Overview

Global Privacy Control (GPC) is a technical specification that allows users to signal their opt-out preference from their browser. When enabled, the GPC opt-out signal indicates that the user does not consent to their personal data or geolocation being sold or shared.

About the GPC opt-out signal

Technically, the browser-level GPC opt-out signal is transmitted using an HTTP header (Sec-GPC) set to 1 in HTTP requests made by the browser. The method for enabling the GPC opt-out signal varies by browser. Some browsers require installing an extension.

GPC specification

For the complete GPC specification, refer to the official GPC website.

Supported inventory suppliers

Equativ can receive, process, and propagate the GPC opt-out signal from the following types of inventory suppliers:

• Publishers using smart.js: for publishers using Equativ ad tags with the smart.js library, retrieving and sending the GPC opt-out header is automated. The smart.js library manages the process without requiring manual activation or configuration. For more information, see Tagging guide: get started.
• Inventory suppliers using Equativ’s Ad API: suppliers sending ad requests directly via the Equativ Ad API can include the GPC HTTP header as defined in the specification. For more information about the Ad API, see GET Ad API integration and POST Ad API integration: usage.
• Inventory suppliers using Equativ’s openRTB endpoint: Suppliers sending openRTB bid requests to Equativ can include the GPC opt-out header in the bid request.

Downstream signaling

Equativ propagates the received GPC opt-out header to all demand partners by including it in the bid requests—even if the GPC opt-out signal is not applicable in the user’s region.

GPC opt-out header processing

When Equativ receives a GPC opt-out header set to 1, it first checks if the signal must be enforced, based on the user's geolocation:

• Inventory suppliers using Equativ’s openRTB endpoint: The GPC opt-out signal is enforced if the country code USA (following the ISO 3166-1 alpha-3 standard) is sent in the geo.country field of the openRTB request. For more information about the geo object, see the Open RTB specification.
• Publishers using smart.js and inventory suppliers using Equativ’s Ad API: The GPC opt-out signal is enforced if the Global Privacy Platform (GPP) consent string contains a US privacy section (GPP section IDs 6 to 22), indicating that a US regulation applies. For a list of US sections and IDs, see the "GPP signal processing" section in Comply with Global Privacy Platform (GPP) or consult the GPP section information.

The GPC opt-out signal is enforced as follows:

• US users with GPC opt-out signal: if the user is in the US and the GPC opt-out header is present (Sec-GPC: 1), consent is treated as withdrawn. Equativ refrains from selling or sharing personalized data and does not use detailed geolocation data. Equativ prioritizes the GPC opt-out signal over any conflicting GDPR/GPP consent status. For more information, see section "Impact of negative/withdrawn consent" in Comply with Global Privacy Platform (GPP).
• Non-US users with GPC opt-out signal: if the user is outside the US, the GPC opt-out signal does not trigger enforcement by Equativ. Only the GPP/GDPR privacy choices are considered. However, the GPC opt-out signal is still propagated to demand partners as described in "Downstream signaling".
• Users without GPC signal: if the GPC opt-out header is absent, null, or set to 0, only the GPP/GDPR privacy choices are considered. For more information, see Comply with Global Privacy Platform (GPP).