The Sec-GPC Header Is Now Everywhere: Server-Side Detection for Analytics
Global Privacy Control ships as the Sec-GPC request header on every request. Here is how to read it at the edge and honour it in a cookieless analytics pipeline.
Global Privacy Control (GPC) is often discussed as a legal signal, but for engineers it is first and foremost an HTTP header. Every request from a GPC-enabled browser or extension carries Sec-GPC: 1, and the same preference is exposed to client JavaScript as navigator.globalPrivacyControl. If you run analytics at the edge, the header is the cleaner integration point — you can act on it before any measurement logic runs, without shipping a byte of tracking code.
What the signal actually looks like
The GPC specification defines a request header field, Sec-GPC, whose only meaningful value is 1, indicating the user does not consent to the sale or sharing of their personal data. The absence of the header means no preference has been expressed — it is explicitly not the same as a positive 0. The spec also defines a well-known resource at /.well-known/gpc.json that a site publishes to declare it honours the signal.
Because Sec-GPC uses the Sec- prefix, it is a forbidden header name: it cannot be set or overridden by fetch() or XMLHttpRequest, which makes it harder to spoof from page scripts than a custom header would be. It is sent on navigations and subresource requests alike, so an edge worker sees it on the very first hit.
Reading it at the Cloudflare edge
On a Cloudflare Worker the check is a single line, and it runs before you decide whether to record anything:
export default {
async fetch(request) {
const gpc = request.headers.get('Sec-GPC') === '1';
// gpc === true -> user opted out of sale/share
// record only privacy-safe, aggregate signals accordingly
return handle(request, { gpc });
}
};
For Monoid this maps directly onto how the product already works. Monoid stores no cookies, no localStorage, and derives no fingerprint, so there is no cross-site profile to suppress in the first place. GPC is a legal opt-out of sale and sharing of personal data — behaviour that a privacy-first, cookieless design never engages in. Detecting Sec-GPC therefore becomes a defence-in-depth measure and an auditable record that the preference was observed, rather than a switch that changes what data leaves the browser.
Why this matters legally, briefly
GPC's enforceability is not theoretical. The California Attorney General's 2022 settlement with Sephora made clear that the CCPA requires businesses to treat GPC as a valid opt-out of sale, and the California Privacy Rights Act regulations require honouring opt-out preference signals. Colorado and other US state regimes have adopted comparable universal opt-out mechanism requirements. Reading the header server-side gives you a deterministic, logged point at which compliance happens — far more robust than relying on a tag manager to fire a rule.
Publishing the well-known resource
If you honour GPC, declare it. Serve /.well-known/gpc.json with a small document:
{ "gpc": true, "lastUpdate": "2026-07-19" }
This is a static file you can return from an edge route with Content-Type: application/json. It signals to browsers, extensions, and auditors that the preference is respected, and it costs nothing to maintain.
Practical guidance for analytics pipelines
- Check the header before measurement, not after. Acting at the edge means the decision is made before any downstream processing.
- Do not treat absence as consent. No
Sec-GPCheader simply means no preference; combine it with your existing lawful basis. - Keep a minimal audit trail. Logging that a request carried
Sec-GPC: 1— without attaching it to an identifier — demonstrates good faith without creating a profile. - Prefer the header over the JS API for gating. The
navigator.globalPrivacyControlproperty is useful for client UI, but the header lets you decide before code runs.
The broader lesson is that privacy signals are increasingly transport-layer facts, not application quirks. Sec-GPC sits alongside DNT (deprecated), the Permissions-Policy header, and Referrer-Policy as things an analytics system should read rather than ignore. For a cookieless product the change is small precisely because the architecture already minimises data — which is the point of building this way in the first place.
Comments
Loading comments…