Global Privacy Control (GPC) Signal

Overview

Global Privacy Control (GPC) is a browser-level privacy signal that lets a visitor express a single, persistent opt-out preference to every website they visit — without having to click a "Do Not Sell" link on each one.

When enabled, the browser:

Sends an HTTP request header: Sec-GPC: 1
Exposes a JavaScript property: navigator.globalPrivacyControl === true

Consent Pro checks the browser’s JavaScript signal on initialization. It applies the GPC override to Opt-Out and Do Not Sell banners on managed pages, without restricting it by region. This describes runtime behavior; applicable legal requirements depend on the site and jurisdiction.

The runtime manages consent choices and the confirmation element. Verify downstream tracking, cookie cleanup, and the visibility of the confirmation on your published site.

Scope: Supported banners and managed pages

For an Opt-Out or Do Not Sell instance, the override applies wherever the runtime manages consent and navigator.globalPrivacyControl === true. It has no region allowlist. Opt-In and Informational banners do not apply this override; pages excluded by targeting do not manage it. See Supported Banner Types.

How Visitors Enable GPC

Visitors enable GPC through a supporting browser’s privacy settings or an extension. Availability and default settings depend on the browser and version. Consult the GPC project’s enablement guidance, then verify navigator.globalPrivacyControl on a managed page after reloading.

The following behavior applies to Opt-Out and Do Not Sell instances on managed pages. When Consent Pro loads, it checks navigator.globalPrivacyControl and compares the signal against the stored consent:

Situation	Behavior
No prior consent stored (first visit)	The signal is honored: non-essential categories (analytics, marketing, personalization) are opted out by default, and the `gpc-honored` element is shown.
Stored consent predates the signal	The signal wins. Non-essential categories are opted out automatically, cookies set under them are cleaned up, a new consent record is written, and the banner is re-shown once (see below).
*Stored consent was given after* the signal was honored**	The visitor knowingly overrode the signal, so their choice stands and the `gpc-honored` element stays hidden.
Stored consent already grants nothing	The signal is being respected already, so nothing is written. The `gpc-honored` element is shown.
Signal is switched off after being honored	The opt-out stays in place. An absent signal is never treated as consent to opt back in (§ 7025(c)(5)); the `gpc-honored` element is hidden because there is no longer a signal to honor.
Visitor manually updates preferences	The manual choice overrides the signal from that point on, for as long as the consent cookie lives.

The runtime considers a present signal on each page load. California’s published CCPA regulations, § 7025 address conflicts between an opt-out preference signal and earlier preferences. Consent Pro records when it observed the signal to distinguish earlier stored grants from a later explicit choice. This timestamp cannot prove when the browser setting changed or that a legal consent requirement was met.

Because browsers expose only the current value of navigator.globalPrivacyControl — with no indication of when it was switched on — Consent Pro records when it first observed the signal in the consent cookie, as a gpcHonoredAt timestamp. Comparing that against the consent timestamp is what distinguishes "consent given before the signal arrived" (signal wins) from "consent given knowingly, after the signal was honored" (consent wins). The stamp is written on every consent write made while the signal is active, and cleared on any write made while it is absent — so consent given with GPC switched off is not immune to a signal that arrives later.

Known limitation: if a visitor knowingly overrides the signal and then switches GPC off and on again, that second switch-on is invisible to any website — no browser API exposes it — so the override stands until the consent cookie expires. Verify this limitation against your organization’s requirements.

If you write the fs-consent cookie yourself from a non-Webflow site, you must carry the gpcHonoredAt stamp forward or the consent you write will be revoked on the visitor's next Webflow page view. See Custom Integration.

What the Visitor Sees

The revocation happens only on pages the banner instance is configured to run on. On a page excluded by the instance's page targeting, Consent Pro does not manage consent at all — it would have no way to block trackers or clean up cookies there — so it leaves the stored consent alone until the visitor reaches a page it does manage.

When the signal revokes a stored consent, the banner is shown once more on that page load, carrying the gpc-honored message. This tells the visitor their saved preferences changed and gives them the § 7025(c)(3) opportunity to consent knowingly instead. It happens only on the page load where a category was actually revoked — later visits show the fixed-preferences element as usual.

If a visitor accepts after seeing that notice, the gpc-honored element hides immediately: the signal has stopped being processed, so Consent Pro stops claiming it was.

A GPC-driven opt-out is recorded like any other consent, with action: "reject_all" and source: "gpc", so it appears in the consent log and in CSV exports as an auditable record of the signal having been processed. Its banner_text may be empty, because the record is written before the banner document has finished loading.

GPC has a meaningful effect only on banners where categories are pre-enabled by default. Consent Pro therefore applies GPC behavior on:

Opt-Out banners
Do Not Sell banners

For both types, all categories are enabled on first visit. When a visitor has GPC active, that default is overridden and non-essential categories (analytics, marketing, personalization) are automatically opted out.

The same scope applies to the recency behavior above: a stored consent is only revoked on Opt-Out and Do Not Sell instances.

GPC does not revoke consent on Opt-In or Informational banners in this runtime. Select banner types according to your requirements; this implementation scope does not determine which laws apply.

California Display Requirement (§ 7025(c)(6))

California’s CCPA regulations effective January 1, 2026, § 7025(c)(6), require applicable businesses to display whether they processed an opt-out preference signal.

