Global Privacy Control (GPC)

Global Privacy Control (GPC) is a browser-level signal that tells websites the visitor does not want their personal information sold or shared. The TrueVault CMP treats a GPC signal as an opt-out of the sale or sharing of personal data (Targeted Advertising) and passes that opt-out to each of its integrations.

This article covers how the CMP detects the signal, what it changes, and what has to be in place for each integration to honor it.

Sending a GPC Signal

The visitor's browser sends the signal, so your site doesn't need to set anything up. A browser that follows the GPC specification exposes navigator.globalPrivacyControl === true to page scripts and adds a Sec-GPC: 1 header to its requests. The CMP reads the navigator.globalPrivacyControl property in the browser.

Visitors can send the signal in two ways:

• Browsers with built-in support, such as Firefox and DuckDuckGo.
• Browser extensions that implement the GPC specification, for browsers without built-in support.

To check whether a browser is sending the signal, run the following in the developer console:

navigator.globalPrivacyControl // true when GPC is enabled

Where GPC Applies

The CMP honors GPC for every visitor, in every region. While the signal is on, the consent cookie records the visitor as opted out (notOptedOut: false), and integrations that read it receive the opt-out. That includes tv_not_opted_out in GTM and sale_of_data in Shopify.

Some parts of the opt-out are US and Canada mechanisms, so they run for visitors there: the us_privacy cookie, the opt-out submitted to TrueVault, ga-disable, Meta Limited Data Use, and the GPP opt-out fields. In the US, these run in every state, even when your organization has residency confirmation turned on and the visitor isn't in a state with an opt-out law.

What a GPC Signal Triggers

When the CMP loads and detects a GPC signal for a visitor who hasn't already been opted out, it does the following:

1. Records the opt-out in the browser. It sets the us_privacy cookie to opted out and sets notOptedOut: false in the consent cookie.
2. Submits an opt-out to TrueVault. It sends a GPC opt-out for your Privacy Center to TrueVault, once per browser. A polaris_auto_optout_submitted value in local storage records that the opt-out was sent, so it isn't sent again.
3. Updates the consent banner. It turns off the Targeted Advertising toggle and disables it, with the message "GPC signal detected, honoring your opt-out preference." By default, this also turns off Advertising, until the visitor makes their own choice in the banner.
4. Decorates opt-out links. It appends "(GPC Opt-Out Signal Honored)" to the text of your Privacy Center opt-out links.
5. Notifies integrations. It fires the consentChanged event and updates the integrations described below.

GPC opt-outs are automatic, so they don't fire the one-time consent events that track a visitor's own choices.

Integration Summary

Integration	What GPC triggers	What must be in place
Google Tag Manager	tv_not_opted_out and ad_personalization are set to denied	The TrueVault CMP GTM template, plus tags that require tv_not_opted_out
Shopify Customer Privacy API	sale_of_data is set to false	A Shopify storefront running the CMP, plus pixels with privacy settings configured
Google Analytics ga-disable	window['ga-disable-<GA_ID>'] is set to true	Your GA ID in the TrueVault Google Analytics integration, with data sharing left on in GA
Meta Limited Data Use	fbq('dataProcessingOptions', ['LDU'], 1, 1000) is called	polaris.js loads before the Meta base pixel code
GPP string	Gpc is true, and the opt-out fields are set to opted out	Nothing beyond the CMP; vendors read the string themselves

Google Tag Manager

The TrueVault CMP GTM template maps the opt-out to these consent signals:

• tv_not_opted_out is set to denied.
• ad_personalization is set to denied when Targeted Advertising applies to your organization and the visitor. See How ad_personalization Is Derived.
• ad_storage and ad_user_data are also set to denied when the CMP turns off Advertising, as described in step 3 above.

