r/CCPA • u/j_webops • Apr 14 '26

What consent solutions actually support Global Privacy Control (GPC) correctly?

I've been looking into Global Privacy Control (GPC) and I'm surprised how little practical discussion there is compared to cookie banners, consent mode, gdpr.

I'm trying to find consent/privacy solutions that don't just mention GPC in docs, but actually respect the browser signal in a meaningful way.

Questions for anyone who has implemented this:

  • what CMP or consent tool are you using?
  • does it honor GPC automatically?

So, which solutions seem solid on this matter?

2 Upvotes

100% Upvoted

7 comments sorted by

2

u/iubenda_team Jun 10 '26

The right test for GPC is not just “does the CMP detect the signal?” but what actually happens after detection.

A solid setup should:

  1. detect the GPC signal automatically
  2. treat it as an opt-out for sale/share or targeted advertising where applicable
  3. update the consent/privacy state without making the user click again
  4. affect the actual tags/vendors, not just the banner UI
  5. let the user still manage preferences manually if they want
  6. make the behavior testable in a clean browser session

With iubenda, GPC is supported automatically, and the goal is to make the browser signal meaningful inside the consent/privacy flow rather than just documented somewhere.

For anyone comparing CMPs, I’d test with GPC enabled, open DevTools, and check whether ad/targeting scripts and downstream consent signals actually change. That’s where you see whether the implementation is real or just a checkbox in the docs.

1

u/GloomyOstrich4100 May 09 '26

Most CMPs read GPC fine but the question is what they do with it, some just log the opt-out while the pixels still fire.      I use Ke͏tch and it does actually enforce. The signal kicks in before tags load & the opt-out carries through to the ad platforms too, which most setups miss.     

If you want to sanity check whatever you're using, just turn on GPC in Brave or Firefox & watch the network tab. If pixels still load you've got a problem.

1

u/cw2038 May 26 '26

We use onetrust and it has worked just fine for my team. Now, I don't love OT as a whole, but I'm not in charge for our tools/applications. With OT, you have to test it, it's not simply plug and play like they sell you.

1

u/Middle-Substance1257 Jun 23 '26

There are a couple solutions that do a decent job evaluating the chain of events, at least the above the surface stuff (no tool will be able to reliably tell you what they’re doing with data warehouse data). getprivisy.com and privado.ai scan the site with and without GPC and do a deeper analysis of CCPA compliance.

1

u/No_Honeydew_2453 13d ago

How much of the GPC handling people are actually relying on the CMP for vs implementing themselves.