Global Privacy Control: When the Browser Says No for You

You have a small sticker on your letterbox. It says "No junk mail", in the stern capitals of a council that has seen things. It works surprisingly well. The pizza flyers stop. The real estate agent's glossy fridge magnet stops. You drink your tea in peace, reading only the post that is actually addressed to you.

Now imagine the sticker did not exist, and you had to ask each business yourself. You ring the pizza shop. They are lovely about it. They take you off the list for the letterbox at the front of the house—but not the one at the side gate, because that is a different letterbox, and it is in a different system. You ring again for the side gate. Done. Then you drive to the holiday shack, and there is a flyer from the same shop waiting in that letterbox, because the shack is a different address, and nobody told the shack. You ring a third time. By now the shop recognises your voice. They could tell you your usual order, your favourite topping and the fact that you always order on Fridays at 6:40 pm. They know exactly who you are and every letterbox you own. They just could not seem to join it up when you asked them to stop.

Then you find out the flyers were never theirs to begin with. They were printed and delivered by a company whose name you have never heard, and it did not get your phone call at all.

You have done nothing wrong here. This is not paranoia, and you are not unusually difficult. It is, almost exactly, what California's Attorney General alleged about Disney.

On 11 February 2026, Disney agreed to pay US$2.75 million, which the Attorney General's office calls the largest settlement to date under the California Consumer Privacy Act (CCPA). The office alleged that when a person used Disney's opt-out tools, the choice often stuck to one service on one device. When they used Global Privacy Control, the browser's version of the letterbox sticker, Disney applied it only to the device that sent it, "even when the consumer was logged into their account". As Attorney General Rob Bonta put it: "businesses can't force people to go device-by-device or service-by-service."

This matters well beyond one media company. California has already passed a law that will make every browser maker build this sticker in, from 2027. The signal is coming to many more browsers, and the question for any business that sells or shares data about Californians is simple: when a browser says no on your visitor's behalf, does your stack hear it, and does the "no" reach every place it has to go?

So here is the plan. First, what the sticker is and why California treats it as a legal request. Then the mechanism itself, down to the single character in the HTTP header. Then Disney, as a worked example, and what the settlement now requires. Last, the part you can fix this week: detecting the signal, mapping it to consent states in Google Tag Manager, and making sure the tags that are not Google's get the message too.

Let's get into it.

Part 1: A Sticker on the Letterbox

The letterbox sticker works because of three quiet facts. You set it once. It applies to everyone who comes to the letterbox, not only the people you have met. And you do not have to explain yourself. The sticker does not say "No junk mail, except from businesses I have not yet had the chance to ring". It just says no.

An opt-out preference signal is the same idea for the web. Under the CCPA, people have the right to tell a business to stop "selling" or "sharing" their personal information. Those words are wider than they sound. "Sharing" covers cross-context behavioural advertising, which is the business of following a person from site to site and app to app to target ads. I covered the basics of the law when it was still young. The usual way to exercise the right is a "Do Not Sell or Share My Personal Information" link on each site. The signal replaces all of those clicks with one setting.

The CCPA regulations state the purpose plainly. Section 7025 says the signal lets a person opt out "with all businesses they interact with online without having to make individualized requests with each business". A business that sells or shares personal information must treat a signal as a valid opt-out request if it meets two tests: it is in a format businesses commonly use, and the regulation gives "an HTTP header field or JavaScript object" as examples; and the tool that sends it makes clear to the person that the signal is "meant to have the effect of opting the consumer out of the sale and sharing of their personal information".

Which sticker

In practice, one signal passes both tests: Global Privacy Control, or GPC. The Attorney General's own page calls it a "'stop selling or sharing my data switch'" and says it "must be honored by covered businesses as a valid consumer request to stop the sale or sharing of personal information". The GPC project says it was first introduced at the W3C in April 2020, and in November 2024 it became an official work item of the W3C Privacy Working Group, the part of the web's main standards body that works on privacy. The specification is still a Working Draft. The latest version was published on 19 February 2026, which means it changed in the same month as the Disney settlement. The draft notes that "at least four states have specifically identified GPC as a valid means to exercise legal opt-out rights".¹

As of February 2026, the GPC project lists Brave and DuckDuckGo as sending the signal by default, and Firefox as offering it in settings. Mozilla says Firefox added it in version 120, and the switch sits under Privacy & Security, labelled "Tell websites not to sell or share my data".

