Global privacy control: are your consent controls keeping up?

TL;DR: Global Privacy Control is still mishandled across many privacy stacks, with 40% of trackers ignoring consumer opt-outs and regulators moving to tighten how signals are honored across devices, including for people who never log in, according to Ketch. Cookie-scoped consent tools are not enough when the legal obligation follows identity and data flow, not just the browser.

Editorial analysis by NHI Mgmt Group, based on content published by Ketch: “Honoring GPC in practice: what the CCPA requires and how to verify it”.

Key questions

Q: How should organisations handle Global Privacy Control across devices and logged-out users?

A: They should treat Global Privacy Control as a rights signal that must follow the person, not the browser session.

Q: Why do cookie banners fail to prove opt-outs are working?

A: Because a banner can record preference without stopping downstream sharing.

Q: What are the signs that a privacy programme is not honoring opt-out signals?

A: Common signs include different outcomes for logged-in and logged-out users, opt-outs that apply on one device but not another, and consent logs that show success while outbound tracker traffic keeps flowing.

Practitioner guidance

• Map every opt-out path to identity resolution Trace how a GPC signal, webform submission, and logged-in account request reach CRM, CDP, advertising, and partner systems.
• Verify suppression with network traffic inspection Check real outbound requests after an opt-out is submitted and compare them with what the CMP dashboard reports.
• Separate cookie consent from sale-or-sharing governance Do not rely on a banner alone to satisfy a rights request.

Bottom line: The central issue is not whether a browser signal exists, but whether the business stops sharing personal data everywhere it can still identify the person.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →