Global Privacy Control (GPC) signal is not technically honored
This check requests the site with the Sec-GPC: 1 header, the technical signal a browser sends when a visitor has turned on Global Privacy Control to opt out of data sale or sharing, and then checks whether the site's behaviour actually changes. On this site, the same tracking cookies were set regardless of whether the opt-out signal was present, meaning GPC is being ignored in the site's actual server logic, not just left undocumented.
Why this matters
If California's CCPA/CPRA applies to you, the regulations require businesses to treat a Global Privacy Control signal as a valid opt-out request, meaning tracking and data sharing actually stop. A site that claims to respect GPC while still setting the same cookies may attract regulator attention, since the behaviour can be tested the same way this check tested it. Whether the law applies to you depends on your size, data and where your visitors are, so check with a privacy adviser.
How to fix it
Your developer and privacy lead need to wire the GPC signal into the site's consent and tracking logic so that when Sec-GPC: 1 is present, it's treated as an opt-out of sale and sharing, suppressing advertising and analytics cookies and third-party data sharing. Most consent platforms, including OneTrust, Osano, and Ketch, support automatic GPC handling once it's switched on, so this is often about a day of configuration rather than custom code.
Turn website findings into an action plan
Create an account to start a Full Audit of your website, with supporting evidence and a prioritised action plan.
Start Full Audit