[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AEV96G2ZFPW4EK9G5FHMCC":3,"skill-same:01M6AEV96G2ZFPW4EK9G5FHMCC":90},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":32,"linkOnly":33,"markdownContent":34,"markdownBody":35,"frontMatter":36,"refName":41,"commitSha":42,"skillDirectory":43,"forksCount":44,"repositoryHtmlUrl":45,"repositoryHomepageUrl":6,"ownerHtmlUrl":46,"ownerBlogUrl":47,"ownerDescription":48,"updatedAt":49,"install":50,"resources":63},"01M6AEV96G2ZFPW4EK9G5FHMCC","gpc-cookie-integration",null,"Integrating Global Privacy Control (GPC) signals with cookie consent platforms. Covers GPC signal detection in browsers, automatic opt-out triggering, mapping GPC to US state privacy laws, and CMP integration for CCPA, CPA, and CTDPA compliance.","mukul975\u002FPrivacy-Data-Protection-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADNKWX1HF4Q5DKEXT5M774",337,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Fgpc-cookie-integration\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[24,25,26,27,28,29,30,31],"integration","gpc cookie integration","state","compliance","ccpa","privacy","global privacy control","detection","2026-11-10 10:12:30",false,"---\nname: gpc-cookie-integration\ndescription: >-\n  Integrating Global Privacy Control (GPC) signals with cookie consent platforms.\n  Covers GPC signal detection in browsers, automatic opt-out triggering, mapping\n  GPC to US state privacy laws, and CMP integration for CCPA, CPA, and CTDPA compliance.\nlicense: Apache-2.0\nmetadata:\n  author: mukul975\n  version: \"1.0\"\n  domain: privacy\n  subdomain: cookie-consent-compliance\n  tags: \"gpc, global-privacy-control, opt-out, ccpa-opt-out, universal-opt-out\"\n---\n\n# Global Privacy Control Integration with Cookie Consent\n\n## Overview\n\nGlobal Privacy Control (GPC) is a browser-level signal that communicates a user's privacy preferences to websites. Specified by the GPC community group and recognized as a legally binding opt-out mechanism under California's CCPA\u002FCPRA (effective January 1, 2023), Colorado's CPA (effective July 1, 2024), Connecticut's CTDPA (effective July 1, 2023), and other US state privacy laws, GPC transmits a `Sec-GPC: 1` HTTP header and a `navigator.globalPrivacyControl` JavaScript property with each request. Websites must detect this signal and automatically trigger opt-out of sale, sharing, and targeted advertising without requiring additional user action. Integration with cookie consent management platforms (CMPs) is essential to ensure the GPC signal correctly suppresses advertising cookies and data sharing.\n\n## GPC Signal Specification\n\n### How GPC Works\n\n**HTTP Header:**\n```\nSec-GPC: 1\n```\nPresent on every HTTP request when the user has enabled GPC in their browser or browser extension.\n\n**JavaScript API:**\n```javascript\nnavigator.globalPrivacyControl  \u002F\u002F Returns true if GPC is enabled\n```\n\n**GPC-Enabled Browsers and Extensions:**\n\n| Browser\u002FExtension | GPC Support | How to Enable |\n|-------------------|-------------|---------------|\n| Firefox | Built-in (v120+) | Settings > Privacy & Security > \"Tell websites not to sell or share my data\" |\n| Brave | Built-in (default ON) | Enabled by default; disable in Settings > Shields |\n| DuckDuckGo Browser | Built-in (default ON) | Enabled by default on mobile and desktop |\n| DuckDuckGo Extension | Extension | Install extension; GPC enabled by default |\n| Privacy Badger (EFF) | Extension | Install extension; GPC enabled by default |\n| OptMeowt | Extension | Chrome\u002FFirefox extension specifically for GPC |\n| Safari | Not natively supported | Requires third-party extension |\n| Chrome | Not natively supported | Requires extension (DuckDuckGo, Privacy Badger) |\n\n### GPC vs. Do Not Track (DNT)\n\n| Feature | GPC | DNT |\n|---------|-----|-----|\n| HTTP header | `Sec-GPC: 1` | `DNT: 1` |\n| JavaScript API | `navigator.globalPrivacyControl` | `navigator.doNotTrack` |\n| Legal recognition | Yes — CCPA\u002FCPRA, CPA, CTDPA, other state laws | No legal enforcement mechanism |\n| Scope | Opt-out of sale, sharing, targeted advertising | General tracking preference |\n| Browser adoption | Growing (Firefox, Brave, DuckDuckGo) | Deprecated by most browsers |\n| Industry compliance | Legally required in applicable jurisdictions | Largely ignored |\n\n## US State Law Mapping\n\n### GPC Legal Requirements by State\n\n| State | Law | GPC Status | Effective Date | Requirement |\n|-------|-----|------------|----------------|-------------|\n| California | CCPA\u002FCPRA | Legally binding opt-out | Jan 1, 2023 | Must treat GPC as valid opt-out of sale and sharing (Cal. Civ. Code §1798.135(e); 11 CCR §7025(b)) |\n| Colorado | CPA | Legally binding opt-out | Jul 1, 2024 | Must honor \"universal opt-out mechanism\" including GPC (C.R.S. §6-1-1313(1)(a); 4 CCR 904-3 Rule 5.11) |\n| Connecticut | CTDPA | Legally binding opt-out | Jul 1, 2023 (UOM: Jan 1, 2025) | Must honor \"opt-out preference signal\" (P.A. 22-15, §6(a)(6)) |\n| Montana | MCDPA | Legally binding opt-out | Oct 1, 2024 | Must honor universal opt-out mechanism |\n| Texas | TDPSA | Legally binding opt-out | Jul 1, 2024 (UOM: Jan 1, 2025) | Must honor universal opt-out mechanism |\n| Oregon | OCPA | Legally binding opt-out | Jul 1, 2024 (UOM: Jan 1, 2026) | Must honor universal opt-out mechanism |\n| Delaware | DPDPA | Legally binding opt-out | Jan 1, 2025 (UOM: Jan 1, 2026) | Must honor universal opt-out mechanism |\n| New Hampshire | NHPA | Legally binding opt-out | Jan 1, 2025 | Must honor universal opt-out mechanism |\n| New Jersey | NJDPA | Legally binding opt-out | Jan 15, 2025 (UOM: Jul 15, 2025) | Must honor universal opt-out mechanism |\n| Virginia | VCDPA | Voluntary (no UOM mandate) | Jan 1, 2023 | No explicit UOM requirement, but opt-out of targeted advertising required |\n| Utah | UCPA | Voluntary (no UOM mandate) | Dec 31, 2023 | No UOM requirement |\n\n### What GPC Triggers\n\nWhen GPC is detected for a user in an applicable jurisdiction:\n\n| Processing Activity | GPC Impact | Action Required |\n|--------------------|-----------|--------------------|\n| Sale of personal information | Opt-out triggered | Stop selling PI for this user |\n| Sharing for cross-context behavioral advertising | Opt-out triggered | Stop sharing PI with ad partners |\n| Targeted advertising | Opt-out triggered (CPA, CTDPA, TDPSA) | Disable behavioral targeting |\n| Profiling for automated decisions | Opt-out triggered (some states) | Disable profiling |\n| Analytics (first-party) | Not triggered | GPC does not opt out of first-party analytics |\n| Essential cookies | Not triggered | Strictly necessary cookies unaffected |\n\n## CMP Integration\n\n### Detection and Response Flow\n\n```\nPage Load\n    │\n    ├── Check for GPC signal\n    │   ├── navigator.globalPrivacyControl === true\n    │   │   OR\n    │   └── Server detects Sec-GPC: 1 header\n    │\n    ├── Determine user jurisdiction\n    │   ├── IP geolocation → US state mapping\n    │   └── Check if state has GPC legal requirement\n    │\n    ├── If GPC detected AND applicable jurisdiction:\n    │   ├── Automatically set consent state:\n    │   │   ├── ad_storage: denied\n    │   │   ├── ad_user_data: denied\n    │   │   ├── ad_personalization: denied\n    │   │   ├── analytics_storage: [per CMP default — GPC does not cover]\n    │   │   └── sale_of_data: opted_out\n    │   │\n    │   ├── Block advertising cookies and tags\n    │   ├── Do NOT fire: Meta Pixel, Google Ads remarketing, third-party ad tags\n    │   ├── DO fire: GA4 (if analytics consent separate from GPC)\n    │   │\n    │   ├── Display modified banner (optional):\n    │   │   \"We detected your Global Privacy Control preference.\n    │   │    We will not sell or share your personal information.\n    │   │    [Manage Other Preferences]\"\n    │   │\n    │   └── Record GPC opt-out in consent log\n    │\n    └── If GPC detected but NON-applicable jurisdiction (e.g., EU):\n        └── Treat as privacy signal but apply jurisdiction's own rules\n            (EU still requires opt-in consent regardless of GPC)\n```\n\n### Implementation for Pinnacle E-Commerce Ltd\n\n**Server-Side GPC Detection (Node.js middleware):**\n\n```javascript\nfunction detectGPC(req, res, next) {\n  const gpcHeader = req.headers['sec-gpc'];\n  const gpcEnabled = gpcHeader === '1';\n\n  req.gpcSignal = gpcEnabled;\n\n  if (gpcEnabled) {\n    \u002F\u002F Determine jurisdiction from IP\n    const userState = geolocateToState(req.ip);\n\n    \u002F\u002F States where GPC is legally binding\n    const gpcMandatoryStates = ['CA', 'CO', 'CT', 'MT', 'TX', 'OR', 'DE', 'NH', 'NJ'];\n\n    req.gpcLegallyBinding = gpcMandatoryStates.includes(userState);\n    req.gpcOptOut = {\n      sale: gpcEnabled && req.gpcLegallyBinding,\n      sharing: gpcEnabled && req.gpcLegallyBinding,\n      targetedAdvertising: gpcEnabled && req.gpcLegallyBinding,\n    };\n  }\n\n  