# Global Privacy Control (GPC) Signal ## Overview [Global Privacy Control](https://globalprivacycontrol.org/) (GPC) is a browser-level privacy signal that lets a visitor express a single, persistent opt-out preference to every website they visit — without having to click a "Do Not Sell" link on each one. When enabled, the browser: - Sends an HTTP request header: `Sec-GPC: 1` - Exposes a JavaScript property: `navigator.globalPrivacyControl === true` Consent Pro checks the browser’s JavaScript signal on initialization. It applies the GPC override to **Opt-Out and Do Not Sell banners** on managed pages, without restricting it by region. This describes runtime behavior; applicable legal requirements depend on the site and jurisdiction. The runtime manages consent choices and the confirmation element. Verify downstream tracking, cookie cleanup, and the visibility of the confirmation on your published site. --- ## Scope: Supported banners and managed pages For an Opt-Out or Do Not Sell instance, the override applies wherever the runtime manages consent and `navigator.globalPrivacyControl === true`. It has no region allowlist. Opt-In and Informational banners do not apply this override; pages excluded by targeting do not manage it. See [Supported Banner Types](#supported-banner-types). --- ## How Visitors Enable GPC Visitors enable GPC through a supporting browser’s privacy settings or an extension. Availability and default settings depend on the browser and version. Consult the [GPC project’s enablement guidance](https://globalprivacycontrol.org/#download), then verify `navigator.globalPrivacyControl` on a managed page after reloading. --- ## How Consent Pro Handles the Signal The following behavior applies to Opt-Out and Do Not Sell instances on managed pages. When Consent Pro loads, it checks `navigator.globalPrivacyControl` and compares the signal against the stored consent: | Situation | Behavior | | ----------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **No prior consent stored (first visit)** | The signal is honored: non-essential categories (analytics, marketing, personalization) are opted out by default, and the `gpc-honored` element is shown. | | **Stored consent predates the signal** | The signal wins. Non-essential categories are opted out automatically, cookies set under them are cleaned up, a new consent record is written, and the banner is re-shown once (see below). | | **Stored consent was given _after_ the signal was honored** | The visitor knowingly overrode the signal, so their choice stands and the `gpc-honored` element stays hidden. | | **Stored consent already grants nothing** | The signal is being respected already, so nothing is written. The `gpc-honored` element is shown. | | **Signal is switched off after being honored** | The opt-out stays in place. An absent signal is never treated as consent to opt back in (§ 7025(c)(5)); the `gpc-honored` element is hidden because there is no longer a signal to honor. | | **Visitor manually updates preferences** | The manual choice overrides the signal from that point on, for as long as the consent cookie lives. | --- ## Recency: Why a Signal Can Override Saved Consent The runtime considers a present signal on each page load. California’s [published CCPA regulations, § 7025](https://cppa.ca.gov/regulations/pdf/ccpa_statute_eff_20260101.pdf) address conflicts between an opt-out preference signal and earlier preferences. Consent Pro records when it observed the signal to distinguish earlier stored grants from a later explicit choice. This timestamp cannot prove when the browser setting changed or that a legal consent requirement was met. Because browsers expose only the current value of `navigator.globalPrivacyControl` — with no indication of when it was switched on — Consent Pro records **when it first observed the signal** in the consent cookie, as a `gpcHonoredAt` timestamp. Comparing that against the consent timestamp is what distinguishes "consent given before the signal arrived" (signal wins) from "consent given knowingly, after the signal was honored" (consent wins). The stamp is written on every consent write made while the signal is active, and cleared on any write made while it is absent — so consent given with GPC switched off is not immune to a signal that arrives later. **Known limitation:** if a visitor knowingly overrides the signal and then switches GPC off and on again, that second switch-on is invisible to any website — no browser API exposes it — so the override stands until the consent cookie expires. Verify this limitation against your organization’s requirements. If you write the `fs-consent` cookie yourself from a non-Webflow site, you must carry the `gpcHonoredAt` stamp forward or the consent you write will be revoked on the visitor's next Webflow page view. See [Custom Integration](/runtime/custom-integration#global-privacy-control). ### What the Visitor Sees The revocation happens only on pages the banner instance is configured to run on. On a page excluded by the instance's page targeting, Consent Pro does not manage consent at all — it would have no way to block trackers or clean up cookies there — so it leaves the stored consent alone until the visitor reaches a page it does manage. When the signal revokes a stored consent, the banner is shown once more on that page load, carrying the `gpc-honored` message. This tells the visitor their saved preferences changed and gives them the § 7025(c)(3) opportunity to consent knowingly instead. It happens only on the page load where a category was actually revoked — later visits show the fixed-preferences element as usual. If a visitor accepts after seeing that notice, the `gpc-honored` element hides immediately: the signal has stopped being processed, so Consent Pro stops claiming it was. ### Consent Records A GPC-driven opt-out is recorded like any other consent, with `action: "reject_all"` and `source: "gpc"`, so it appears in the consent log and in CSV exports as an auditable record of the signal having