Skip to content

CCPA mentioned but no /.well-known/gpc.json discovery file referenced

A /.well-known/gpc.json file is a small, standard text file that formally declares a site supports Global Privacy Control (GPC), so tools and regulators can check GPC support programmatically instead of guessing from behaviour alone. This check looks for that file when the privacy policy mentions CCPA (California Consumer Privacy Act). On this site, CCPA is mentioned, but no gpc.json discovery file was found. A coordinated multi-state enforcement sweep across California, Colorado, Connecticut, and New Jersey on 9 September 2025 treats this discovery file as a required signal. Without it, regulators and automated compliance tools cannot programmatically confirm how the site handles GPC, which weakens the site's evidence trail if its GPC handling is ever formally reviewed. Your developer should publish a /.well-known/gpc.json file declaring GPC support, with a gpc field set to true and a lastUpdate field holding today's date in ISO format (YYYY-MM-DD). This is one of the fastest fixes in this whole audit, around five minutes of work for a developer who already has hosting access.

Why this matters

A coordinated multi-state enforcement sweep across California, Colorado, Connecticut, and New Jersey on 9 September 2025 treats this discovery file as a required signal. Without it, regulators and automated compliance tools cannot programmatically confirm how the site handles GPC, which weakens the site's evidence trail if its GPC handling is ever formally reviewed.

How to fix it

Your developer should publish a /.well-known/gpc.json file declaring GPC support, with a gpc field set to true and a lastUpdate field holding today's date in ISO format (YYYY-MM-DD). This is one of the fastest fixes in this whole audit, around five minutes of work for a developer who already has hosting access.