Global Privacy Control (GPC) signal is not technically honored

This check requests the site with the Sec-GPC: 1 header, the technical signal a browser sends when a visitor has turned on Global Privacy Control to opt out of data sale or sharing, and then checks whether the site's behaviour actually changes. On this site, the same tracking cookies were set regardless of whether the opt-out signal was present, meaning GPC is being ignored in the site's actual server logic, not just left undocumented. California's CCPA/CPRA (California Consumer Privacy Act / Privacy Rights Act) regulations, effective January 2026, require honouring GPC technically, meaning tracking actually stops, not just stating respect for it in a privacy policy. Any site that claims to respect GPC while still setting the same cookies regardless carries direct enforcement risk, since regulators can test this exact behaviour the same way this check did. Your developer and privacy lead need to wire the GPC signal into the site's consent and tracking logic so that when Sec-GPC: 1 is present, it's treated as an opt-out of sale and sharing, suppressing advertising and analytics cookies and third-party data sharing. Most consent platforms, including OneTrust, Osano, and Ketch, support automatic GPC handling once it's switched on, so this is often about a day of configuration rather than custom code.