Imported from mukul975/Privacy-Data-Protection-Skills (plugins/cookie-consent-skills/skills/gpc-cookie-integration/SKILL.md). Install upstream with npx skills add mukul975/Privacy-Data-Protection-Skills --skill gpc-cookie-integration. Copyright stays with the author (Apache-2.0).

Global Privacy Control Integration with Cookie Consent

Overview

Global Privacy Control (GPC) is a browser-level signal that communicates a user's privacy preferences to websites. Specified by the GPC community group and recognized as a legally binding opt-out mechanism under California's CCPA/CPRA (effective January 1, 2023), Colorado's CPA (effective July 1, 2024), Connecticut's CTDPA (effective July 1, 2023), and other US state privacy laws, GPC transmits a Sec-GPC: 1 HTTP header and a navigator.globalPrivacyControl JavaScript property with each request. Websites must detect this signal and automatically trigger opt-out of sale, sharing, and targeted advertising without requiring additional user action. Integration with cookie consent management platforms (CMPs) is essential to ensure the GPC signal correctly suppresses advertising cookies and data sharing.

GPC Signal Specification

How GPC Works

HTTP Header:

Sec-GPC: 1

Present on every HTTP request when the user has enabled GPC in their browser or browser extension.

JavaScript API:

navigator.globalPrivacyControl  // Returns true if GPC is enabled

GPC-Enabled Browsers and Extensions:

GPC vs. Do Not Track (DNT)

US State Law Mapping

GPC Legal Requirements by State

What GPC Triggers

When GPC is detected for a user in an applicable jurisdiction:

CMP Integration

Detection and Response Flow

Page Load
    │
    ├── Check for GPC signal
    │   ├── navigator.globalPrivacyControl === true
    │   │   OR
    │   └── Server detects Sec-GPC: 1 header
    │
    ├── Determine user jurisdiction
    │   ├── IP geolocation → US state mapping
    │   └── Check if state has GPC legal requirement
    │
    ├── If GPC detected AND applicable jurisdiction:
    │   ├── Automatically set consent state:
    │   │   ├── ad_storage: denied
    │   │   ├── ad_user_data: denied
    │   │   ├── ad_personalization: denied
    │   │   ├── analytics_storage: [per CMP default — GPC does not cover]
    │   │   └── sale_of_data: opted_out
    │   │
    │   ├── Block advertising cookies and tags
    │   ├── Do NOT fire: Meta Pixel, Google Ads remarketing, third-party ad tags
    │   ├── DO fire: GA4 (if analytics consent separate from GPC)
    │   │
    │   ├── Display modified banner (optional):
    │   │   "We detected your Global Privacy Control preference.
    │   │    We will not sell or share your personal information.
    │   │    [Manage Other Preferences]"
    │   │
    │   └── Record GPC opt-out in consent log
    │
    └── If GPC detected but NON-applicable jurisdiction (e.g., EU):
        └── Treat as privacy signal but apply jurisdiction's own rules
            (EU still requires opt-in consent regardless of GPC)

Implementation for Pinnacle E-Commerce Ltd

Server-Side GPC Detection (Node.js middleware):

function detectGPC(req, res, next) {
  const gpcHeader = req.headers['sec-gpc'];
  const gpcEnabled = gpcHeader === '1';

  req.gpcSignal = gpcEnabled;

  if (gpcEnabled) {
    // Determine jurisdiction from IP
    const userState = geolocateToState(req.ip);

    // States where GPC is legally binding
    const gpcMandatoryStates = ['CA', 'CO', 'CT', 'MT', 'TX', 'OR', 'DE', 'NH', 'NJ'];

    req.gpcLegallyBinding = gpcMandatoryStates.includes(userState);
    req.gpcOptOut = {
      sale: gpcEnabled && req.gpcLegallyBinding,
      sharing: gpcEnabled && req.gpcLegallyBinding,
      targetedAdvertising: gpcEnabled && req.gpcLegallyBinding,
    };
  }

  next();
}

Client-Side GPC Detection and CMP Update:

function handleGPCSignal() {
  const gpcEnabled = navigator.globalPrivacyControl === true;

  if (!gpcEnabled) return;

  // Get user's jurisdiction (from server or geolocation)
  const userJurisdiction = getUserJurisdiction();
  const gpcBindingStates = ['CA', 'CO', 'CT', 'MT', 'TX', 'OR', 'DE', 'NH', 'NJ'];

  if (gpcBindingStates.includes(userJurisdiction)) {
    // Update Google Consent Mode
    gtag('consent', 'update', {
      'ad_storage': 'denied',
      'ad_user_data': 'denied',
      'ad_personalization': 'denied',
      // analytics_storage not affected by GPC
    });

    // Update CMP state
    updateCMPState({
      sale_optout: true,
      sharing_optout: true,
      targeted_advertising_optout: true,
      source: 'gpc_signal',
    });

    // Remove any existing advertising cookies
    removeAdvertisingCookies();

    // Log GPC opt-out
    logConsentEvent({
      type: 'gpc_auto_optout',
      jurisdiction: userJurisdiction,
      timestamp: new Date().toISOString(),
      gpc_header_present: true,
    });
  }
}

function removeAdvertisingCookies() {
  const adCookies = ['_fbp', '_fbc', '_gcl_au', 'IDE', 'fr', 'NID'];
  adCookies.forEach(name => {
    document.cookie = `${name}=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/; domain=.pinnacle-ecommerce.com`;
  });
}

// Run on page load
handleGPCSignal();

CMP Platform Integration

OneTrust GPC Configuration:

Cookiebot GPC Configuration:

GPC Verification and Compliance

Testing GPC Integration

CCPA/CPRA Specific Requirements

Under California Attorney General regulations (11 CCR §7025):

1. No degradation of service: A business must not interpret GPC as consent to financial incentive opt-in
2. Conflict resolution: If a user has previously opted in to sale/sharing, GPC on a subsequent visit should be treated as a revocation of that opt-in
3. No re-prompting: Do not ask a GPC user to reconsider their opt-out choice
4. Record keeping: Maintain records of GPC-triggered opt-outs for 24 months
5. Privacy policy disclosure: State in the privacy policy that the business honors GPC

Pinnacle E-Commerce Ltd Privacy Policy Language:

"We recognize the Global Privacy Control (GPC) signal sent by your browser. When we detect a GPC signal from a user in California, we treat it as a request to opt out of the sale and sharing of personal information as defined under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA). We apply this opt-out automatically without requiring any additional action from you."

Edge Cases

Key Legal and Technical References

• GPC Specification (globalprivacycontrol.org) — Technical specification for the GPC signal
• CCPA/CPRA Cal. Civ. Code §1798.135(e) — Business must treat GPC as valid opt-out request
• 11 CCR §7025(b)-(c) (California AG Regulations) — GPC implementation requirements
• Colorado CPA Rules, 4 CCR 904-3, Rule 5.11 — Universal opt-out mechanism requirements including GPC
• Connecticut CTDPA P.A. 22-15, §6(a)(6) — Opt-out preference signal requirement
• California AG Enforcement Action: Sephora (August 2022) — First CCPA enforcement for failure to honor GPC; $1.2 million settlement
• EDPB Statement on GPC (2023) — European perspective on GPC as an expression of Article 21 objection right
• W3C Privacy Community Group — GPC specification development
• IAB CCPA Compliance Framework — US Privacy String and GPC interoperability