Why the sticker is about to get more common

Today, a person has to choose one of those browsers, or find a setting, or install an extension. California has decided that is too much work. In October 2025, Governor Newsom signed AB 566, the California Opt Me Out Act. It adds a new section to the CCPA: a business "shall not develop or maintain a browser" unless the browser includes a setting that sends an opt-out preference signal, and the setting must be "easy for a reasonable person to locate and configure". It applies from 1 January 2027.

The law does not name any browser. It did not need to. As the privacy lawyer Darren Abernethy told the IAPP, "the world's largest browser developers by market share do happen to be based in the Golden State". He expects "an increase in the sending of browser-based opt-out of sell/share requests", and he is watching whether the big browsers put the new setting on or off by default. That one choice will decide whether GPC stays a signal from a privacy-minded few, or becomes something a large share of your California traffic sends.

So in February 2026 you have about ten months before the sticker comes in the box with the most common browsers. This is a good time to find out whether your letterbox can read.

Part 2: How the Signal Actually Travels

A signal is only useful if something reads it. So how does a browser say no, in bytes?

GPC uses two channels, and the W3C draft defines both. One goes to your server with every request. The other sits in the page, where your scripts can ask for it. They carry the same value, and they must agree, which turns out to be more interesting than it sounds.

Channel one: the header

Every time a browser asks a server for something, it sends a list of HTTP request headers first: short lines of metadata such as the language the person prefers or the kind of browser they use. Think of them as the writing on the outside of an envelope. The server reads the envelope before it opens the letter.

A browser with GPC turned on adds one line to every request:

GET /something/here HTTP/2
Host: example.com
Sec-GPC: 1

That is the whole signal. The value is the numeric character "1". The spec is unusually strict about it. A browser "MUST generate a Sec-GPC header field with a field-value that is exactly the numeric character '1'" when GPC is on, and must not send the header at all when it is off. There is no Sec-GPC: 0. A server that sees any value other than exactly "1" "MUST ignore it and process the request as if that header had not been specified".

The header is also "deliberately defined without an extension mechanism", so nobody can later add 1; except-for-partners to it. The authors explain why: experience with previous similar headers shows that people "rely on string equality instead of parsing the value". In other words, developers will write if (header === "1"), and any extension would quietly break that check. So the spec makes the lazy check the correct check.

Channel two: the property

Headers reach the server. They do not reach the JavaScript running in the page, which is where your tag manager, your analytics and your ad pixels live. So GPC also exposes a property on the browser's navigator object:

navigator.globalPrivacyControl // true or false

It is a read-only boolean: true if the browser would send Sec-GPC: 1, and false otherwise. It is available in normal page scripts and in web workers.² The spec even includes an example, and I will quote the comment in full, because standards bodies are not often this dry:

if (!navigator.globalPrivacyControl) {
  // wonderful, we can sell this person's data!
}

It is a joke with a real point. The property exists so that code can check before it acts, and the only honest time to check is before anything is sent.

Why the two channels agree: the cache

Here is the detail most summaries skip. The spec says the preference "MUST be cached on each top-level navigation". Each tab keeps a value called gpcAtNavigation, set when the page begins to load. It "is initially false". The property returns that cached value, and the header follows it too.

So if a person turns GPC on while your page is open, nothing changes on that page. The header and the property both keep the old value until the next full page load. The spec only says the browser "SHOULD" tell the person about tabs that are out of step and offer to reload them. For you, this has two useful effects. You can read the value once per page and trust it for the rest of that page. And your server and your scripts will not disagree about the same page load. The letterbox sticker cannot change halfway through the delivery round.

