Global Privacy Control (GPC)

Global Privacy Control is a browser-level signal that lets a visitor broadcast, on every site they visit, that they don't want their data sold or shared. Under CCPA/CPRA — and a growing number of US state privacy laws — an opt-out preference signal like GPC must be treated as a valid opt-out request. Some browsers and extensions send it by default.

ConsentLayer detects and honors GPC automatically. There's no code to write.

How ConsentLayer detects it

On page load, the banner reads the browser's navigator.globalPrivacyControl property. When it's true, the visitor is asserting GPC.

Detection is built into banner.js — it happens before the banner would otherwise render, so a GPC visitor is never shown a prompt that ignores their signal.

What it does

When GPC is detected and your site is configured to respect it (the default), ConsentLayer:

1. Skips the banner — the visitor isn't asked, because they've already answered.
2. Auto-records a reject-all decision — every optional category (Statistics, Marketing, …) is set to denied; only required categories stay on.
3. Sets the Do Not Sell flag on the consent record, tying GPC into the same opt-out-of-sale/sharing state a visitor would set manually.
4. Shows a small confirmation toast so the visitor knows their signal was honored.

Blocked trackers stay blocked, exactly as if the visitor had clicked "Reject all."

Reading it in code

The signal is available on the consent state through the SDK:

import { getConsentState } from '@consentlayer/sdk'

const state = getConsentState()
if (state?.gpcSignal) {
  // This visitor arrived with GPC asserted.
}

See the Core SDK reference for the full ConsentState type.

In the consent log

GPC-honored decisions are recorded like any other, with gpcSignal set to true and doNotSell set to true. You can see and export them from the Consent Log — useful as evidence that opt-out signals were respected.