Ads tracking ignores Global Privacy Control
Short answer: If you sell or share personal data for advertising and California’s privacy law applies to you, yes: the CCPA regulations (§7025) say a GPC signal is a valid request to opt out. Colorado, Connecticut and other states have similar rules, and California fined Sephora in 2022 partly for ignoring GPC. The site shouldn’t load ad trackers for that visitor.
Do websites have to honour Global Privacy Control (GPC)?
We visited with Global Privacy Control switched on, the browser signal that says “don’t sell or share my data”. Advertising trackers still loaded.
California requires businesses that sell or share personal data to treat GPC as a valid opt-out, and Colorado, Connecticut and other states have similar rules. California has fined companies for ignoring it. In the EU, the GDPR also lets people object by automated signals.
Check it yourself in two minutes
Use a browser with GPC on (Firefox, Brave or DuckDuckGo have it, or a GPC extension).
Open your site in a private window and open DevTools → Network.
Reload and look for ad pixels such as Meta, TikTok or Google Ads. With GPC on, they shouldn’t load.
In the console, navigator.globalPrivacyControl should say true.
How to fix it
- Turn on your consent tool’s GPC setting, so advertising tags don’t load when the browser sends GPC.
- Or check navigator.globalPrivacyControl before loading ad pixels, and treat the visitor as opted out.
- Optionally show “Opt-Out Request Honored” so visitors can see it worked.
How untick detects it
When a normal first visit loads advertising trackers without a choice (no consent banner, or a US-style “Do not sell or share” link), a second fresh visitor comes with GPC switched on: the Sec-GPC: 1 header and navigator.globalPrivacyControl. If advertising, social or marketing trackers still load, we report them. Analytics alone isn’t counted.
Every finding comes with screenshots, the evidence we collected and a fix for your setup. How a scan works.
Questions people ask
Does GPC matter in Europe?
EU sites already need consent before tracking, so a visitor who hasn’t accepted shouldn’t be tracked anyway. The GDPR also lets people object by automated means (Art. 21(5)), but regulators haven’t settled whether GPC counts, so untick only judges GPC where opt-out rules apply.
How do I honour GPC?
Most consent tools have a GPC setting for US visitors. Or check navigator.globalPrivacyControl before loading ad pixels and treat the visitor as opted out, without a pop-up or extra step.