next();\n}\n```\n\n**Client-Side GPC Detection and CMP Update:**\n\n```javascript\nfunction handleGPCSignal() {\n  const gpcEnabled = navigator.globalPrivacyControl === true;\n\n  if (!gpcEnabled) return;\n\n  \u002F\u002F Get user's jurisdiction (from server or geolocation)\n  const userJurisdiction = getUserJurisdiction();\n  const gpcBindingStates = ['CA', 'CO', 'CT', 'MT', 'TX', 'OR', 'DE', 'NH', 'NJ'];\n\n  if (gpcBindingStates.includes(userJurisdiction)) {\n    \u002F\u002F Update Google Consent Mode\n    gtag('consent', 'update', {\n      'ad_storage': 'denied',\n      'ad_user_data': 'denied',\n      'ad_personalization': 'denied',\n      \u002F\u002F analytics_storage not affected by GPC\n    });\n\n    \u002F\u002F Update CMP state\n    updateCMPState({\n      sale_optout: true,\n      sharing_optout: true,\n      targeted_advertising_optout: true,\n      source: 'gpc_signal',\n    });\n\n    \u002F\u002F Remove any existing advertising cookies\n    removeAdvertisingCookies();\n\n    \u002F\u002F Log GPC opt-out\n    logConsentEvent({\n      type: 'gpc_auto_optout',\n      jurisdiction: userJurisdiction,\n      timestamp: new Date().toISOString(),\n      gpc_header_present: true,\n    });\n  }\n}\n\nfunction removeAdvertisingCookies() {\n  const adCookies = ['_fbp', '_fbc', '_gcl_au', 'IDE', 'fr', 'NID'];\n  adCookies.forEach(name => {\n    document.cookie = `${name}=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=\u002F; domain=.pinnacle-ecommerce.com`;\n  });\n}\n\n\u002F\u002F Run on page load\nhandleGPCSignal();\n```\n\n### CMP Platform Integration\n\n**OneTrust GPC Configuration:**\n\n| Setting | Value |\n|---------|-------|\n| Honor GPC Signal | Enabled |\n| GPC Treatment | Apply to \"Sale of Personal Data\" and \"Targeted Advertising\" categories |\n| GPC Applicable Regions | US-CA, US-CO, US-CT, US-MT, US-TX, US-OR, US-DE, US-NH, US-NJ |\n| GPC Banner Behavior | Suppress opt-out banner (already opted out); show confirmation notice |\n| GPC Consent Record | Log GPC signal as opt-out source |\n\n**Cookiebot GPC Configuration:**\n\n| Setting | Value |\n|---------|-------|\n| Respect GPC | Enabled |\n| GPC → Category Mapping | GPC = reject \"Marketing\" category |\n| GPC Regions | California, Colorado, Connecticut, Montana, Texas, Oregon, Delaware, New Hampshire, New Jersey |\n\n## GPC Verification and Compliance\n\n### Testing GPC Integration\n\n| Test | Expected Behavior | Verification Method |\n|------|-------------------|-------------------|\n| GPC header sent | Browser sends `Sec-GPC: 1` | Network inspector |\n| Server detects GPC | Middleware sets `req.gpcSignal = true` | Server logs |\n| Ad cookies blocked | No _fbp, _gcl_au, IDE cookies set | Cookie inspector |\n| Ad tags blocked | No Meta Pixel, Google Ads remarketing requests | Network inspector |\n| Analytics unaffected | GA4 still fires (GPC does not cover analytics) | GA4 real-time reports |\n| Consent log records GPC | GPC opt-out logged with timestamp and jurisdiction | Database query |\n| CCPA opt-out link reflects GPC | \"Do Not Sell\" page shows GPC-detected opt-out status | UI inspection |\n| Modified banner displayed | Banner acknowledges GPC preference | Visual verification |\n\n### CCPA\u002FCPRA Specific Requirements\n\nUnder California Attorney General regulations (11 CCR §7025):\n\n1. **No degradation of service**: A business must not interpret GPC as consent to financial incentive opt-in\n2. **Conflict resolution**: If a user has previously opted in to sale\u002Fsharing, GPC on a subsequent visit should be treated as a revocation of that opt-in\n3. **No re-prompting**: Do not ask a GPC user to reconsider their opt-out choice\n4. **Record keeping**: Maintain records of GPC-triggered opt-outs for 24 months\n5. **Privacy policy disclosure**: State in the privacy policy that the business honors GPC\n\n**Pinnacle E-Commerce Ltd Privacy Policy Language:**\n\n> \"We recognize the Global Privacy Control (GPC) signal sent by your browser. When we detect a GPC signal from a user in California, we treat it as a request to opt out of the sale and sharing of personal information as defined under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA). We apply this opt-out automatically without requiring any additional action from you.