How many ad requests go out before the banner reads GPC? Four stores tested

When did each banner process GPC?

Tested 2026-10-27 (UTC+8), from a direct US connection in Virginia. The browser was headless Chrome, with a new profile each run, English, and the America/Los_Angeles timezone. GPC runs sent a Sec-GPC: 1 header and set navigator.globalPrivacyControl to true before any page script ran. We opened the homepage, clicked nothing, and waited 20 seconds after DOMContentLoaded. Each store has two GPC runs, listed separately, and one run without GPC.

The marker is the first sign that the store processed GPC. On Store O it is the moment OneTrust wrote the OptanonConsent cookie with isGpcEnabled=1. That write time is exact. On Store K and Store R it is the first time Osano.cm.getConsent() returned OPT_OUT: ACCEPT. Those stores wrote no consent cookie, so the cookie is not the marker. The read is every 100 ms, so the time is an upper bound: no later than the millisecond in the table. On Store P there is no CMP. The marker is the first time Shopify.customerPrivacy.currentVisitorConsent() returned sale_of_data: "no". That read is also every 100 ms, and the API already said "no" the first time it could be read, so "before" on Store P is before that API was readable. Store K and Store R are the same stores as in our Postscript test.

The moment a banner processes GPC may depend on that store's configuration and script load order. We did not test either, so these times do not represent the CMP itself.

On Store O, OneTrust called Shopify setTrackingConsent at 4137 ms on run 1 and 4412 ms on run 2, with marketing false and sale_of_data false. Active groups after the GPC runs were C0001, C0002, and C0003. On the run without GPC they were C0001, C0002, C0003, SSPD_BG, C0004, and C0005.

In window.dataLayer, the Consent Mode default was ad_storage granted on Store O, Store P, and Store R, and denied on Store K. On the GPC runs the recorded gtag commands were default only. None was a consent update to denied. We only checked window.dataLayer. Other writes, including a Consent Mode path outside gtag and Shopify's own consent calls, were not in this check, so this record cannot show whether Consent Mode was updated some other way.

A separate page covers a GPC signal present but marketing still loads.

What was sent before the banner processed GPC?

Counts below are ad and marketing requests whose start time is before the marker. They include script downloads. The number in parentheses leaves out script, stylesheet, and document loads. Runs are not combined. We only checked whether requests were sent, not what they carried (for example an ad platform's restricted-processing parameters), so we cannot say whether any of them count as a sale or share.

On Store O the first ad request was at 1171 ms on run 1 and 1121 ms on run 2, about 3 seconds before OneTrust recorded GPC. Before Shopify read sale_of_data as "no", Store O had already sent 14 requests on run 1 and 23 on run 2.

How a CMP can hold tags before a click is a different check: CMP auto-blocking before Accept.

Did ad requests stop after GPC was processed?

The capture waited 20 seconds after DOMContentLoaded, with no click. The table counts ad and marketing requests from the GPC marker until that wait ended. How long that stretch lasts depends on when the marker landed, and this page does not turn it into one fixed duration after the marker. We recorded the counts and the vendors. We did not check which script sent each request. Again, we checked whether requests were sent, not their parameters, so we cannot say whether they count as a sale or share.

On Store O, after OneTrust called setTrackingConsent with marketing false, the two runs still sent 44 and 40 ad requests.

How much did GPC change compared with a visit without it?

Each store has one run with GPC off, same homepage, same 20 second wait, no click. That run is only there to check that the marker moved with GPC. The table is the ad and marketing total for that visit.

On Store K, Osano's first read had MARKETING set to DENY on the GPC runs and on the run without GPC. The Consent Mode default on that store was ad_storage denied in all three runs. The run without GPC sent the same two script downloads, and nothing after.

What did Shopify's privacy API do on the store with no banner?

Store P shows no CMP. The first time Shopify.customerPrivacy.currentVisitorConsent() could be read, sale_of_data was already "no": no later than 1000 ms on run 1 and no later than 1176 ms on run 2. On the run without GPC that field was an empty string at the first read. Before the API was readable, the GPC runs sent 5 and 8 requests, Attentive and gtag.js. After it, Google Ads still sent 11 requests on each run, with Attentive, Vibe, and one Mailchimp request. We did not check which of these the store treats as a sale or share.

What the Customer Privacy API records, and what a customer-event pixel can still load, is on Shopify Customer Events versus the Privacy API.

What do California's official sources say about GPC?

California's AB 566, the California Opt Me Out Act, adds Civil Code section 1798.136. It says a business shall not develop or maintain a browser without a consumer-configurable setting that sends an opt-out preference signal. The section becomes operative on January 1, 2027. AB 566 bill text

Staff slides for the August board meeting listed GPC timing examples. Staff slides

Not legal advice.

On Store O, the first ad request went out at about 1.1 seconds. OneTrust recorded GPC at about 4.1 to 4.3 seconds.

What we didn't test

One direct US exit, in Virginia. Two GPC runs and one run without GPC per store. Homepage only. No click, no scroll, and no product page.

Osano and Shopify marker times are upper bounds from a 100 ms poll. The OneTrust marker is the exact cookie write.

Before and after compare the request start time with the marker time. A request after the marker can continue a chain that started earlier, such as a cookie-sync redirect. We did not split those out.

We checked whether a request was sent. We did not read the fields inside it.

GPC in the browser was the header plus the JavaScript property. That should match Firefox or Brave with GPC on. We did not repeat the runs in those browsers. The browser steps are on how to test GPC in Chrome, Firefox, and Brave.

A few requests in the capture events had no Sec-GPC header: 1 of 764 and 1 of 761 on Store O, and 3 of 431 and 3 of 433 on Store R. The other requests on those runs had the header. Store K and Store P had the header on every recorded request.

These times come from four stores. They are not a ranking of CMPs, and they are not a statement that a store did something wrong.

How do you check GPC timing on your own store?

You can time the same gap in a desktop browser. Keep the header proof with the request list. The field list is on how to prove a storefront honored GPC.

1. Turn GPC on before the load. Brave and Firefox have a setting. An extension can send it in other browsers. The free GPC checker reads the header your browser sent to ConsentProbe.
2. Open a new private window. In DevTools, open Network and turn on Preserve log. Load the homepage and note the time of the first ad request.
3. Open Application, then Cookies. For OneTrust, read isGpcEnabled=1 inside OptanonConsent. Or, in the Console, call Shopify.customerPrivacy.currentVisitorConsent() and read sale_of_data.

Want this timing recorded on your store, run by run? See the cookie audit.

FAQ

Not legal advice

Not legal advice.