The runtime shows the gpc-honored element while it is processing the signal and hides it when a later visitor choice overrides it. Verify that the element exists, is visible, and accurately describes your site’s downstream handling. Its presence alone does not establish compliance.

If your banner was generated before the gpc-honored element was added, see Updating an Existing Banner below.

No Configuration Required

GPC support is built into Opt-Out and Do Not Sell banners and works automatically. There is no toggle, setting, or region list to enable. When a visitor has GPC active in their browser, Consent Pro will honor it and display the confirmation.

Consent Pro sets a fs-consent-gpc attribute on the banner, preferences, and fixed-preferences elements, reflecting whether the signal is currently being processed — not merely whether it is present:

fs-consent-gpc="true" — GPC is active and is being honored
fs-consent-gpc="false" — GPC is not active, or the visitor knowingly consented after it was honored

The attribute updates live, so it flips to "false" the moment a visitor accepts cookies while a signal is active.

An element with the attribute fs-consent-element="gpc-honored" is automatically shown when GPC is honored and hidden when it is not. Use this to display a message confirming that the visitor's GPC preference has been respected.

The gpc-honored element is included by default in newly generated Opt-Out and Do Not Sell banners. If your banner was generated before GPC support was added, you can either:

Regenerate the banner from the Consent Pro app (recommended), or
Manually add the element using the markup below.

Place the following HTML inside both your banner element and your Preferences panel:

html

<div fs-consent-element="gpc-honored" class="consent_gpc-honored">
  <div class="consent_gpc-honored-icon w-embed">
    <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="currentColor" class="size-6">
      <path
        fill-rule="evenodd"
        d="M2.25 12c0-5.385 4.365-9.75 9.75-9.75s9.75 4.365
        9.75 9.75-4.365 9.75-9.75 9.75S2.25 17.385 2.25
        12Zm13.36-1.814a.75.75 0 1 0-1.22-.872l-3.236
        4.53L9.53 12.22a.75.75 0 0 0-1.06 1.06l2.25
        2.25a.75.75 0 0 0 1.14-.094l3.75-5.25Z"
        clip-rule="evenodd"
      />
    </svg>
  </div>
  <div class="consent_gpc-honored_text">The GPC signal has been honored.</div>
</div>

Style the consent_gpc-honored element and its children in your site builder or with custom CSS.

Optional: Publishing `/.well-known/gpc.json`

The GPC specification defines an optional, machine-readable support file that websites may host at:

text

/.well-known/gpc.json

This file is a public declaration that your site recognizes and honors GPC. Privacy tools, browser extensions, scanners, and compliance reviewers may check for it.

Do I need it?

No — it is optional. Your site can fully honor GPC without it, because the signal is transmitted directly by the browser with every request. Consent Pro does not require this file to function.

That said, publishing it is a low-effort transparency win and is recommended for audit readiness.

File contents

json

{
  "gpc": true,
  "lastUpdate": "2026-04-28"
}

Field	Description
`gpc`	`true` declares that your site intends to honor GPC requests.
`lastUpdate`	The date this declaration was last reviewed, in ISO format (`YYYY-MM-DD`).

Where to host it

The file must be publicly accessible on your website's domain:

text

https://yourdomain.com/.well-known/gpc.json

Do not host it on the Consent Pro CDN or script domain — this declaration belongs to the website operator, not the CMP vendor.

Best Practice Recommendation

For strongest transparency and audit readiness:

Use an Opt-Out or Do Not Sell banner (Consent Pro handles GPC automatically).
Confirm the gpc-honored element is present in your banner and Preferences panel.
Publish /.well-known/gpc.json on your domain.
Keep the lastUpdate value current when your privacy policies change.

Jurisdiction-specific requirements

The California Privacy Protection Agency publishes current regulations and proposed changes. Check the applicable primary sources when assessing obligations; this page documents product behavior and does not provide an exhaustive legal assessment.

Summary

GPC is a browser-level signal that communicates a user's opt-out preference automatically.
Consent Pro processes GPC on Opt-Out and Do Not Sell instances on managed pages, without a region restriction.
The signal is treated as a live opt-out request, so it overrides consent that was saved before it arrived — and a consent given knowingly after it was honored overrides the signal in turn. The most recent expression of the visitor's preference wins.
Verify tracking behavior and confirmation display; runtime support does not establish legal compliance.
The gpc-honored element is shown whenever the signal is being processed, and is included by default in new Opt-Out and Do Not Sell banners.
Publishing /.well-known/gpc.json is optional but recommended.
No configuration is required — GPC support is built in.

Global Privacy Control (GPC) Signal ​

Overview ​

Scope: Supported banners and managed pages ​

How Visitors Enable GPC ​

How Consent Pro Handles the Signal ​

Recency: Why a Signal Can Override Saved Consent ​

What the Visitor Sees ​

Consent Records ​

Supported Banner Types ​

California Display Requirement (§ 7025(c)(6)) ​

No Configuration Required ​

Banner Behavior and Styling ​

Updating an Existing Banner ​

Optional: Publishing /.well-known/gpc.json ​

Do I need it? ​

File contents ​

Where to host it ​

Best Practice Recommendation ​

Jurisdiction-specific requirements ​

Summary ​