\"\n\n## Edge Cases\n\n| Scenario | Resolution |\n|----------|-----------|\n| User has GPC enabled but previously opted IN to sharing | GPC overrides — treat as opt-out (most recent signal governs) |\n| User has GPC enabled and is in non-applicable state (e.g., Utah) | Respect GPC as privacy preference but not legally required |\n| User has GPC enabled and is in EU | GPC does not substitute for opt-in consent; apply EU rules |\n| GPC detected on API request (no browser) | Honor if Sec-GPC header present (may be from privacy-aware app) |\n| GPC enabled for some pages, disabled for others | Per-request evaluation; this should not normally occur |\n| Multiple opt-out signals (GPC + cookie banner reject) | Apply most restrictive — both result in opt-out |\n\n## Key Legal and Technical References\n\n- **GPC Specification (globalprivacycontrol.org)** — Technical specification for the GPC signal\n- **CCPA\u002FCPRA Cal. Civ. Code §1798.135(e)** — Business must treat GPC as valid opt-out request\n- **11 CCR §7025(b)-(c) (California AG Regulations)** — GPC implementation requirements\n- **Colorado CPA Rules, 4 CCR 904-3, Rule 5.11** — Universal opt-out mechanism requirements including GPC\n- **Connecticut CTDPA P.A. 22-15, §6(a)(6)** — Opt-out preference signal requirement\n- **California AG Enforcement Action: Sephora (August 2022)** — First CCPA enforcement for failure to honor GPC; $1.2 million settlement\n- **EDPB Statement on GPC (2023)** — European perspective on GPC as an expression of Article 21 objection right\n- **W3C Privacy Community Group** — GPC specification development\n- **IAB CCPA Compliance Framework** — US Privacy String and GPC interoperability\n","# Global Privacy Control Integration with Cookie Consent\n\n## Overview\n\nGlobal Privacy Control (GPC) is a browser-level signal that communicates a user's privacy preferences to websites. Specified by the GPC community group and recognized as a legally binding opt-out mechanism under California's CCPA\u002FCPRA (effective January 1, 2023), Colorado's CPA (effective July 1, 2024), Connecticut's CTDPA (effective July 1, 2023), and other US state privacy laws, GPC transmits a `Sec-GPC: 1` HTTP header and a `navigator.globalPrivacyControl` JavaScript property with each request. Websites must detect this signal and automatically trigger opt-out of sale, sharing, and targeted advertising without requiring additional user action. Integration with cookie consent management platforms (CMPs) is essential to ensure the GPC signal correctly suppresses advertising cookies and data sharing.\n\n## GPC Signal Specification\n\n### How GPC Works\n\n**HTTP Header:**\n```\nSec-GPC: 1\n```\nPresent on every HTTP request when the user has enabled GPC in their browser or browser extension.\n\n**JavaScript API:**\n```javascript\nnavigator.globalPrivacyControl  \u002F\u002F Returns true if GPC is enabled\n```\n\n**GPC-Enabled Browsers and Extensions:**\n\n| Browser\u002FExtension | GPC Support | How to Enable |\n|-------------------|-------------|---------------|\n| Firefox | Built-in (v120+) | Settings > Privacy & Security > \"Tell websites not to sell or share my data\" |\n| Brave | Built-in (default ON) | Enabled by default; disable in Settings > Shields |\n| DuckDuckGo Browser | Built-in (default ON) | Enabled by default on mobile and desktop |\n| DuckDuckGo Extension | Extension | Install extension; GPC enabled by default |\n| Privacy Badger (EFF) | Extension | Install extension; GPC enabled by default |\n| OptMeowt | Extension | Chrome\u002FFirefox extension specifically for GPC |\n| Safari | Not natively supported | Requires third-party extension |\n| Chrome | Not natively supported | Requires extension (DuckDuckGo, Privacy Badger) |\n\n### GPC vs. Do Not Track (DNT)\n\n| Feature | GPC | DNT |\n|---------|-----|-----|\n| HTTP header | `Sec-GPC: 1` | `DNT: 1` |\n| JavaScript API | `navigator.globalPrivacyControl` | `navigator.doNotTrack` |\n| Legal recognition | Yes — CCPA\u002FCPRA, CPA, CTDPA, other state laws | No legal enforcement mechanism |\n| Scope | Opt-out of sale, sharing, targeted advertising | General tracking preference |\n| Browser adoption | Growing (Firefox, Brave, DuckDuckGo) | Deprecated by most browsers |\n| Industry compliance | Legally required in applicable jurisdictions | Largely ignored |\n\n## US State Law Mapping\n\n### GPC Legal Requirements by State\n\n| State | Law | GPC Status | Effective Date | Requirement |\n|-------|-----|------------|----------------|-------------|\n| California | CCPA\u002FCPRA | Legally binding opt-out | Jan 1, 2023 | Must treat GPC as valid opt-out of sale and sharing (Cal. Civ. Code §1798.135(e); 11 CCR §7025(b)) |\n| Colorado | CPA | Legally binding opt-out | Jul 1, 2024 | Must honor \"universal opt-out mechanism\" including GPC (C.R.S. §6-1-1313(1)(a); 4 CCR 904-3 Rule 5.11) |\n| Connecticut | CTDPA | Legally binding opt-out | Jul 1, 2023 (UOM: Jan 1, 2025) | Must honor \"opt-out preference signal\" (P.A. 22-15, §6(a)(6)) |\n| Montana | MCDPA | Legally binding opt-out | Oct 1, 2024 | Must honor universal opt-out mechanism |\n| Texas | TDPSA | Legally binding opt-out | Jul 1, 2024 (UOM: Jan 1, 2025) | Must honor universal opt-out mechanism |\n| Oregon | OCPA | Legally binding opt-out | Jul 1, 2024 (UOM: Jan 1, 2026) | Must honor universal opt-out mechanism |\n| Delaware | DPDPA | Legally binding opt-out | Jan 1, 2025 (UOM: Jan 1, 2026) | Must honor universal opt-out mechanism |\n| New Hampshire | NHPA | Legally binding opt-out | Jan 1, 2025 | Must honor universal opt-out mechanism |\n| New Jersey | NJDPA | Legally binding opt-out | Jan 15, 2025 (UOM: Jul 15, 2025) | Must honor universal opt-out mechanism |\n| Virginia | VCDPA | Voluntary (no UOM mandate) | Jan 1, 2023 | No explicit UOM requirement, but opt-out of targeted advertising required |\n| Utah | UCPA | Voluntary (no UOM mandate) | Dec 31, 2023 | No UOM requirement |\n\n### What GPC Triggers\n\nWhen GPC is detected for a user in an applicable jurisdiction:\n\n| Processing Activity | GPC Impact | Action Required |\n|--------------------|-----------|--------------------|\n| Sale of personal information | Opt-out triggered | Stop selling PI for this user |\n| Sharing for cross-context behavioral advertising | Opt-out triggered | Stop sharing PI with ad partners |\n| Targeted advertising | Opt-out triggered (CPA, CTDPA, TDPSA) | Disable behavioral targeting |\n| Profiling for automated decisions | Opt-out triggered (some states) | Disable profiling |\n| Analytics (first-party) | Not triggered | GPC does not opt out of first-party analytics |\n| Essential cookies | Not triggered | Strictly necessary cookies unaffected |\n\n## CMP Integration\n\n### Detection and Response Flow\n\n```\nPage Load\n    │\n    ├── Check for GPC signal\n    │   ├── navigator.globalPrivacyControl === true\n    │   │   OR\n    │   └── Server detects Sec-GPC: 1 header\n    │\n    ├── Determine user jurisdiction\n    │   ├── IP geolocation → US state mapping\n    │   └── Check if state has GPC legal requirement\n    │\n    ├── If GPC detected AND applicable jurisdiction:\n    │   ├── Automatically set consent state:\n    │   │   ├── ad_storage: denied\n    │   │   ├── ad_user_data: denied\n    │   │   ├── ad_personalization: denied\n    │   │   ├── analytics_storage: [per CMP default — GPC does not cover]\n    │   │   └── sale_of_data: opted_out\n    │   │\n    │   ├── Block advertising cookies and tags\n    │   ├── Do NOT fire: Meta Pixel, Google Ads remarketing, third-party ad tags\n    │   ├── DO fire: GA4 (if analytics consent separate from GPC)\n    │   │\n    │   ├── Display modified banner (optional):\n    │   │   \"We detected your Global Privacy Control preference.\n    │   │    We will not sell or share your personal information.\n    │   │    [Manage Other Preferences]\"\n    │   │\n    │   └── Record GPC opt-out in consent log\n    │\n    └── If GPC detected but NON-applicable jurisdiction (e.g., EU):\n        └── Treat as privacy signal but apply jurisdiction's own rules\n            (EU still requires opt-in consent regardless of GPC)\n```\n\n### Implementation for Pinnacle E-Commerce Ltd\n\n**Server-Side GPC Detection (Node.js middleware):**\n\n```javascript\nfunction detectGPC(req, res, next) {\n  const gpcHeader = req.headers['sec-gpc'];\n  const gpcEnabled = gpcHeader === '1';\n\n  req.gpcSignal = gpcEnabled;\n\n  if (gpcEnabled) {\n    \u002F\u002F Determine jurisdiction from IP\n    const userState = geolocateToState(req.ip);\n\n    \u002F\u002F States where GPC is legally binding\n    const gpcMandatoryStates = ['CA', 'CO', 'CT', 'MT', 'TX', 'OR', 'DE', 'NH', 'NJ'];\n\n    req.gpcLegallyBinding = gpcMandatoryStates.includes(userState);\n    req.gpcOptOut = {\n      sale: gpcEnabled && req.gpcLegallyBinding,\n      sharing: gpcEnabled && req.gpcLegallyBinding,\n      targetedAdvertising: gpcEnabled && req.gpcLegallyBinding,\n    };\n  }\n\n  next();\n}\n```\n\n**Client-Side GPC Detection and CMP Update:**\n\n```javascript\nfunction handleGPCSignal() {\n  const gpcEnabled = navigator.globalPrivacyControl === true;\n\n  if (!gpcEnabled) return;\n\n  \u002F\u002F