Application honors Global Privacy Control (GPC) browser signal

The California Attorney General's 2022 enforcement guidance confirmed that businesses must treat the Global Privacy Control (GPC) signal as a valid opt-out of sale and sharing under CCPA § 1798.120. GPC is a browser-level HTTP header (Sec-GPC: 1) and JavaScript property (navigator.globalPrivacyControl) sent automatically by Brave, Firefox with privacy settings, and the Privacy Badger extension. If your middleware doesn't read this header before any third-party pixels initialize, you are sharing PI with advertising platforms before the consumer's opt-out signal is honored — a per-page-load violation. Unlike a manual opt-out form, GPC arrives on every qualifying request without any user action on your site.

Implement GPC detection in middleware.ts so the opt-out cookie is set before any client JavaScript runs, then gate all pixel initialization on the combined preference check.

// middleware.ts — intercept GPC before client-side code loads
import { NextRequest, NextResponse } from 'next/server'

export function middleware(req: NextRequest) {
  const gpc = req.headers.get('Sec-GPC')
  const response = NextResponse.next()
  if (gpc === '1') {
    response.cookies.set('ccpa_opt_out', '1', {
      path: '/', maxAge: 60 * 60 * 24 * 365, sameSite: 'lax',
    })
  }
  return response
}

// lib/analytics.ts — combined GPC + cookie check
function isOptedOut(): boolean {
  if (typeof navigator !== 'undefined' && navigator.globalPrivacyControl === true) return true
  if (typeof document !== 'undefined') return document.cookie.includes('ccpa_opt_out=1')
  return false
}

export function initializeThirdPartyPixels() {
  if (isOptedOut()) return
  loadFacebookPixel()
  loadGoogleAdsRemarketing()
}

Add to your privacy policy: "We honor the Global Privacy Control (GPC) signal. A GPC-enabled browser is automatically treated as an opt-out of sale or sharing." This disclosure is required by CPRA regulations.