Honouring Global Privacy Control in your analytics
Browsers can send a Global Privacy Control signal meaning do not track or sell my data. How to detect it, and why honouring it everywhere is the simple choice.
Global Privacy Control is a signal a browser can send to say the user opts out of their data being sold or shared. Scripts can read it as navigator.globalPrivacyControl, and servers see it as a request header.
Honour it before the first event
function optedOut() {
if (localStorage.getItem("analyticsConsent") === "denied") return true;
return navigator.globalPrivacyControl === true;
}Check it in the tracking wrapper so no call site can forget, and set GA's disable flag before its config call so the automatic page view is skipped too.
Why honour it everywhere
Some laws require it in some places. Working out who is where is more effort than simply respecting the signal for everyone, and the data you lose is small. Pair it with a visible opt-out on your privacy page and with keeping private data out of URLs: keep keys out of analytics.
Questions
What is Global Privacy Control?
A browser signal, sent as a request header and exposed to scripts, that says the user does not want their data sold or shared. Some browsers and extensions send it.
Is honouring GPC legally required?
Some privacy laws, such as California's, treat it as a valid opt-out request. Check what applies to you; this is general information, not legal advice.
How do I honour it in analytics?
Check navigator.globalPrivacyControl before sending anything, and if it is true, send nothing, including the first page view.