Get user's jurisdiction (from server or geolocation)\n  const userJurisdiction = getUserJurisdiction();\n  const gpcBindingStates = ['CA', 'CO', 'CT', 'MT', 'TX', 'OR', 'DE', 'NH', 'NJ'];\n\n  if (gpcBindingStates.includes(userJurisdiction)) {\n    \u002F\u002F Update Google Consent Mode\n    gtag('consent', 'update', {\n      'ad_storage': 'denied',\n      'ad_user_data': 'denied',\n      'ad_personalization': 'denied',\n      \u002F\u002F analytics_storage not affected by GPC\n    });\n\n    \u002F\u002F Update CMP state\n    updateCMPState({\n      sale_optout: true,\n      sharing_optout: true,\n      targeted_advertising_optout: true,\n      source: 'gpc_signal',\n    });\n\n    \u002F\u002F Remove any existing advertising cookies\n    removeAdvertisingCookies();\n\n    \u002F\u002F Log GPC opt-out\n    logConsentEvent({\n      type: 'gpc_auto_optout',\n      jurisdiction: userJurisdiction,\n      timestamp: new Date().toISOString(),\n      gpc_header_present: true,\n    });\n  }\n}\n\nfunction removeAdvertisingCookies() {\n  const adCookies = ['_fbp', '_fbc', '_gcl_au', 'IDE', 'fr', 'NID'];\n  adCookies.forEach(name => {\n    document.cookie = `${name}=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=\u002F; domain=.pinnacle-ecommerce.com`;\n  });\n}\n\n\u002F\u002F Run on page load\nhandleGPCSignal();\n```\n\n### CMP Platform Integration\n\n**OneTrust GPC Configuration:**\n\n| Setting | Value |\n|---------|-------|\n| Honor GPC Signal | Enabled |\n| GPC Treatment | Apply to \"Sale of Personal Data\" and \"Targeted Advertising\" categories |\n| GPC Applicable Regions | US-CA, US-CO, US-CT, US-MT, US-TX, US-OR, US-DE, US-NH, US-NJ |\n| GPC Banner Behavior | Suppress opt-out banner (already opted out); show confirmation notice |\n| GPC Consent Record | Log GPC signal as opt-out source |\n\n**Cookiebot GPC Configuration:**\n\n| Setting | Value |\n|---------|-------|\n| Respect GPC | Enabled |\n| GPC → Category Mapping | GPC = reject \"Marketing\" category |\n| GPC Regions | California, Colorado, Connecticut, Montana, Texas, Oregon, Delaware, New Hampshire, New Jersey |\n\n## GPC Verification and Compliance\n\n### Testing GPC Integration\n\n| Test | Expected Behavior | Verification Method |\n|------|-------------------|-------------------|\n| GPC header sent | Browser sends `Sec-GPC: 1` | Network inspector |\n| Server detects GPC | Middleware sets `req.gpcSignal = true` | Server logs |\n| Ad cookies blocked | No _fbp, _gcl_au, IDE cookies set | Cookie inspector |\n| Ad tags blocked | No Meta Pixel, Google Ads remarketing requests | Network inspector |\n| Analytics unaffected | GA4 still fires (GPC does not cover analytics) | GA4 real-time reports |\n| Consent log records GPC | GPC opt-out logged with timestamp and jurisdiction | Database query |\n| CCPA opt-out link reflects GPC | \"Do Not Sell\" page shows GPC-detected opt-out status | UI inspection |\n| Modified banner displayed | Banner acknowledges GPC preference | Visual verification |\n\n### CCPA\u002FCPRA Specific Requirements\n\nUnder California Attorney General regulations (11 CCR §7025):\n\n1. **No degradation of service**: A business must not interpret GPC as consent to financial incentive opt-in\n2. **Conflict resolution**: If a user has previously opted in to sale\u002Fsharing, GPC on a subsequent visit should be treated as a revocation of that opt-in\n3. **No re-prompting**: Do not ask a GPC user to reconsider their opt-out choice\n4. **Record keeping**: Maintain records of GPC-triggered opt-outs for 24 months\n5. **Privacy policy disclosure**: State in the privacy policy that the business honors GPC\n\n**Pinnacle E-Commerce Ltd Privacy Policy Language:**\n\n> \"We recognize the Global Privacy Control (GPC) signal sent by your browser. When we detect a GPC signal from a user in California, we treat it as a request to opt out of the sale and sharing of personal information as defined under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA). We apply this opt-out automatically without requiring any additional action from you.\"\n\n## Edge Cases\n\n| Scenario | Resolution |\n|----------|-----------|\n| User has GPC enabled but previously opted IN to sharing | GPC overrides — treat as opt-out (most recent signal governs) |\n| User has GPC enabled and is in non-applicable state (e.g., Utah) | Respect GPC as privacy preference but not legally required |\n| User has GPC enabled and is in EU | GPC does not substitute for opt-in consent; apply EU rules |\n| GPC detected on API request (no browser) | Honor if Sec-GPC header present (may be from privacy-aware app) |\n| GPC enabled for some pages, disabled for others | Per-request evaluation; this should not normally occur |\n| Multiple opt-out signals (GPC + cookie banner reject) | Apply most restrictive — both result in opt-out |\n\n## Key Legal and Technical References\n\n- **GPC Specification (globalprivacycontrol.org)** — Technical specification for the GPC signal\n- **CCPA\u002FCPRA Cal. Civ. Code §1798.135(e)** — Business must treat GPC as valid opt-out request\n- **11 CCR §7025(b)-(c) (California AG Regulations)** — GPC implementation requirements\n- **Colorado CPA Rules, 4 CCR 904-3, Rule 5.11** — Universal opt-out mechanism requirements including GPC\n- **Connecticut CTDPA P.A. 22-15, §6(a)(6)** — Opt-out preference signal requirement\n- **California AG Enforcement Action: Sephora (August 2022)** — First CCPA enforcement for failure to honor GPC; $1.2 million settlement\n- **EDPB Statement on GPC (2023)** — European perspective on GPC as an expression of Article 21 objection right\n- **W3C Privacy Community Group** — GPC specification development\n- **IAB CCPA Compliance Framework** — US Privacy String and GPC interoperability\n",{"name":5,"license":15,"metadata":37,"description":7},{"tags":38,"author":9,"domain":29,"version":39,"subdomain":40},"gpc, global-privacy-control, opt-out, ccpa-opt-out, universal-opt-out","1.0","cookie-consent-compliance","main","9b2ef9eae161c00a17241d42a388571321b33e9f","plugins\u002Fprivacy-skills-complete\u002Fskills\u002Fgpc-cookie-integration",68,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-03-17 04:06:52",{"source":8,"skillName":5,"commands":51,"prompt":61,"zipAvailable":62},[52,55,58],{"tool":53,"command":54},"npx","npx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill gpc-cookie-integration",{"tool":56,"command":57},"bunx","bunx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill gpc-cookie-integration",{"tool":59,"command":60},"pnpm","pnpm dlx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill gpc-cookie-integration","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Fgpc-cookie-integration\u002FSKILL.md",true,[64,70,76,80,84],{"path":65,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":68,"sourceHtmlUrl":69},"assets\u002Ftemplate.md","ASSET","资产文件",1843,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Fgpc-cookie-integration\u002Fassets\u002Ftemplate.md",{"path":71,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":74,"sourceHtmlUrl":75},"reference\u002Fworkflow-template.md","REFERENCE","参考文档",5139,"https:\u002F\u002Fgithub.com\u002Fmatheusnorjosa\u002Faprender_sistema\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Ffindings-crosscheck\u002Freference\u002Fworkflow-template.md",{"path":77,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":78,"sourceHtmlUrl":79},"references\u002Fstandards.md",1523,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Fgpc-cookie-integration\u002Freferences\u002Fstandards.md",{"path":81,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":82,"sourceHtmlUrl":83},"references\u002Fworkflows.md",1769,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Fgpc-cookie-integration\u002Freferences\u002Fworkflows.md",{"path":85,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":88,"sourceHtmlUrl":89},"scripts\u002Fprocess.py","SCRIPT","脚本",7481,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Fgpc-cookie-integration\u002Fscripts\u002Fprocess.py",[91,115,132,145,162,175],{"skillNo":92,"name":93,"nameZh":6,"description":94,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":95,"categories":96,"keywords":106,"publishedAt":32},"01M6AG6K8R3XW10ENWH2FH18RH","workplace-email-privacy","Implements email and internet monitoring compliance in the workplace per Barbulescu v Romania (ECHR Grand Chamber), EDPB guidance, and national labour law. Covers acceptable use policies, legitimate expectation of privacy, proportionality testing, and content vs metadata monitoring. Keywords: email monitoring, Barbulescu, workplace privacy, internet monitoring, acceptable use policy, ECHR, proportionality.