The notice on the gate: gpc.json

There is one more piece. A site "MAY" publish a small file at /.well-known/gpc.json to say whether it honours GPC:

{ "gpc": true, "lastUpdate": "2025-04-15" }

A gpc value of true means the server "intends to abide by GPC requests at least to the extent it is legally obligated to do so". The lastUpdate date must be a valid date format. By default, if the file is not there, a site's support is simply unknown. The file is optional, but it is one of the things researchers and regulators can check from outside, so if you publish it, it must be true. We will come back to why.

max_tokensPOST./v1/messages

What the signal does not do

GPC is narrow on purpose. The draft defines a "do-not-sell-or-share interaction" as one where the person asks that their data "not be sold to or shared with any party other than the one the person intends to interact with, or to have their data used for cross-context ad targeting". It then says what GPC is not: it "is not designed to exercise deletion rights", and it is "not designed to address data collection or ad targeting within the same context".

That second line matters for analytics. A GPC signal is not a general "do not measure me" request. It is a "do not pass me on" request. Your own first-party measurement of how people use your own site is outside its main purpose, unless that data then flows to someone else for advertising. Keep that distinction in mind. It decides most of the mapping in Part 5.

So that is the sticker, the envelope and the notice on the gate. Now for the part where it all goes wrong.

Part 3: Ten Doors in the Magic Kingdom

stop_reasoneval:.pass

First, a small appreciation. The Attorney General's office clearly had fun with this one. The press release is titled "California Won't Let It Go". Bonta's quote says consumers "shouldn't have to go to infinity and beyond". And the complaint itself, a formal legal document filed in the Los Angeles Superior Court, says the CCPA "created a whole new world of consumer data protections", that "in a tale as old as time, Disney placed its profits over these critical consumer privacy rights", and that none of the opt-out methods "satisfied the bare necessities of the law".³ Somewhere in the California Department of Justice, a deputy attorney general has earned a very good afternoon off.

Under the puns is a precise and useful set of allegations. Disney did not admit them. The settlement is a stipulated judgment, entered "without trial or adjudication of any fact or law" and without Disney "admitting any liability". So read everything below as what California alleged, and what Disney has now agreed to do.

What Disney could see

The complaint starts with what Disney knew. Disney runs Disney+, Hulu and ESPN+, each of which needs an account, and since at least 2019 it has offered a bundle with a common login. Each time a person logs in, the complaint says, Disney collects device identifiers, device type, IP address and viewing activity, and "when a consumer use[s] the same login on different devices, Disney associates those devices with the consumer for advertising purposes". It quotes a Disney executive from a 2019 interview, who said that even ad-free subscriptions give "strong visibility into device ID".

Hold on to that. Disney, in the complaint's account, was very good at knowing that your laptop, your tablet and your television all belonged to you. That was the point of the ad business. Now watch what happened when you asked it to stop.

Marisol's week

Let's make it concrete with a made-up subscriber. Marisol lives in Fresno. She has the bundle, and she watches on three devices: a laptop, a tablet and the television in the lounge. Here is her week, following the methods and gaps the complaint describes.

Monday. Marisol installs Firefox on her laptop and turns on "Tell websites not to sell or share my data". She logs in to the Hulu website. Her browser sends Sec-GPC: 1. According to the complaint, Disney did accept GPC on its streaming websites. It opted her out of sharing with its ad-tech partners—"but only for the specific service and device the consumer was using when they requested to opt-out, even if they were logged in to their Disney account". What the systems record: Hulu, laptop: opted out. Everything else: unchanged.

Tuesday. She watches ESPN+ on her tablet. There is no GPC in that app. Her account is the same account, and Disney knows the tablet is hers. What the systems record: ESPN+, tablet: selling and sharing as normal.

Wednesday. Marisol finds the opt-out toggle in the Disney+ app on her tablet and switches it on. The Attorney General's release says a toggle "only applied the request to the specific streaming service the user was watching, and often only the specific device". What the systems record: Disney+, tablet: opted out. Hulu and ESPN+ on the tablet: unchanged. And so on for every other pair.

Thursday. She has now read the privacy policy, and she fills in Disney's opt-out webform, which sounds like the one form to rule them all. The complaint says the webform stopped sharing only through "the company's own advertising platform". Disney "continued to share those consumers' data with third-party ad-tech partners", through code it embedded in its own websites and apps. What the systems record: Disney's in-house ad platform: opted out. The third-party code on every page and in every app: still sending.

