Overview
Global Privacy Control (GPC) is a privacy setting that allows users to set their browser to automatically signal to websites and online services that they do not want their personal information to be sold or shared with third-party companies. It is a simple and standardized way for users to exercise their privacy rights and opt-out of data-sharing practices.
When users activate GPC, their browser sends a signal to websites and online services they visit, indicating that the user wants their personal information to be kept private. This signal is a header included in the browser's HTTP request, and it can consist of a digital "do not sell" instruction that tells websites not to sell the user's personal data to third-party companies.
GPC Signal and CCPA
As new legislation focused on data privacy and protection becomes law, it is increasingly important for businesses to respect and honor GPC signal. This is essential for CCPA compliance and for demonstrating to site visitors that privacy rights are taken seriously. By adhering to GPC signal guidelines, businesses can show their commitment to respecting and safeguarding each user's privacy while also ensuring that personal data is collected and used ethically and in compliance with applicable laws and regulations.
As CPRA became effective January 1, 2023, the AG of California is stepping up enforcement of this legislation to make sure that every business responsibly handles and respects each user's data privacy. Recent enforcement of CCRA levied massive fines for the online retailer Sephora.
"There are no more excuses. Follow the law, do right by consumers, and process opt-out requests made via user-enabled global privacy controls" - Office of the AG of California
GPC Signal and GDPR
The GDPR, which took effect on May 25, 2018, is built around obtaining informed, affirmative consent before any personal data processing begins, rather than relying on an opt-out model. Since Global Privacy Control didn't exist yet when the regulation was written, it isn't mentioned anywhere in the GDPR and doesn't automatically satisfy its consent requirements on its own. That said, legal analysis of the regulation suggests GPC can still carry weight in certain situations such as a withdrawal of consent under Article 7(3), or an objection to processing under Article 21 where legitimate interest is the legal basis being relied on.
How does it work in ObservePoint?
Sending GPC Signal is a critical part of validating the various opt-in/opt-out user states required to ensure privacy compliance. To enable this setting on your Audits or Journeys simply toggle on Send GPC Signal found Journey Setup or Audit Setup Advanced Options. Report data reflects tags, cookies, and other technologies loading while in this state.