out signal under CCPA/CPRA, and sites that ignore it have already been the subject of public enforcement actions. Because GPC is asserted before the visitor ever touches the banner, it tests a different code path than a Reject-All click, a site can pass the Reject-All test and still fail GPC if the CMP-to-tag-manager integration only listens for the banner's own button event and never checks the browser-level signal at all.

Implementation

Configure a dedicated Audit with gpcEnabled set on the browser profile (deliberately without third-party-cookie blocking, since that would mask a genuine GPC failure as a pass).
Check the pre-built ObservePoint report for GPC Signal Recognition (Advertising/Sharing Tags Under GPC).
Any tag in the report above is still firing under GPC. Cross-check the pattern against your Reject-All Audit results; a mismatch means the site handles the button and the header inconsistently.

Remediation

For remediation, check the following steps:

If GPC is not recognized at all, the root cause is almost always that the CMP or tag-management layer was never wired to read the Sec-GPC browser header (work with engineering or the CMP vendor to confirm the CMP's GPC-detection feature is enabled - most major CMPs, including OneTrust, support this natively) and that detecting it triggers the same downstream consent-category denial as a manual opt-out click.
Where GPC is partially recognized (some tags respect it, others don't), trace the inconsistency to specific tag triggers the same way as the manual opt-out leak check, since the underlying trigger-gating logic is typically shared.
Re-run the GPC-specific audit and compare_consent_states after remediation, and add the GPC audit to a recurring schedule since GPC-specific regressions are easy to miss if only the manual-click opt-out path is tested regularly.

Conclusion

Given the CPPA's explicit enforcement focus on GPC, this is not an optional or best-practice check. Running Reject-All alone and skipping the GPC-specific audit leaves a documented, regulator-confirmed gap in your evidence.