What must be in place:

• The TrueVault CMP template and tag, on the latest template version.
• tv_not_opted_out as an additional consent requirement on every tag that should be blocked for opted-out visitors. See US & Canada Opt Outs.
• The Consent Changed trigger on those tags. On a visitor's first page view, the opt-out reaches GTM as a consent update shortly after the page loads, after GTM has applied its default consent state.

Shopify Customer Privacy API

The CMP calls window.Shopify.customerPrivacy.setTrackingConsent() with sale_of_data: false. This happens with every banner type, including informational banners and no banner. See Opt-Out Signals and sale_of_data.

What must be in place:

• The CMP running on your Shopify storefront. The CMP loads Shopify's Customer Privacy API itself.
• Shopify App Pixels and Custom Pixels whose privacy settings require the right consent categories. Shopify, not the CMP, decides which pixels run. See Shopify App Pixel Consent.

Google Analytics ga-disable

The CMP sets window['ga-disable-<GA_ID>'] = true, which stops Google Analytics from sending data for that property. See Google Analytics ga-disable Flag.

What must be in place:

• Your GA ID configured in the TrueVault Google Analytics integration settings.
• The survey question about turning off data sharing in Google Analytics answered No (or left unanswered). If you answer Yes, the CMP doesn't manage ga-disable for GA.
• The flag set before GA sends a hit. The CMP sets the flag during initialization. To block GA hits for opted-out visitors on their first page view, also add tv_not_opted_out as a consent requirement on your GA tags in GTM.

Meta Limited Data Use

When the visitor is opted out, the CMP enables Meta's Limited Data Use (LDU) data processing option before the Meta Pixel initializes:

fbq('dataProcessingOptions', ['LDU'], 1, 1000)

The CMP watches for the Meta base pixel code to define window.fbq, then makes this call before the pixel's fbq('init', ...) runs. This doesn't require any changes to your pixel code.

What must be in place:

• polaris.js loads before the Meta base pixel code. If the pixel initializes before the CMP loads, LDU isn't applied on that page.
• To keep the Meta Pixel from loading at all for opted-out visitors, add tv_not_opted_out as a consent requirement on your Meta tags in GTM.

GPP String

The CMP reflects the opt-out in the IAB Global Privacy Platform (GPP) datastore:

• Gpc is set to true.
• The opt-out fields that apply to your organization, such as SaleOptOut and SharingOptOut, are set to 1 (opted out).

What must be in place: nothing beyond the CMP itself. The GPP API is available on every page where the CMP is installed. Vendors that support GPP read the string through window.__gpp() and apply the opt-out themselves.

Persistence

The opt-out is stored in the us_privacy cookie, so it stays in place on later visits even if the visitor turns GPC off. While the GPC signal is on, the Targeted Advertising toggle stays off and can't be changed. To opt back in, the visitor has to turn GPC off and then turn Targeted Advertising back on in the banner.

Testing GPC

1. Turn on GPC in your browser. In Firefox, go to Settings → Privacy & Security and turn on Tell websites not to sell or share my data. In other browsers, install a GPC extension.
2. Clear your site data so the CMP sees you as a new visitor. See How do I clear the location cache when testing polaris.js?
3. Load your site from a US or Canadian location.
4. Check each integration in the developer console:

// GPC signal
navigator.globalPrivacyControl // true

// GPP string
window.__gpp('ping', (data) => console.log(data.gppString)) // decode at https://iabgpp.com; Gpc should be true

// Shopify
window.Shopify.customerPrivacy.saleOfDataAllowed() // false

// Google Analytics (replace with your GA ID)
window['ga-disable-G-XXXXXXXXXX'] // true

5. In GTM Preview mode, confirm that tv_not_opted_out is denied and that tags requiring it don't fire.
6. Confirm that Meta Pixel requests include LDU parameters (for example, dpo=LDU in the facebook.com/tr requests on the Network tab).

Further Reading

• Global Privacy Control
• GPC specification
• US & Canada Opt Outs
• IAB Global Privacy Platform (GPP)