GPC signal present but marketing still loads: what to check

Not legal advice

This guide explains how to observe a storefront when the browser sends a GPC signal, Sec-GPC: 1, and marketing, ad, or analytics requests still load. It is not legal advice, not a second GPC definition, not a CPRA compliance certificate, and not counsel on whether any business must honor GPC. ConsentProbe reports are technical observations of what fired under GPC-on versus GPC-off. They do not say what counsel would allow. Observation is not counsel permission.

Last updated September 29, 2026. The GPC definition page owns what the signal is and how to enable it. The GPC versus CMP claims guide owns mismatch framing. The prove-honored page owns the evidence fields. The browser toggle page owns Chrome, Firefox, and Brave switches. This page is the capture sequence. It does not rewrite those guides.

Short answer

Seeing Sec-GPC: 1, or a CMP badge that says GPC detected, does not prove marketing stopped. Honor, in a browser test, means GPC-on traffic should not look like GPC-off sale or sharing traffic for the same URL.

Enable GPC in a clean profile. Confirm Sec-GPC: 1 on the document request. Load the storefront. Capture marketing, ad, and analytics hosts and cookies. Repeat with GPC off. If hosts and cookies match across both visits, or if the CMP UI claims detection while Network still fans out to ad endpoints, you have a claims-versus-runtime gap.

The definition and enable steps stay on the GPC signal page. Mismatch framing stays on the GPC versus CMP claims guide. The evidence checklist stays on the prove-honored page. This page is the capture sequence, not a second GPC definition. It is not legal advice. Observation is not counsel permission.

Signal versus honor

A header, a badge, and a quieter network are different observations. Write the finding as a host that still appears on GPC-on. Leave permission with counsel. The definition of GPC stays on the signal page.

GPC-on and GPC-off on the same URL

These steps compare a present signal with marketing hosts. They do not configure CMP honor logic. The browser toggle page holds the Chrome, Firefox, and Brave switches. Do not paste that matrix here.

1. Use a clean profile. Enable GPC. Confirm the capability before you record hosts. The browser toggle page lists the switches.
2. Load the storefront once. Confirm Sec-GPC: 1 on the document request. Screenshot the CMP if it mentions GPC. Label the pack GPC-on.
3. Capture cookies, storage, and Network for marketing, ad, and analytics hosts.
4. Open a new clean profile with GPC off. Load the same URL. Label the pack GPC-off. Recapture the same layers.
5. Diff hosts and cookies. Write one finding sentence per unexpected match, such as the same ad or pixel host on both visits.
6. If Reject All is also in scope, keep Reject as a separate labeled visit. Do not merge Reject and GPC into one unlabeled capture.

Where the GPC pages already stop

The GPC signal page defines the signal and the basic paired test. This page starts after you already see Sec-GPC: 1 and marketing hosts are still on the wire. It does not paste that definition.

The GPC versus CMP claims guide covers a detected badge versus runtime. Use it when the story is the UI claim. This page covers the capture sequence when the signal is already present.

The prove-honored page lists evidence fields. The evidence pack lists file shape. The browser toggle page lists how to turn the signal on. The Shopify GPC page is the storefront vertical. The Reject leftovers guide is a separate failure mode: a banner choice, not a browser signal. The retest-after-fix guide covers the rerun after engineering changes the gate.

Example of a storefront clue, not a customer capture: the document request shows Sec-GPC: 1, and the CMP says GPC detected. GPC-on Network still shows the same ad host as the GPC-off visit.

When diffing GPC-on and GPC-off gets slow

Diffing GPC-on and GPC-off across templates by hand takes a long time. ConsentProbe's California and GPC path runs the paired visits on the storefront URL. Each finding stays tied to a request, a cookie, or a screenshot.

Use the free US-baseline visit when you want the report format. Use the paid California path when GPC claims are the question. The free versus paid guide draws that line. ConsentProbe does not configure CMP GPC honor, does not install a CMP, and does not issue a certificate.

FAQ

Limits of this page

This page tells you how to confirm Sec-GPC: 1 and compare GPC-on with GPC-off when marketing hosts still load. It does not rewrite the GPC definition, the GPC versus CMP claims guide, the prove-honored checklist, or the browser toggle page. It is not a second GPC definition, not legal advice, and not a certificate. Observation is not counsel permission. ConsentProbe reports stay tied to requests, cookies, and screenshots. A free US-baseline scan is not an EU or California legal conclusion.

Related guides

Open the GPC versus CMP claims guide for a badge mismatch, the GPC signal page for the definition, the prove-honored page for evidence fields, the browser toggle page for the switches, and the evidence pack for file shape.

• GPC vs CMP Claims: How to Spot a Mismatch
• What is the Global Privacy Control (GPC) signal, and how do you test it?
• How do you prove a storefront honored GPC?
• How to test GPC in Chrome, Firefox, and Brave
• What belongs in a cookie consent audit evidence pack?
• Reject All Still Tracking: What to Check After You Say No
• How do you test whether a Shopify storefront honors Global Privacy Control?
• What does a free US-baseline cookie audit prove vs paid EU or California scans?
• CMP claims vs runtime evidence: how do you prove the banner actually works?
• Cookie audit hub: which consent test should you run first?
• How do you re-test after a GPC or Reject All fix?
• ConsentProbe methodology
• Pricing and listed regional products