Global Privacy Control

Getting started with Global Privacy Control.

What GPC is, how to scan your site for the problems regulators and plaintiffs look for, and how GPC opt-outs flow into your DSR queue.

What is GPC?

Global Privacy Control (GPC) is a browser signal that tells a website a visitor does not want their data sold or shared. It shows up two ways: a Sec-GPC: 1 header on every request, and a navigator.globalPrivacyControl value that returns true on the front end.

Visitors turn GPC on in their browser. Brave and DuckDuckGo send the signal by default, Firefox offers it in settings, and Chrome, Safari, and Edge support it through a privacy extension.

Where you have to honor it

At least a dozen states now require you to honor GPC, including California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, and Texas. In those states, GPC is a legal opt-out. When a visitor arrives with it on, stop selling or sharing their data and be ready to show you did. California also requires you to show the visitor their opt-out was honored, so silent suppression is not enough.

What the module does

Open ai.trustsuperset.com/gpc. It scans your live site under three conditions, on initial load, after "Accept All," and with GPC enabled, and shows where you stand on two things at once:

GPC Do trackers stop when a visitor has GPC on?
CIPA Does your cookie banner actually gate tracking before a visitor consents? Trackers that fire before consent are, believe it or not, wiretapping exposure under the California Invasion of Privacy Act (CIPA), with potential statutory damages of $5,000 per violation. There are a lot of lawsuits going around for improperly configured cookie banners, and this scan runs the same test a plaintiff's firm would.

The rest of this guide covers three things: running the scan, capturing GPC opt-outs as DSRs, and fixing what the scan flags.

Run the scan

The walkthrough runs four checks. Each one returns a pass or a flag, with the numbers behind it.

Website Scan Counts third-party requests, tracking domains, and trackers under each condition. This is the baseline the other steps read from. Expand View full reports for the detail, then click Continue to Cookie Banner Check.
Cookie Banner Superset clicks "Accept All" and checks whether tracking was gated before consent. A banner that does not block tracking until a visitor accepts gets flagged. That is your CIPA exposure.
GPC Trackers Loads your site with GPC on and compares the tracker count to initial load. Trackers that still fire are flagged as not honoring the signal.
GPC Opt-Outs Your standing dashboard: compliance score, GPC opt-out requests over the last 30 days, and signals seen in the last 30 days and 24 hours. Requests flowing in plus a clean score means it is working.

Capture GPC opt-outs as DSRs

Route detected signals into the same queue as everything else.

A detected signal has to become a request your team or your automation acts on. Superset routes captured GPC opt-outs into the same DSR queue as your webform, email, and DROP requests, so your existing automation applies. Wiring it up takes two steps.

Detect the signal. Read the Sec-GPC: 1 header server-side, or navigator.globalPrivacyControl on the front end. Use whichever fits your stack.
Post it to Superset. Send the opt-out to the /dsr/new/ endpoint with three fields:
"origin": "GPC" "request_type": "erasure" "email": "{consumer email}"

The request lands in your DSR Manager queue at ai.trustsuperset.com/dsars/manage tagged GPC, and your erasure and opt-out automation applies. Full API docs are at docs.trustsuperset.com. Your API key is already on the platform; email [email protected] if you need a new one.

Heads up This capture path works when you can tie the visitor to an email, so it covers logged-in or otherwise identifiable visitors. For anonymous visitors, honoring GPC means not firing trackers in the first place. That is a job for cookie consent, covered next.

Fix what the scan flags

A flag on the Cookie Banner or GPC Trackers step means your site is exposed today: trackers are firing on visitors who have not consented, or who have opted out through GPC. The standard way to close that gap is a cookie consent platform, also known as a Consent Management Platform (CMP): the tool that runs your cookie banner and decides what is allowed to load. A CMP reads the GPC signal and suppresses tracking for visitors who have it on, and it holds everyone else's trackers until they consent. That handles the anonymous visitors from the note above and the cookie-banner flag from Step 2.

When you set it up, "accept all" and "reject all" should take the same number of clicks, honoring the "symmetry in choice" required by privacy regulations. An asymmetric banner is a risk.

Re-run the scan to confirm tracking only fires with consent. Email [email protected] if you need help.

Important

Match your privacy policy to what your site does. Do not claim GPC handling you have not shipped.
It is one queue. Webform, Privacy Inbox, DROP, and GPC all land in the same DSR Manager, under the automation you have already set.
Re-scan after site changes. New tags creep in, and a clean scan can flag after a marketing update.

Welcome to Superset GPC If anything in this guide doesn't behave the way it says, email [email protected] and we'll dig in.