Global Privacy Control has to be read before your tags run, says California's draft

Who it applies to, and from when

The duty underneath is already in force. A business that sells or shares personal information has to treat a valid opt-out preference signal as a request to opt out, for that browser or device and any profile associated with it (section 7025(c)(1)). The California Attorney General’s page on GPC says it must be honored by covered businesses as a valid consumer request (oag.ca.gov). Posting a “Do Not Sell or Share” link does not remove the duty (7025(e)), and a cookie banner on its own is not an acceptable way to opt out of sale or sharing (7026(a)(4)).

What is new is wording and examples, and those are a proposal. Nothing is adopted and there is no effective date. If the board advances the text, these CCPA regulations go out for formal comment and can still change.

A second date sits next to it. From 1 January 2027, Civil Code section 1798.136 forbids developing or maintaining a browser without a setting, configurable by the person using it, that sends an opt-out preference signal. Inferred More of a site’s visitors will send the signal next year than this year, whether or not anything changes in the CPPA regulations.

The GPC signal arrives with the first request

The mechanism is simple. A browser with GPC switched on sends the request header Sec-GPC with the value 1, and the page can read the boolean navigator.globalPrivacyControl (W3C draft, MDN). The GPC signal is in the very first request for the page, before a single script has run.

The draft draws the consequence in its example of Business WWW, an online retailer with a consent platform and a tag manager whose advertising and analytics cookies and pixels are set before either tool has checked for the signal. The visitor’s opt-out, in the draft’s words, is received as soon as Violet’s browser sends the initial request to access the website, so selling or sharing before the check fails the requirement to stop as soon as feasibly possible (7026(f)(3)(C)). The statement of reasons adds that It is entirely feasible to configure a website to detect the GPC signal before initializing any scripts, cookies, or other technologies, and is blunt about the alternative: This improper sequencing is not merely a technical oversight; it is a direct violation of the timing requirement.

In system terms this is the unknown state again. Until the signal has been checked, the site does not know the visitor’s choice, and unknown is not permission. The statement of reasons makes the same point about the tooling: the consent platform and the tag manager are both client-side JavaScript, and they have to be coordinated so that anything that sells or shares waits until the signal has been processed.

A load order that reads the signal first

There are two places the signal can be read, and a robust setup uses both.

1. On the server. The Sec-GPC header is in the request, so the server knows before it renders a byte. It can write the state into the page, ahead of the tag manager snippet, and leave sale-or-share tags out of the response entirely.
2. In the page, as a fallback. An inline script in the head, placed before the tag manager loads, reads navigator.globalPrivacyControl synchronously and writes the same state.
3. In the tag manager. Every tag that sells or shares fires only on a resolved state that allows it. No trigger fires on “consent not yet denied”.

The inline step, as a sketch:

// Illustrative. Runs inline in <head>, before the tag manager snippet.
// It does not cover the consent platform's API, stored choices, other purposes or regions.
const gpc = navigator.globalPrivacyControl === true;

window.saleOrShare = gpc
  ? { status: 'resolved', value: 'denied', source: 'gpc' }
  : { status: 'unknown' };

What happens when there is no signal is a separate decision. California’s right is an opt-out right (Civil Code section 1798.120, which the draft cites), but the same page may serve visitors from places where these tags need consent first, and that is a question for the legal side, not the tag configuration.

The draft also keeps the existing requirement to show the result: a business must display whether it processed the signal, and the text offers Opt-Out Request Honored as an example (7025(c)(6)). If the business wants to rely on the frictionless route and drop the opt-out link, it may not answer the signal with a pop-up or interstitial, though the status display is allowed (7025(f)(3)).

Where this breaks in production

• Cached HTML. If the server writes the state based on Sec-GPC and a CDN caches the page without Sec-GPC in its Vary header, one visitor’s version is served to the next. Varying on the header splits the cache. Relying on the client-side check keeps the cache whole but moves the decision later in the load. That trade-off is real and has to be made on purpose.
• Tags outside the tag manager. A pixel pasted into a theme, a plugin that loads its own script or an embedded widget never reads the state. The gate only holds what passes through it.
• Third parties that sync cookies. The draft puts this on the site: it has to be configured so that third-party trackers do not start or perform cookie syncing whenever the signal is present. A site cannot reach into a partner’s script and switch the syncing off, so in practice I would not load those trackers at all when the signal is there.
• An asynchronous consent platform. If the platform loads after the tag manager and the tag manager fires on page view, the order is wrong however well the platform reads the signal.
• Linked profiles. If you link a visitor’s devices or accounts for advertising, the draft’s examples say the opt-out has to follow those links. A flag stored in one browser does not reach a profile on the server.
• Server-side forwarding. Events sent from your own servers to advertising platforms never pass through the browser gate. The signal state has to travel with the event, or the forwarding has to stop.

What is still uncertain

Whether the board advances the text on 6 November 2026, and what the formal comment period changes. The examples could be reworded, narrowed or dropped before any final text, and so could the metrics expansion in section 7102.

My own view is that none of that is a reason to wait. The agency says the timing example describes what the law already requires, and the statement of reasons calls the misordering a violation of an existing rule. Fixing the load order is cheap compared with explaining it later. Whether your particular setup meets the current rule is a question for a lawyer who knows your data flows.

Questions to take back to your team

1. Where in the page load is the signal first read today, and is that before or after the tag manager loads?
2. Which tags and vendors count as a sale or a share, and who decided?
3. Does any script that sells or shares load outside the tag manager?
4. Do you link devices or accounts for advertising, and does the opt-out follow the link?
5. If the server reads Sec-GPC, does the cache vary on it?
6. Where on the site do you display that the opt-out was honoured?
7. Do you forward events from the server, and does the signal state travel with them?

Konrad’s reading of the Meta judgment in New Mexico makes the same point at a different scale. A control that governs the screen and not the data flow is a promise the system does not keep.