How do you prove a storefront honored GPC?

Not legal advice

This article explains observable artifacts that show a storefront reacted to a Global Privacy Control signal in a test. It is not legal advice, not a CPRA compliance certificate, and not a guarantee that honoring GPC in one run meets California or any other rule. ConsentProbe reports are technical observations. They do not replace counsel.

Last updated September 24, 2026. The general file list lives on the cookie consent evidence pack guide. What GPC is, and how to turn the signal on, lives on the Global Privacy Control test guide. This page is the proof checklist for a paired run.

Short answer

To prove a storefront honored GPC in a test, keep three artifact types from a paired GPC-off versus GPC-on run on the same URL: (1) request header proof that Sec-GPC: 1 was present on the GPC-on navigation, (2) a network and cookie diff that shows which marketing or sale-or-share hosts and cookies dropped or stayed, and (3) a screenshot of the CMP or banner state under GPC-on, and under GPC-off if you claim the UI changed.

GPC detected in the banner is not enough when Network still matches the GPC-off run. Read that case on the GPC versus CMP claims guide. Package the three surfaces the same way as a general cookie consent evidence pack. ConsentProbe can produce a labeled GPC scenario with findings tied to those surfaces. A free US-baseline scan is not a California GPC conclusion. This page is testing guidance, not legal advice and not a compliance certificate.

What honored means in a test

On this page, honored means the files show a behavior change after the signal arrived. You enabled GPC, and you confirmed the signal reached the page. Sec-GPC: 1 on the document request is the header proof. navigator.globalPrivacyControl in the console is optional. Keep the header in the pack. That is the value on the request many tags and the server can see.

Compare the same URL with GPC off and with GPC on, and record cookies and third-party requests. Keep the CMP sentence beside the network file. The sentence is a claim about the UI. The request list is the check on behavior.

A quieter network on one URL, in one region, on one day, is a test result. This page does not set a legal threshold for honored. A browser language, or a clock set to Los Angeles, does not turn a non-California network into a California result. The free versus paid guide draws that line for ConsentProbe scans. The same line applies to a pack you build by hand.

Evidence checklist

Fill one row per artifact before you write honored on a ticket. The evidence pack guide still owns how any consent file is named, redacted, and handed off. The rows below are the GPC-specific items.

Capture the header, then the diff

In Chrome DevTools, open Network and reload. Select the document row and open Request Headers. Sec-GPC with a value of 1 is the proof for that load. Save a screenshot, or a HAR line, after you remove cookies, query tokens, and request bodies. The evidence pack guide uses that redaction rule for every consent state.

If the header is missing, stop and fix the profile before you diff cookies. A GPC-off visit filed under a GPC-on label looks like the storefront ignored a signal it never received.

Export cookies from the Application panel for the shop host and for third parties set on that navigation, and save the third-party request list under the same label as the header shot. A host on the GPC-off file and absent or gated on GPC-on is the pass signal for that host. A host on both files, with a similar spread, did not use the signal. Name that host in the finding sentence. An illustrative line, with a stand-in host: GPC-on, ads.example still requested /collect after Sec-GPC: 1 (header shot H1, request R14). Substitute the host and the IDs from your run.

Paired mini protocol

Change only the signal between the two runs. Keep the URL and how far you navigate the same. A missing Sec-GPC header means that file cannot support a GPC-on claim.

1. Use two clean profiles, or an equivalent isolated context. Open the same storefront URL. Write the region you actually used. A locale or a timezone is not an IP.
2. Run A, GPC off. Record cookies, third-party requests, and a banner screenshot.
3. Run B, GPC on. Confirm Sec-GPC: 1 on the navigation request. Record the same surfaces.
4. Diff hosts and cookies. Write one finding sentence per distinct failure, with the artifact IDs from that run.
5. If the shop is Shopify, follow the Shopify GPC honor test for theme, app, and pixel steps. Keep this checklist for the proof pack itself.
6. For what GPC is and how to enable it, use the Global Privacy Control test guide. If the UI says detected and Network is unchanged, use the GPC versus CMP claims guide.

The badge, the header, and the network

A CMP badge that says GPC was detected is the UI claim. Header proof shows this navigation sent the signal. The network and cookie diffs show whether behavior changed. When the pack says honored, keep all three. The GPC versus CMP claims guide walks a badge that is up while the request list still matches GPC-off. The CMP claims versus runtime guide covers the same kind of check for Reject All and Accept All.

On Shopify, follow the Shopify GPC honor test for theme Liquid, app embeds, customer events, and pixels, and bring these three artifacts back from that run. If you are still choosing among GPC, Reject All, and a pre-consent pass, start from the testing hub.

After the DIY checklist

After you have run the checklist by hand, use ConsentProbe when you want a labeled GPC scenario with findings already linked to a request, a cookie, or a screenshot. A free US-baseline visit shows the report format on one non-California pass. It is not a California or GPC conclusion. Paid California or GPC scenarios are the regional pair. The free versus paid guide states that split.

ConsentProbe does not install a CMP or a banner. The CMP still collects the click choice. The audit records what the browser did under the scenario name.

FAQ

Limits of this page

This page explains how to prove, in a test, that a storefront reacted to Global Privacy Control. It is not legal advice, not a CPRA compliance certificate, and not a guarantee that three files mean a shop meets California or any other rule. ConsentProbe reports stay tied to requests, cookies, and screenshots. A free US-baseline scan remains a format pass, not a GPC conclusion.

Related guides

Open the evidence pack guide for the file rules, the GPC test guide to enable the signal, the claims guide when the badge and the network disagree, and the Shopify GPC honor test when the shop is Shopify.

• What belongs in a cookie consent audit evidence pack?
• What is Global Privacy Control, and how do you test it on a storefront?
• How to test GPC in Chrome, Firefox, and Brave
• GPC vs CMP Claims: How to Spot a Mismatch
• How do you test whether a Shopify storefront honors Global Privacy Control?
• What does a free US-baseline cookie audit prove vs paid EU or California scans?
• CMP claims vs runtime evidence: how do you prove the banner actually works?
• Which cookie consent test should you run first?
• Testing Global Privacy Control on a California Storefront
• Reject All vs Accept vs GPC: A Scenario Matrix for Shopify Stores
• How do you re-test after a GPC or Reject All fix?
• ConsentProbe methodology
• Pricing and listed regional products