Friday. She sits down in front of the television and looks for an opt-out in the TV app. In many connected TV apps, the complaint says, there was none. The app told her to use a computer or phone to visit the webform—the same webform that, according to the complaint, had no effect on the embedded code sending data from the TV app. "As a result, there was no way for consumers to stop Disney from selling and sharing personal information from these apps."

The complaint does the maths for her. To opt out fully, a bundle subscriber on a computer, a tablet and a TV "would have to express their opt-out choice up to ten times": one toggle for each of three services on each of three devices, plus the webform. "Any one of these methods should have been sufficient."

page_viewtool_use

And even after all ten, some of the TV apps would still have been sending. Marisol has made more phone calls than the pizza shop's best customer, and the holiday shack still has flyers in it.

The sentence to remember

One line in the complaint is worth pinning above your desk. Disney claimed, according to the complaint, that "vendor and technical limitations" hindered its ability to provide an opt-out tied to a person's identity. The complaint's reply: "tellingly, these limitations did not hinder the company from associating devices with specific users for purposes of identity-based advertising." Then, as a general rule:

if a business can associate a consumer's devices with the consumer for advertising purposes, it can and must associate those devices with the consumer for purposes of honoring the consumer's opt-out rights.

That is the principle of the whole case. The graph you built to target a person is the graph you must use to stop targeting them. If your system can join the laptop and the TV for an ad, it can join them for a "no".

The complaint adds a second point that applies to many more businesses than Disney. Labelling a form or a toggle as an opt-out when it does not fully opt people out is deception. "The same is true when a business tells consumers that it honors the Global Privacy Control or other opt out preference signals, when it actually doesn't." A gpc.json file that says true, or a privacy policy that says "we honour GPC", is a claim somebody can test.

utm_source=SELECT

What Disney agreed to do

The judgment gives a specific, public description of what honouring GPC looks like for a business with accounts. For its streaming services, Disney must:

• For a logged-in person who opts out "including through use of an OPT-OUT PREFERENCE SIGNAL", apply the choice "across all DISNEY STREAMING SERVICES" associated with the account.
• For a logged-out person, or one with no account, tell them they may need to log in, or give minimal information, to opt out fully. If they do not, treat the signal as an opt-out for "that browser, application, or device and any consumer profile" tied to it, "including pseudonymous profiles".
• Put a clear opt-out link inside every streaming service, including the apps.
• Give people a way to confirm that the opt-out has been processed, "such as within the settings or preferences menu".
• Avoid cookie preference screens and other choices that could confuse people into thinking they must also be selected to opt out.
• Notify every third party it sold or shared the data with, and tell them to comply and pass the request on.
• Pay US$2,750,000 within 30 days, and run a monitoring programme for three years, with an annual report to the Attorney General.

This is also, according to the release, the seventh CCPA enforcement action by the Attorney General's office, and the second from a sweep of streaming services that began in January 2024. So this is a pattern, not a one-off.

Part 4: What "Honouring" Means When the Signal Arrives

Take the Disney terms away and you find the regulation underneath them. It is short, and it is worth reading slowly, because it answers most of the "but what about…" questions that come up in a tag audit.

The browser, the profile and the person

Section 7025(c)(1) says that when a business receives a valid signal, it must treat it as an opt-out "for that browser or device and any consumer profile associated with that browser or device, including pseudonymous profiles". Then: "If known, the business shall also treat the opt-out preference signal as a valid request to opt-out of sale/sharing for the consumer."

Three layers, then:

1. The browser or device. Always.
2. Any profile tied to it, even without a name. A cookie ID, an advertising ID, a hashed identifier in a customer data platform. If you can link the browser to it, the opt-out follows.
3. The person, if you know who they are. A logged-in account, or any other link you have. Then the opt-out follows the person to their other devices.

