The visitor arrives from Los Angeles. Before they even see your home page, their browser has already spoken.
Every request reaching your server carries a header that says, explicitly and legibly: this user does not want their data sold or shared with third parties. It is called Global Privacy Control, GPC for short. It is free, it is a standard, and it has been traveling for years.
Your cookie banner, almost certainly, ignores it.
And compliance, today, is no longer just about what your website says. It is about what it is able to hear.
The problem: a web that speaks but does not listen
For ten years we have built compliance as a one-way conversation. The site asks: do you want cookies? The user answers: yes or no. Everything else, from the preventive blocking of scripts to the consent log, descends from that exchange.
But there is a second channel, silent and parallel, where the roles are reversed: it is the user who speaks first, and the site that must answer.
Anyone who enables the GPC signal does it once, in their browser settings. From that moment their choice travels with them, site after site, like a tag pinned to their chest: do not sell my data, do not share it, do not track me.
Most websites are not designed to read it. The signal arrives, it is left on the ground, and the advertising tags fire anyway.
A banner that speaks but does not listen is not a compliance tool. It is expensive decoration.
What GPC and GPP actually are
Two standards, two different jobs, one goal: making the user's will travel.
GPC (Global Privacy Control) is a browser signal. The specification is maintained by a W3C working group (the consortium that governs web standards) and it materializes in an HTTP header, Sec-GPC: 1, plus a property readable via JavaScript. Browsers like Brave and DuckDuckGo send it by default; Firefox offers it among its protection options.
The point here is legal. In California, since July 1, 2023, the CCPA regulations (the most famous US privacy law) recognize the signal as a valid opt-out request from the sale and sharing of data. Colorado, Connecticut, Utah and other states recognize it too. The user fills in no form, writes no message to the data controller: the signal is the request. Ignoring it is not an oversight. It is a violation.
GPP (Global Privacy Platform) is the language the advertising market uses to transport that will. It is a platform from the IAB Tech Lab (the body that defines digital advertising standards), created to replace the old US Privacy String, and it solves a simple problem: ever-new laws, a single stream of traffic to label.
It works in sections. One section for the agreement among US states (the MSPA, Multi-State Privacy Agreement), sections for individual states, one for Canada, one for Europe (the well-known TCF). Each section declares the state of consent for its own jurisdiction. And the GPC signal is an integral part of the protocol: when it is present and applicable, the GPP string must reflect it.
The GPP string is a consent passport: one page for every country that consent travels through.
Where geolocation comes in
Here we touch the point that many consent management platforms do not apply correctly: the rules to apply depend on where the visitor of your website is located.
A visitor from Berlin falls within the GDPR perimeter: prior privacy notice, free and granular consent, technical blocking of tags before the yes. A visitor from San Francisco falls into the opposite model: processing starts unless refused, the prohibition on selling or sharing data is exercised as an opt-out, and the GPC signal carries legal force. Utah, Colorado, Virginia add further nuances.
Applying preventive consent to the United States as well, then, is a correct choice: it is the most protective model, and where the law requires nothing, protecting more is not a mistake. The limit is another. A single logic treats identically those who asked nothing and those who, with the GPC signal, have already expressed their will: compliance without optimization, more friction for visitors, more missed opportunities for publishers.
This is where GPC, GPP and geolocation change management: from correct to optimized, because each visitor is recognized their jurisdiction and their choice.
True compliance measures first, then responds.
What you risk by pretending nothing is happening
Perhaps you think: my market is European, these things concern others. There are two objections.
The first: your American visitors exist. Open Google Analytics and look for the United States in the list of countries. If your site has any traffic at all, those visitors are there.
The second: the numbers are not abstract. The CCPA provides for fines of up to 2,500 dollars per violation, rising to 7,500 if intentional. Per violation: not per site, not per year. Multiply by users and by days, and the figure quickly becomes a serious conversation.
A precedent already exists. In 2022 Sephora paid 1.2 million dollars to close an investigation by the California Attorney General, also for failing to honor the GPC signal. It was the first case, not the last.
And there is the silent damage, the kind that does not arrive by mail: the US advertising ecosystem speaks GPP. Those who do not speak it find themselves cut out of the supply chain, or serving ads with a consent they cannot document.
The GDPR ends at the Union's borders. Your visitors do not.
What My Agile Privacy does from version 3.4.0
From this version My Agile Privacy supports GPC and GPP, as part of the flow through which consent is collected, interpreted and transmitted.
Told at the principle level, this is what it means.
The signal is heard. If a visitor has enabled GPC, their will is honored according to the jurisdiction that applies to them, without forcing them to ask a second time for what they have already asked their browser.
Management goes from correct to optimized. Consent is calibrated on the visitor's regulatory perimeter: full protection where needed, the right fluidity where the law allows it.
The supply chain receives its language. Consent also flows in GPP format, alongside those My Agile Privacy already speaks today: Google Consent Mode v2, IAB TCF 2.4, CCPA and the laws of individual US states.
No double configuration. The feature hooks into the compliance journey you already know: whoever administers the site does not have to become a jurist of US privacy law.
Geolocation is available on all plans, starting from Smart Fox included.
If you already use My Agile Privacy, it takes you one minute: update to 3.4.0 from your WordPress dashboard and find everything already active.
Compliance is also knowing when to stay silent
For years privacy was thought of as something the site says to the user: a notice, a banner, four buttons. More and more it is something the site must be able to read from the user: signals, preferences expressed elsewhere, jurisdictions that change with the border.
Companies that understand this now turn an obligation into an advantage: less friction for visitors, less risk for publishers, more trust for both.
Next time you evaluate a cookie banner, do not just ask it what it shows. Ask it what it is able to hear.
Update to 3.4.0, or discover how My Agile Privacy puts your website in listening mode, on myagileprivacy.com. For any doubt, our experts (real people, not automated bots) are waiting for you in the Helpdesk.