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fworkplace-email-privacy\u002FSKILL.md",[97,102,105],{"categoryNo":98,"categoryName":99,"taxonomyType":100,"taxonomyTypeDesc":101},"01JBSEEDCAT000000000000005","邮件与沟通","SCENARIO","使用场景",{"categoryNo":103,"categoryName":104,"taxonomyType":100,"taxonomyTypeDesc":101},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[107,108,29,27,109,110,111,112,113,114],"email","workplace email privacy","content","data","policy","testing","monitoring","metadata",{"skillNo":116,"name":117,"nameZh":6,"description":118,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":119,"categories":120,"keywords":125,"publishedAt":32},"01M6AG6FRCBJY7D061BJZMNV49","whistleblower-data","Implements data protection compliance for whistleblowing systems under EU Directive 2019\u002F1937 and GDPR. Covers anonymous reporting channels, identity protection for whistleblowers and accused persons, retention limits, access restrictions, and retaliation prevention. Addresses national transpositions and DPA guidance. Keywords: whistleblower, Directive 2019\u002F1937, anonymous reporting, identity protection, retaliation, retention, reporting channel.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fwhistleblower-data\u002FSKILL.md",[121,124],{"categoryNo":122,"categoryName":123,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000033","数据分析师",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[110,126,127,128,27,129,130,29,131],"whistleblower data","identity","reporting","data protection","gdpr","prevention",{"skillNo":133,"name":134,"nameZh":6,"description":135,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":136,"categories":137,"keywords":139,"publishedAt":32},"01M6AG6CJP0PW3X65HC7VP9SR9","vendor-termination-data","Vendor termination data return and deletion procedures per GDPR Article 28(3)(g). Covers data extraction formats, deletion certification requirements, transition planning, residual data handling, and post-termination verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-termination-data\u002FSKILL.md",[138],{"categoryNo":122,"categoryName":123,"taxonomyType":21,"taxonomyTypeDesc":22},[110,140,141,142,143,130,29,144],"vendor termination data","planning","verification","extraction","certification",{"skillNo":146,"name":147,"nameZh":6,"description":148,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":149,"categories":150,"keywords":152,"publishedAt":32},"01M6AG69E277DXZB2NF6KV17ZA","vendor-risk-scoring","Vendor privacy risk tiering methodology for processor management. Covers scoring factors including data volume, sensitivity, transfer locations, certifications, breach history, and control maturity with weighted risk calculation and tier assignment.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-risk-scoring\u002FSKILL.md",[151],{"categoryNo":122,"categoryName":123,"taxonomyType":21,"taxonomyTypeDesc":22},[153,154,155,156,157,158,159,160,29,110,161],"vendor risk scoring","risk","risk scoring","methodology","risk-scoring","assessment","transfer","certifications","processor",{"skillNo":163,"name":164,"nameZh":6,"description":165,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":166,"categories":167,"keywords":169,"publishedAt":32},"01M6AG6655ABFKT2BBWHCP4PAT","vendor-privacy-due-diligence","Pre-contract vendor privacy due diligence per GDPR Article 28(1). Covers risk questionnaires, technical controls assessment, certification review, data flow analysis, and documented sufficiency decisions for processor engagement.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-due-diligence\u002FSKILL.md",[168],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[29,170,130,171,158,172,173,110,161,154,144,174],"vendor privacy due diligence","review","onboarding","flow","analysis",{"skillNo":176,"name":177,"nameZh":6,"description":178,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":179,"categories":180,"keywords":188,"publishedAt":32},"01M6AG62C3VD8SYNGH4N7RHZTE","vendor-privacy-audit","On-site and remote vendor audit procedures per GDPR Article 28(3)(h). Covers audit planning, evidence collection methodologies, finding classification, remediation tracking, and audit report generation for processor compliance verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-audit\u002FSKILL.md",[181,184,187],{"categoryNo":182,"categoryName":183,"taxonomyType":100,"taxonomyTypeDesc":101},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":185,"categoryName":186,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000036","内容创作者",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[189,190,29,191,142,192,27,130,193,161,194,195,196,141],"vendor privacy audit","audit","report","audit report","remediation","collection","remediation-tracking","classification"]