The regulation includes two worked examples that could have been written for Marisol. "Caleb" visits with GPC on, not logged in, and the business cannot link his browser to his account. So the opt-out covers his browser identifier only. "Angela" turns on GPC while logged in, so the business applies it to her browser and her account. Later she logs in from a different device without GPC, and the business "shall not interpret the absence of the opt-out preference signal as consent to opt-in". The Disney complaint is, in effect, an allegation that Disney treated every Angela as a Caleb.

What you may and may not do in return

The rest of the section closes the obvious workarounds:

• No extra hoops. A business "shall not require a consumer to provide additional information beyond what is necessary to send the signal". It may offer a way to add details, for example to cover offline sales. If the person ignores the offer, the signal still applies to the browser.
• The signal beats your settings. If the signal conflicts with a site-specific setting that allows sale or sharing, the business must still process the opt-out. It may tell the person about the conflict and ask for consent, following the consent rules.
• Links do not replace signals. A business may choose to post "Do Not Sell or Share" links, but it must process signals either way.
• Frictionless, if you want to drop the links. A business may skip the links only if it processes signals "in a frictionless manner". That means no fee, no change to the person's experience of the product, and no "notification, pop-up, text, graphic, animation, sound, video, or any interstitial content in response to the opt-out preference signal". Displaying whether the person has opted out does not count as friction.⁴

What changed on 1 January 2026

One key word in this section changed at the start of this year. The earlier version of § 7025(c)(6) said a business "may display" whether it had processed the signal. The updated regulations, in force from 1 January 2026, say it "must display whether it has processed the consumer's opt-out preference signal as a valid request to opt-out of sale/sharing on its website", for example with a toggle or radio button that shows the person is opted out. I flagged this in my September post on the new CCPA rules. The Disney judgment's "means by which the CONSUMER can confirm" is the same idea, applied to an account.

So a site that gets GPC right must now also say that it got it right, and do it without a pop-up. The sticker gets a small, polite reply: "Noted." Not a banner shouting "ARE YOU SURE?".

Regulators have been saying this for a while

None of this should be a surprise. The Attorney General's settlement with Sephora in August 2022 was partly about not honouring GPC. Bonta's message then: "There are no more excuses." In September 2025, the California Privacy Protection Agency (CPPA), with the attorneys general of California, Colorado and Connecticut, announced a joint sweep of businesses that may not be honouring GPC. Three weeks later, the CPPA's largest penalty so far, US$1.35 million against Tractor Supply, included a failure to give an effective way to opt out, "including through opt-out preference signals such as Global Privacy Control".

And the research says many sites still get it wrong. A team from Wesleyan and Princeton crawled 11,708 sites three times between December 2023 and April 2024. Among sites that appeared to sell or share data and that used at least one of the standard privacy strings, only 44% opted a GPC visitor out through all of them in December 2023, 43% in February 2024 and 45% in April 2024. The authors call it "widespread disregard for California residents' right to opt out". Their method is worth noting: they read the privacy strings and the gpc.json file from outside, exactly as a regulator could.⁵

So the law is clear, the enforcement is steady, and more than half of the measured sites were failing. The good news is that most of the fix, for most sites, is in the tag layer, which is the one part of this story you can change in a Tuesday afternoon.

Part 5: Wiring It Into Your Tags

aria-labelgtm.js

Your tag manager is the post office at the front door of your site. Every pixel, ping and conversion that leaves goes through it. So that is where you check the seal. The rule is simple: read the signal before any tag fires, and let it decide what may leave.

A word of warning before the code. Google's consent mode guide, as of February 2026, does not mention GPC at all. Consent mode was designed around banners and European consent. So the mapping below is my recommendation, not something Google documents. It follows the regulation, and I will say where you have a choice.

Step 1: Detect it before anything else

In Google Tag Manager, create a Custom JavaScript variable. Call it JS - GPC:

function () {
  return navigator.globalPrivacyControl === true;
}

The strict === true means a browser that does not support GPC returns false, not undefined. Because the value is cached per page load, you can read it at any time on the page and get the same answer.

Every web container includes a "Consent Initialization - All Pages" trigger, which fires before every other trigger, even the Initialization trigger. That is where your consent setup belongs, and it is where the GPC check belongs too.

