Support Library

Cookie Consent, Privacy Choices and Global Privacy Control

Analytics and advertising tags set cookies and share visitor data. In the EU and UK, those cookies need consent before they are set. In California and a growing list of US states, sharing data for advertising means offering an opt-out link and honouring the Global Privacy Control browser signal.

Author
CategoryWebsite Security
Length5 minute read
UpdatedNovember 2, 2026

The short answer

If the site loads trackers that set cookies, add a consent management platform and load those trackers only after a visitor agrees. If it loads advertising trackers, add a “Your Privacy Choices” link to the footer, honour the GPC signal, and publish {"gpc": true, "lastUpdate": "2026-11-01"} at /.well-known/gpc.json.

Consent before tracking

How trackers should wait for consent and respect opt-out signals Top, no consent: a visitor opens the homepage, analytics and advertising tags load immediately and set cookies, and the browser’s Global Privacy Control signal is ignored. Bottom, consent first: a consent banner loads first, trackers wait until the visitor agrees, and a visitor whose browser sends GPC is opted out of sale and sharing automatically. Tracking without consent Visitor arrives GPC signal sent Tags load at once Analytics, ads Cookies set Before any choice Signal ignored Data shared anyway Breaches EU and UK cookie rules Ignores US opt-out rights Consent and choices respected Visitor arrives GPC signal sent Banner first Consent platform Tags wait Load after “Accept” GPC honoured Opted out of sharing Cookies only with consent Opt-outs applied automatically How trackers should wait for consent and respect opt-out signals Top, no consent: a visitor opens the homepage, analytics and advertising tags load immediately and set cookies, and the browser’s Global Privacy Control signal is ignored. Bottom, consent first: a consent banner loads first, trackers wait until the visitor agrees, and a visitor whose browser sends GPC is opted out of sale and sharing automatically. Tracking without consent Visitor arrives GPC signal sent Tags load at once Analytics, ads Cookies set Before any choice Signal ignored Data shared anyway Breaches EU and UK cookie rules Ignores US opt-out rights Consent and choices respected Visitor arrives GPC signal sent Banner first Consent platform Tags wait Load after “Accept” GPC honoured Opted out of sharing Cookies only with consent Opt-outs applied automatically
Strictly necessary cookies, such as a session or a load balancer cookie, do not need consent. Analytics and advertising cookies do.

How DNS Panopticon detects it

Security Posture reads the homepage HTML for known trackers (analytics, advertising and tag managers), consent management platforms and Google Consent Mode, looks for a privacy choices link, and fetches /.well-known/gpc.json. Trackers or a banner that a tag manager adds later cannot be seen. The results appear on the Privacy card.

FindingSeverityWhen it appears
No cookie consent tool foundMediumTrackers that set cookies load, but no consent banner or platform was found.
Cookie consent couldn’t be confirmedNot gradedConsent Mode or a tag manager is present, but whether visitors are asked cannot be seen in the HTML.
No “Your Privacy Choices” linkLowAdvertising trackers load, which counts as sharing under CCPA/CPRA, but there is no opt-out link.
No Global Privacy Control declarationLow/.well-known/gpc.json is missing, or says GPC is not honoured.
Cookie consent is asked for / choices linked / GPC honouredPassThe expectation is met.
No cookie-setting tracker found on the homepagePassNo tracker known to set cookies was found in the HTML. This isn’t a legal finding about other tracking.
The homepage loads N trackersNoteLists what was seen, for context.

How to check it yourself

Command or toolWhat to look for
curl -s https://example.com/.well-known/gpc.jsonA JSON file with "gpc": true.
curl -s https://example.com/ | grep -ioE "googletagmanager|gtag|fbevents|onetrust|cookiebot|cookieyes|didomi"Trackers and consent tools in the homepage HTML.

In a private browser window, open developer tools before loading the site: Application → Cookies should show no analytics or advertising cookies until you accept. To test GPC, use a browser that sends it (Firefox with the setting on, Brave or DuckDuckGo) and check that navigator.globalPrivacyControl is true and your site applies the opt-out.

Which rules apply

RequirementWhereWhat it means
Consent before non-essential cookiesEU (ePrivacy Directive and GDPR), UK (PECR)Ask first, make refusing as easy as accepting, and do not pre-tick boxes.
“Do Not Sell or Share” / “Your Privacy Choices” linkCalifornia (CCPA/CPRA) and several other US statesCovered businesses that sell or share data, including for targeted ads, must offer an opt-out link on the homepage.
Honour Global Privacy ControlCalifornia, Colorado and other statesTreat the browser’s GPC signal as a valid opt-out of sale and sharing.
/.well-known/gpc.jsonGPC specificationA public statement that the site honours the signal.

Smaller organisations may be below the thresholds of US state laws; check whether they apply to you.

Why it matters

  • Enforcement is common. Cookie consent is one of the most enforced privacy rules in Europe, and the California Attorney General’s first CCPA settlement concerned ignoring GPC.
  • Trust. Visitors notice banners that cannot be refused, and trackers that ignore their settings.
  • Data quality. Consent Mode and proper consent records keep analytics usable and defensible.

How to set it up

  1. List your trackers and decide which are strictly necessary. Remove any you no longer use.
  2. Add a consent management platform (OneTrust, Cookiebot, CookieYes, Didomi and others) and configure it to block non-essential tags until consent, with Reject as easy as Accept.
  3. Load trackers through the platform or a tag manager that respects its choices, and enable Google Consent Mode if you use Google tags.
  4. Add the opt-out link “Your Privacy Choices” (or “Do Not Sell or Share My Personal Information”) to the footer if you sell or share data for advertising, and make it work.
  5. Honour GPC: read the Sec-GPC: 1 header or navigator.globalPrivacyControl and apply the opt-out automatically. Many consent platforms can do this for you.
  6. Publish /.well-known/gpc.json with {"gpc": true, "lastUpdate": "YYYY-MM-DD"}.
  7. Test in a private window and record the results for your compliance file.

FAQ

Our banner is added by Google Tag Manager. Why does it say no consent tool was found?

DNS Panopticon reads the HTML as served and cannot run tag managers. Where a container is present it reports consent as unconfirmed rather than missing. Loading the consent platform directly in the page, before the tag manager, also makes sure it runs first.

Do we need a banner if we only use privacy-friendly analytics?

Analytics tools that set no cookies and collect no personal data often need no consent in the EU and UK. DNS Panopticon only asks for consent when it sees trackers that set cookies.

We are not in California. Does GPC matter?

If you have visitors from states that require it and meet their thresholds, yes. Even where it is not required, honouring GPC is a simple way to respect visitors’ choices.

Sources and further reading

Related support articles

Privacy Policy RequirementsSecure, HttpOnly and SameSite Cookie FlagsTrust Centers