Topic starter
23/10/2026 12:48 am
TL;DR: 40% of trackers still ignored consumer opt-outs, with Ketch identifying a Global Privacy Control enforcement gap across privacy stacks. Identity-linked suppression and traffic checks are needed to prove the signal actually stops sharing.
Editorial analysis by NHI Mgmt Group, based on content published by Ketch: “Honoring GPC in practice: what the CCPA requires and how to verify it”.
Key questions
Q: Why do cookie banners fail to prove opt-outs are working?
A: Because a banner can record preference without stopping downstream sharing.
Q: What are the signs that a privacy programme is not honoring opt-out signals?
A: Common signs include different outcomes for logged-in and logged-out users, opt-outs that apply on one device but not another, and consent logs that show success while outbound tracker traffic keeps flowing.
Q: How should organisations handle Global Privacy Control across devices and logged-out users?
A: They should treat Global Privacy Control as a rights signal that must follow the person, not the browser session.
Practitioner guidance
- Map every opt-out path to identity resolution Trace how a GPC signal, webform submission, and logged-in account request reach CRM, CDP, advertising, and partner systems.
- Verify suppression with network traffic inspection Check real outbound requests after an opt-out is submitted and compare them with what the CMP dashboard reports.
- Separate cookie consent from sale-or-sharing governance Do not rely on a banner alone to satisfy a rights request.
Bottom line: The central issue is not whether a browser signal exists, but whether the business stops sharing personal data everywhere it can still identify the person.
Glossary terms: Global Privacy Control, Universal Opt-Out Mechanism, Rights Request, Cross-Source Identity Resolution
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
23/10/2026 9:49 am
Cookie-scoped consent is no longer a complete privacy control: browser-level opt-out signals have moved the compliance question from collection to data propagation. A business can satisfy a banner interaction and still fail the actual legal obligation if downstream sharing continues. For privacy programmes, the decisive control is now whether the opt-out follows the person across systems.
A question worth separating out:
Q: What should privacy teams do when a browser-level signal and an account-level request conflict?
A: They should treat the more durable rights record as authoritative and reconcile the browser signal into the account-linked record. The aim is to avoid duplicated handling paths that leave one channel suppressed and another still sharing data, which is exactly how enforcement gaps persist.
👉 Read our full editorial: Global privacy control exposes the limits of cookie-only consent
This post was modified 6 days ago by NHI Mgmt Group