been processed. Its `banner_text` may be empty, because the record is written before the banner document has finished loading. --- ## Supported Banner Types GPC has a meaningful effect only on banners where categories are pre-enabled by default. Consent Pro therefore applies GPC behavior on: - **Opt-Out** banners - **Do Not Sell** banners For both types, all categories are enabled on first visit. When a visitor has GPC active, that default is overridden and non-essential categories (analytics, marketing, personalization) are automatically opted out. The same scope applies to the recency behavior above: a stored consent is only revoked on Opt-Out and Do Not Sell instances. GPC does not revoke consent on Opt-In or Informational banners in this runtime. Select banner types according to your requirements; this implementation scope does not determine which laws apply. --- ## California Display Requirement (§ 7025(c)(6)) California’s [CCPA regulations effective January 1, 2026](https://cppa.ca.gov/regulations/pdf/ccpa_statute_eff_20260101.pdf), § 7025(c)(6), require applicable businesses to display whether they processed an opt-out preference signal. The runtime shows the `gpc-honored` element while it is processing the signal and hides it when a later visitor choice overrides it. Verify that the element exists, is visible, and accurately describes your site’s downstream handling. Its presence alone does not establish compliance. If your banner was generated before the `gpc-honored` element was added, see [Updating an Existing Banner](#updating-an-existing-banner) below. --- ## No Configuration Required GPC support is built into Opt-Out and Do Not Sell banners and works automatically. There is no toggle, setting, or region list to enable. When a visitor has GPC active in their browser, Consent Pro will honor it and display the confirmation. --- ## Banner Behavior and Styling Consent Pro sets a `fs-consent-gpc` attribute on the banner, preferences, and fixed-preferences elements, reflecting whether the signal is currently being **processed** — not merely whether it is present: - `fs-consent-gpc="true"` — GPC is active and is being honored - `fs-consent-gpc="false"` — GPC is not active, or the visitor knowingly consented after it was honored The attribute updates live, so it flips to `"false"` the moment a visitor accepts cookies while a signal is active. An element with the attribute `fs-consent-element="gpc-honored"` is automatically shown when GPC is honored and hidden when it is not. Use this to display a message confirming that the visitor's GPC preference has been respected. ### Updating an Existing Banner The `gpc-honored` element is included by default in newly generated **Opt-Out** and **Do Not Sell** banners. If your banner was generated before GPC support was added, you can either: 1. **Regenerate the banner** from the Consent Pro app (recommended), or 2. **Manually add the element** using the markup below. Place the following HTML inside both your **banner** element and your **Preferences** panel: ```html
The GPC signal has been honored.
``` Style the `consent_gpc-honored` element and its children in your site builder or with custom CSS. --- ## Optional: Publishing `/.well-known/gpc.json` The GPC specification defines an optional, machine-readable support file that websites may host at: ```text /.well-known/gpc.json ``` This file is a public declaration that your site recognizes and honors GPC. Privacy tools, browser extensions, scanners, and compliance reviewers may check for it. ### Do I need it? **No** — it is optional. Your site can fully honor GPC without it, because the signal is transmitted directly by the browser with every request. Consent Pro does not require this file to function. That said, publishing it is a low-effort transparency win and is recommended for audit readiness. ### File contents ```json { "gpc": true, "lastUpdate": "2026-04-28" } ``` | Field | Description | | ------------ | -------------------------------------------------------------------------- | | `gpc` | `true` declares that your site intends to honor GPC requests. | | `lastUpdate` | The date this declaration was last reviewed, in ISO format (`YYYY-MM-DD`). | ### Where to host it The file must be publicly accessible on **your website's domain**: ```text https://yourdomain.com/.well-known/gpc.json ``` Do **not** host it on the Consent Pro CDN or script domain — this declaration belongs to the website operator, not the CMP vendor. --- ## Best Practice Recommendation For strongest transparency and audit readiness: 1. Use an Opt-Out or Do Not Sell banner (Consent Pro handles GPC automatically). 2. Confirm the `gpc-honored` element is present in your banner and Preferences panel. 3. Publish `/.well-known/gpc.json` on your domain. 4. Keep the `lastUpdate` value current when your privacy policies change. --- ## Jurisdiction-specific requirements The [California Privacy Protection Agency](https://www.cppa.ca.gov/regulations/) publishes current regulations and proposed changes. Check the applicable primary sources when assessing obligations; this page documents product behavior and does not provide an exhaustive legal assessment. --- ## Summary - GPC is a browser-level signal that communicates a user's opt-out preference automatically. - Consent Pro processes GPC on **Opt-Out and Do Not Sell instances on managed pages**, without a region restriction. - The signal is treated as a live opt-out request, so it overrides consent that was saved before it arrived — and a consent given knowingly after it was honored overrides the signal in turn. The most recent expression of the visitor's preference wins. - Verify tracking behavior and confirmation display; runtime support does not establish legal compliance. - The `gpc-honored` element is shown whenever the signal is being processed, and is included by default in new Opt-Out and Do Not Sell banners. - Publishing `/.well-known/gpc.json` is optional but recommended. - No configuration is required — GPC support is built in.