Consent & Preference Signals
Whether the site honors legally recognized browser opt-out signals, chiefly Global Privacy Control, as CCPA/CPRA and similar state laws require.
A legal opt-out, sent automatically.
Global Privacy Control is a browser setting that tells every site a visitor opts out of the sale or sharing of their data. California requires sites to treat it as a valid opt-out request, and Colorado has a similar rule.
Ignoring it is a specific, testable compliance gap. Paired with data sale or sharing findings, it points to regulatory enforcement exposure.
Global Privacy Control signal not honored
Example finding. Vendor names are withheld.
What CyRisk tracks.
Severity and placement are CyRisk defaults. Your team can elevate, downgrade or drop any risk to context-only, per account.
| RISK | DEFAULT SEVERITY | DEFAULT PLACEMENT |
|---|---|---|
| Global Privacy Control signal not honored | Critical | Critical to Bind |
| Browser-based privacy signal handling | High | May Affect Coverage |
The scan sends the GPC opt-out signal and checks whether sale and sharing tracking continues.
Detect the GPC browser signal and suppress all non-essential tracking and advertising transmissions when it’s present, consistent with CCPA/CPRA, then verify through independent testing.
Verified by rescan. The fix shows on the next scan.
Ready-to-use language.
“Does the site detect Global Privacy Control and stop sale and sharing tracking when it’s on?”
“Implement GPC detection that suppresses non-essential tracking, verified by CyRisk rescan.”
Regulatory coverage terms. Read alongside the data sale/share and Do Not Sell/Share findings.
Keep exploring.
Laws this exposure can trigger
Related exposure families
What is Global Privacy Control?
A browser setting that sends an automatic opt-out signal to every site a person visits.
Which states require sites to honor it?
California requires it, and Colorado has a similar rule.
Is it hard to fix?
Usually not. It’s a specific, testable configuration change, which makes it a clean subjectivity.
See who ignores the opt-out.
Send five past submissions you’ve already bound, conditioned or declined. We score them blind, then put our disposition next to the call you made.
Severity and placement shown are CyRisk defaults and can be tuned per account. A detected exposure indicates a fact pattern common to privacy litigation, not a confirmed violation. Litigation theories explain why a finding is tracked; they are not legal advice.