If you run your own server, or a server-side container, you can also read the header there. The check is the lazy one the spec asked for: the request's Sec-GPC header is exactly "1", or it is not.⁶

Step 2: Map it to consent states

I first wrote about consent mode back in 2022. It now has four main consent types, which I covered in detail last August. Google defines two of them as "sending user data related to advertising to Google" (ad_user_data) and "personalized advertising" (ad_personalization). The other two control storage for ads and for analytics.

Here is how I map GPC to them, and why:

The last row is the one to think about. If your analytics property shares data with ad products—for example, audiences built from analytics and sent to an ad platform—then that flow is sharing, and GPC should stop it. If your analytics is only yours, the signal does not require you to stop measuring. In doubt, deny it and move on. The cost is some measurement; the cost of being wrong in California is set out in Part 3.

In a Consent Mode template, you set the defaults with setDefaultConsentState, and apply the signal with updateConsentState. Google's guide warns against using a raw gtag('consent', 'update', …) inside a template instead. With plain gtag.js, the same logic looks like this, and it must run on every page, before any config or event command:

window.dataLayer = window.dataLayer || [];
function gtag() { dataLayer.push(arguments); }

const gpc = navigator.globalPrivacyControl === true;

gtag('consent', 'default', {
  ad_storage: gpc ? 'denied' : 'granted',
  ad_user_data: gpc ? 'denied' : 'granted',
  ad_personalization: gpc ? 'denied' : 'granted',
  analytics_storage: 'granted', // or your banner's rule
  wait_for_update: 500,
});

Two notes. First, this is a US-style default, which assumes you have no consent banner for these visitors. If you already run a banner with regional defaults, keep it, and add GPC as one more input that can only narrow consent. Google's guide says the more specific region wins, so a US-CA default beats a US one. But the simpler approach is to honour GPC everywhere. The browser has asked. You do not need to check a map first.

Second, if your banner later says "granted", GPC must still win on the advertising types. The regulation says the signal beats a site-specific setting. You may ask for consent, but you cannot quietly override it.

Step 3: Tell Google's ad tags, too

Google has a separate switch for US state laws, called restricted data processing (RDP). When it is on, Google limits how it uses the data to purposes such as ad delivery, measurement and fraud detection. You can set it in the Google tag with 'restricted_data_processing': true, and Google Ads conversion and remarketing tags in GTM have an "Enable Restricted Data Processing" field that can be set from a variable instead of a fixed value. So set it from JS - GPC. Google says conversion tracking still works when RDP is on.

Google also says it reads the signal itself. Its help page, as of February 2026, says that in states that require it, "Google will receive GPC signals directly and trigger RDP mode for those ad requests". That is where a lot of teams stop. Read two more lines of the same page first.

First: "Restricted data processing does not extend to the sending or disclosure of data to third parties that you may have enabled in our products and services". Second: "As of July 1, 2023, restricted data processing is not available in California where the advertiser engages in cross-context behavioral advertising, including Customer Match."⁷

In plain words: Google's own handling of GPC covers Google's own ad requests. By Google's account, it does not even cover third parties you enable inside Google's products. It follows that it does not cover your Meta pixel, your LinkedIn tag, your TikTok pixel or the affiliate script someone added in 2021. And in California, a flag on Google's side is not a substitute for you not sending the data in the first place.

This is Thursday in Marisol's week. Disney's webform, as alleged, stopped Disney's own ad platform and left the third-party code running. A site that relies on "Google handles GPC" makes the same mistake with different logos.

Step 4: Stop the tags that are not Google's

Consent mode only changes the behaviour of Google tags. Every other tag needs its own rule. In GTM, the most direct fix is a trigger exception:

1. Create a trigger, Block - GPC, of type Custom Event, with the event name matching .* (regex) and the condition JS - GPC equals true.
2. Add Block - GPC as an exception on every third-party advertising tag: Meta, LinkedIn, TikTok, Pinterest, affiliate and retargeting tags, and anything that syncs IDs.
3. Leave your first-party analytics tags alone, unless they send data to an ad platform.

