检查清单
How to test GPC in Chrome, Firefox, and Brave
Enable Global Privacy Control in Chrome, Firefox, and Brave, verify Sec-GPC, and compare the storefront. A toggle is not a legal conclusion.
In brief
Enable Global Privacy Control in Chrome, Firefox, or Brave, confirm the document request carries Sec-GPC: 1, then compare the storefront with a GPC-off run. A toggle does not prove the shop honored the signal. Proof artifacts live on the GPC evidence checklist. ConsentProbe can run a labeled GPC scenario. A free US-baseline scan is not a California GPC conclusion. This page is testing guidance, not legal advice.
Not legal advice
This guide explains how to enable Global Privacy Control in Chrome, Firefox, and Brave, and how to verify the Sec-GPC signal and the storefront reaction in a test. It is not legal advice (非正式法律意见), not a CPRA certificate, and not a claim that a browser toggle settles the legal question. ConsentProbe reports are technical observations. They do not replace counsel.
Last updated September 24, 2026. Browser labels move, so this page stays at capability level and links current help. The GPC definition guide owns what the signal is and how paired tests are framed. The prove-honored checklist owns the artifact list. The claims guide owns a detected badge with an unchanged network. The Shopify GPC page owns the Shopify honor test. This page stays on enable, header check, and storefront diff.
Short answer
Enable GPC in the browser, verify Sec-GPC: 1 on the document request, then load the storefront and record whether cookies, network, and banner state changed versus a GPC-off run. A toggle alone does not prove the storefront honored the signal.
For the proof artifact list, use the prove GPC honored evidence checklist: header capture, network and cookie diff, and screenshot. For what GPC is and how paired tests work, see the Global Privacy Control test guide. ConsentProbe can run a labeled GPC scenario with those surfaces linked. A free US-baseline scan is not a California GPC conclusion. ConsentProbe does not install a CMP. This page is testing guidance, not legal advice (非正式法律意见).
Enable the signal
As of September 24, 2026, stable Chrome does not show a built-in Global Privacy Control control. Use a GPC-capable extension, then confirm the header. Do not copy a Chrome menu path, and do not treat other Chromium browsers as Chrome.
Firefox exposes Global Privacy Control in Privacy settings when that build offers it. Brave's desktop and Android builds send GPC by default on current help pages, and Brave's iOS notes say the JavaScript property can be present while the HTTP header is not. In every browser, the next step is the same: read Sec-GPC on the document request.
| Browser | What to do | Verify next |
|---|---|---|
| Chrome | Use a current GPC-capable extension. Stable Chrome has no built-in toggle to copy | DevTools Network, document request, Request Headers, Sec-GPC: 1 |
| Firefox | Open Privacy settings and enable Global Privacy Control where Firefox shows it | The same header check. Optional: navigator.globalPrivacyControl in the console |
| Brave | Confirm the privacy or Shields path that sends GPC. Desktop and Android often send it already | The same header check. Do not stop at a Shields label |
Verify the header and the storefront
A detected badge in the banner is not the diff. The claims guide covers that mismatch. Package the files with the prove-honored checklist. Do not stop when a site says GPC detected.
- GPC off: load the URL once in a clean profile. Capture cookies, Network, and the banner.
- Enable GPC. Confirm
Sec-GPC: 1 on the main document and on the key navigations. - GPC on: load the same URL again. Use a clean profile or cleared storage when the first visit wrote IDs.
- Diff cookies, marketing hosts, and banner state against the GPC-off pack.
- Package the proof with the prove GPC honored evidence checklist.
Where the deeper pages live
This page does not repeat those guides. Open the one that matches the gap you still have.
The Global Privacy Control test guide covers the definition and the paired-test frame. The prove-honored checklist covers header, diff, and screenshot files. The GPC versus CMP claims guide covers a CMP that says detected while Network still matches GPC-off. The Shopify GPC honor test covers a Shopify shop URL.
When hand-building the pair gets slow
Building GPC-off and GPC-on packs across templates by hand is slow. ConsentProbe runs a labeled GPC scenario on the storefront URL. Each finding stays tied to a request, a cookie, or a screenshot.
Use the free US-baseline visit when you want the report format only. It is not a California GPC conclusion. The free versus paid guide draws that line. ConsentProbe does not certify CPRA behavior and does not install a CMP.
FAQ
How do I test GPC in Chrome?
Use a GPC-capable extension, confirm Sec-GPC: 1 on the document request, then diff the storefront against a GPC-off run. Stable Chrome has no built-in menu path to copy.
Does Firefox send GPC?
When the Privacy setting is on, verify the header the same way. Optional: read navigator.globalPrivacyControl in the console.
Does Brave send GPC?
Confirm it in Brave's privacy controls, then verify Sec-GPC on the document request. A Shields label is not the header.
Does turning the toggle on prove the storefront honored GPC?
No. The toggle sends a signal. Honor, in this test, means cookies, network, or banner state changed versus GPC-off. That comparison is a technical record, not a legal conclusion.
Where is the proof checklist?
The prove GPC honored evidence checklist lists the header, the network and cookie diff, and the screenshot.
Is this legal advice?
No (非正式法律意见). These are technical observations. ConsentProbe does not replace counsel, and it does not install a CMP.
Limits of this page
This page tells you how to enable Global Privacy Control in Chrome, Firefox, and Brave, verify Sec-GPC: 1, and diff the storefront. It is not legal advice (非正式法律意见), not a CPRA certificate, and not a claim that a browser toggle settles the legal question. ConsentProbe reports stay tied to requests, cookies, and screenshots. A free US-baseline scan is not a California GPC conclusion.
Related guides
Open the GPC definition guide for the signal, the prove-honored checklist for the files, the claims guide when the badge and the network disagree, and the Shopify honor test when the shop is Shopify.
- What is Global Privacy Control, and how do you test it on a storefront?
- GPC vs CMP Claims: How to Spot a Mismatch
- How do you prove a storefront honored GPC?
- How do you test whether a Shopify storefront honors Global Privacy Control?
- What belongs in a cookie consent audit evidence pack?
- What does a free US-baseline cookie audit prove vs paid EU or California scans?
- How do you re-test after a GPC or Reject All fix?
- Which cookie consent test should you run first?
- ConsentProbe methodology
- Pricing and listed regional products
Sources
These links cover the platform and regulatory context used in this guide. Applicability still depends on the organization and jurisdiction.
保存一次美国基线技术记录
完成自行检查后，可以跑一次免费美国基线审计：在加州以外做一次浏览器访问，把 Cookie、请求和截图存成证据。这次访问不会跑欧盟拒绝/接受，也不会跑加州 GPC。欧盟、加州和 Global 2 可在登录后的账单页购买。