Overview
This check confirms that your site detects the Global Privacy Control (GPC) signal that a visitor’s browser sends and applies it as an opt-out. ObservePoint runs an audit with the GPC signal enabled and flags any tag outside the Strictly Necessary category that still fires.
Note: This guide is provided for informational purposes only and does not constitute legal advice. Consult qualified legal counsel regarding your organization's specific GDPR compliance obligations.
Why It Matters
GDPR does not name GPC, but it does give visitors the right to object to processing by automated means, using technical specifications (Article 21(5)). Withdrawing consent must also be as easy as giving it (Article 7(3)). A browser-level signal is one practical way for a visitor to do both without clicking through a banner.
Detecting the signal is not enough. If your site reads it but non-essential tags keep firing, the visitor’s choice is ignored without their knowing. This check tests the outcome rather than the setting, so it catches that gap.
Implementation
Configure a dedicated Web Audit with the GPC signal (
gpcEnabled) enabled on the browser profile, deliberately without third-party-cookie blocking, since that would mask a genuine GPC failure as a pass.Check the pre-built ObservePoint report for GPC Signal Detection and Application.
In the report above, look at the TAG_CATEGORY column for any tag outside "Strictly Necessary" still firing under GPC, each one is a signal the site isn't honoring.
Remediation
If non-essential tags still fire under GPC:
Confirm the test is valid. Make sure the audit really sent the GPC signal and that no pre-audit action accepted cookies, since an accept click can override the signal.
Check your consent management platform (CMP). Most CMPs have a setting to honor GPC. Turn it on and confirm it puts the visitor in an opted-out state, not just a recorded preference.
Check your tag manager. Each flagged tag should be assigned to a consent category that opted-out visitors block. Tags with no category usually fire regardless.
Look for hard-coded tags. A tag placed directly in the page code bypasses your tag manager and your CMP, so it ignores GPC.
Re-run the audit. Once the fix is live, run it again and confirm only Strictly Necessary tags fire.
Conclusion
A privacy signal only matters if your site acts on it. GPC lets a visitor opt out once, in their browser, and expect every site to respect it. A tag that keeps firing anyway undoes that choice without anyone noticing.
Consent setups drift as tags, vendors, and CMP settings change, so a site that honors GPC today can stop doing so after a release. Running this check on a regular schedule catches that early, before it becomes a pattern.