If you must keep a vendor's tag for some reason, check what its limited mode does before you rely on it. Meta, for example, offers Limited Data Use, turned on for California with fbq('dataProcessingOptions', ['LDU'], 1, 1000) before the pixel's init call. Meta warns that retargeting and measurement "will be limited". For a person who has said "do not share", not firing the pixel is simpler and easier to defend.⁸

If your site passes GPC status to ad partners through a privacy string, such as the IAB's Global Privacy Platform, update it on the same signal. That is how the USENIX team measured compliance, and it is how your partners learn about the opt-out.

Step 5: If you have accounts, write it down

The tag layer handles the browser. It cannot handle Angela. If people log in to your site or app, the signal must reach the account:

• When a logged-in request arrives with Sec-GPC: 1, or the property is true, record an opt-out on the account in your own database. Not in a cookie. On the account.
• Apply that account flag everywhere the account is used: other browsers, your apps, your TV app if you have one, and your server-side feeds to ad partners.
• Do not clear the flag when a later visit arrives without the signal. The regulation says a business "shall not interpret the absence" of the signal as consent.
• Tell the third parties you have already shared data with, as the Disney judgment requires.
• Show the status in the account settings, and on the site itself.

This is the part that needs a developer and a data owner, not just a tag manager. It is also the part at the centre of the Disney case. Tags stop the flyers at one letterbox. The account flag is how the pizza shop remembers you own the holiday shack.

Part 6: Priya's Checklist

GPC:.1await

Meet Priya, a made-up marketing operations lead at a subscription business with California customers, a website, an app and three ad platforms. Here is her week, and it can be yours.

1. Turn it on and look. Install Firefox, turn on "Tell websites not to sell or share my data", and open your site with the developer tools open. In the console, navigator.globalPrivacyControl should return true. In the Network tab, requests should carry Sec-GPC: 1.
2. Watch what leaves. With GPC on, reload the page and filter the Network tab for your ad vendors' domains. Any request to a third-party ad platform is a question to answer. For Google tags, check that the consent state shows the ad types denied.
3. Test with a clean profile. Use a fresh browser profile with no cookies, so an old cookie choice does not hide a problem.
4. Log in and test again. Log in with GPC on. Then log in from a second browser without GPC. The account should still be opted out. This is the Angela test, and it is the one Disney allegedly failed.
5. Test the apps. If you have mobile or TV apps, find the opt-out inside each one. If an app sends people to a webform, check that the webform actually stops the app's data flows.
6. Check the reply. From 1 January 2026, the site must show whether it processed the signal. Look for a status in the privacy settings or footer. Make sure it is not a pop-up.
7. Read your own promises. Check your privacy policy and /.well-known/gpc.json. If either says you honour GPC, the tests above must pass. A false "yes" is worse than an honest "not yet".
8. List every place data is sold or shared. Pixels, conversion APIs, customer list uploads, server-side feeds, data partners. Each one needs a rule for the GPC flag. If you have been managing consent as a system, this list should already exist.
9. Plan for 2027. When browsers must ship the setting, the share of visitors with GPC on may rise a lot, depending on the defaults. Model what happens to your audiences and remarketing if it does, before it does.

None of this needs a new platform. Most of it is a variable, a trigger exception, a column in a database and a careful afternoon of testing.

Final Thoughts

Go back to the letterbox. The sticker works because nobody has to be rung. It is set once, it applies to everyone who comes to the box, and a delivery person who ignores it is not confused. They have decided to ignore it.

Global Privacy Control is that sticker for the web, and in California it carries the force of law. The signal itself is almost comically small: one header with one character, and one property that is true or false. The hard part is not reading it. The hard part is what the Disney case put in plain words: if you can join a person's devices to sell ads, you can and must join them to stop. The signal has to reach your consent state, your third-party tags, your pseudonymous profiles and, when you know who the person is, their account.

So this week, add the JS - GPC variable, map it to your consent states, add the trigger exception to every tag that is not yours, and run the Angela test with two browsers and one login. Then check that your site says "noted" without a pop-up.

In about ten months, the sticker comes pre-installed in the browsers most people use. Right now you can still test at your own pace, before more of your visitors start sending it. Now, if you'll excuse me, my tea is ready, and nobody has asked me to opt out of it. Yet.