Global Privacy Control (GPC)

Overview

Global Privacy Control (GPC) is a formal specification for an "opt-out preference signal" referenced in California privacy regulations including the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA). California's Attorney General has declared support for GPC and begun enforcing compliance with GPC signals.

Native Support in Freshpaint Consent Management

Freshpaint Consent Management (FPCM) automatically detects and honors the Global Privacy Control signal. The system checks whether navigator.globalPrivacyControl is set to true in visitors' browsers and automatically applies opt-out preferences when appropriate.

Geographic Restrictions

GPC is only honored for users in the United States, where regulations like CPRA provide stronger legal backing for the signal. While the GPC signal is available globally in supporting browsers, Freshpaint will only apply automatic opt-outs for users geolocated to the US.

This geographic restriction ensures compliance with jurisdictions that have formally adopted GPC while avoiding unintended privacy impacts in regions without GPC regulations.

How It Works

1

Detection

Freshpaint checks if navigator.globalPrivacyControl === true and the user is located in the United States.

2

Automatic Opt-Out

If GPC is detected and the user has not yet made explicit consent choices, all consent categories are automatically set to false (opted out).

3

User Interface Updates

The consent modal displays a notification informing the user that their opt-out preference signal has been detected and is being honored.

4

Respect for Explicit Consent

If a user has already made explicit consent choices (by interacting with your consent modal), GPC will NOT override their preferences.

Example Scenarios

Scenario 1: New visitor with GPC enabled

• User has GPC enabled in their browser

• User is located in California, US

• User has not previously interacted with your consent modal

• Result: All consent categories default to opted-out, user sees GPC notification

Scenario 2: Returning visitor with GPC who previously gave consent

• User has GPC enabled in their browser

• User is located in the US

• User previously accepted analytics consent on your site

• Result: User's previous consent choice is respected, GPC does not override it, user sees notification that GPC was detected but not applied

Scenario 3: Visitor with GPC enabled outside the US

• User has GPC enabled in their browser

• User is located in the EU

• Result: GPC is not applied (no automatic opt-out), normal consent flow applies

User Interface Changes

When GPC is detected, FPCM automatically updates the user interface:

Consent Modal Footer

A notice appears at the bottom of the consent modal, below the action buttons:

Preferences Modal

A notification section is added at the top of the preferences modal, before the consent categories:

• Title: "Opt-Out Signal Detected"

• Description: "Your browser is sending a Global Privacy Control signal. Your opt-out preference is being honored."

Tracking and Analytics

Freshpaint automatically tracks GPC-related data in consent events with two properties:

• $consent_gpc_signal: Boolean indicating whether the GPC signal was detected (true/false)

• $consent_gpc_applied: Boolean indicating whether the GPC signal triggered automatic opt-out behavior (true/false)

Example Event Properties

{
  "$consent_gpc_signal": true,
  "$consent_gpc_applied": true,
  // ... other consent properties
}

Frequently Asked Questions

Does GPC apply to users outside the United States?

No. Freshpaint only honors GPC for users geolocated to the United States, where CPRA and CCPA provide legal backing for the signal.

Will GPC override my users' consent choices?

No. If a user has already made explicit consent choices by interacting with your consent modal, those choices take precedence over GPC.

Do I need to modify my Freshpaint configuration to support GPC?

No. GPC support is built into Freshpaint Consent Management and works automatically. No configuration changes are required.

How do I know if GPC is being applied for my users?

Check the $consent_gpc_signal and $consent_gpc_applied properties in your consent events. You can also monitor browser console logs for GPC-related messages.

Example console message:

[Freshpaint] Global Privacy Control detected - will apply default opt-out

What happens if a user disables GPC after previously visiting my site?

Freshpaint will respect any explicit consent choices the user has already made. If they had no previous consent choice, they'll see the normal consent modal without GPC opt-out applied.