Privacy finding
The Global Privacy Control signal is sent and advertising requests go on as before
Privacy Warning Severity: High
Part of the audit The consent signal says denied, the tags behave as granted. Finding id: privacy.privacyControlSignalIgnored.
What it costs you
A visitor whose browser says 'do not sell or share my data' is treated like any other visitor.
What to do
Make the consent setup read the signal and treat it as an opt-out for the tags it concerns.
What it checks
- Browser privacy signal ignored
How to fix it
Make the consent setup read the signal
- Check whether your consent tool has a setting for the Global Privacy Control signal and switch it on for the regions where it applies. We do not name the setting because it differs per tool.
- If the tool has none, read the signal in your own code before the advertising tags load and hold them back when it is set.
How to check: Switch the signal on in a browser that supports it and reload: the network panel shows no identifier going to [host]. Then run the scripted visit again.
A real case
California's Attorney General found that Sephora ignored opt-out requests sent with the Global Privacy Control browser signal and did not tell customers that the trackers on its site amounted to selling their data. Sephora paid 1.2 million dollars in penalties under the 2022 settlement.
How to verify by hand
The consent platform's setting for the Global Privacy Control signal.
What this relies on
The site does not read the signal at all.