Global Privacy Control (GPC) is a browser-level privacy signal that lets visitors broadcast a "do not sell or share my personal information" preference to every website they visit. Zenovay honors GPC automatically, with no configuration on your side, and there is no attribute or setting that turns it off.
What GPC is
GPC is supported by Brave, Firefox, DuckDuckGo, and a growing list of privacy-focused browsers and extensions. When a visitor turns it on, every HTTP request from that browser carries the header:
Sec-GPC: 1
and the page can read the same preference in JavaScript as navigator.globalPrivacyControl === true.
Under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), Sec-GPC: 1 is recognized as a valid opt-out signal. Many EU regulators treat it as a clear expression of intent to refuse non-essential processing.
How Zenovay honors GPC
There are two layers, and the first one does almost all of the work.
In the browser. The tracking script reads navigator.globalPrivacyControl before it does anything else. If the value is true, the script switches tracking off and stops initializing. Nothing that comes later runs: no pageview, no settings fetch, no custom events, no session replay, no heatmaps, no screenshots, no error tracking, no frustration detection, no Core Web Vitals, no queued retries. A GPC visitor on a site using the Zenovay script sends nothing at all, so there is no visitor row, no session, and no pageview to suppress downstream.
This check is not affected by data-ignore-dnt. GPC cannot be overridden from the script tag or from your website settings.
On the server. Requests can still reach the ingestion API without going through the browser tracker, for example from your own backend through the server-side events API or from a direct HTTP call. For those, Zenovay checks the Sec-GPC header and suppresses behavioural processing for the request:
- Server-side custom events are rejected at the ingest endpoint with a
gpc_opted_outreason. - B2B company identification is skipped, so the address behind the visit is not enriched with company data.
- Demographic and language inference is skipped.
- Milestone behavioural events are not generated.
- Live-cursor ingest and popup-widget impressions are dropped.
- The visitor record is flagged
gpc_opted_out, so the suppression travels with the row and is auditable.
A visit that arrives this way is still recorded: the visitor and session identifiers, the hashed IP, and the geolocation, device, and campaign fields are stored, and value scoring still runs on it. The server-side layer is a suppression of enrichment and profiling, not a guarantee of invisibility, which is why the browser-side stop matters more in practice.
GPC is also a stronger signal than a stored consent choice. A Sec-GPC: 1 request is treated as an opt-out even if a cookie from a previous session says "accept all".
What this means for your visitors
A visitor with GPC enabled who lands on a Zenovay-tracked site loading the normal script:
- Sends no tracking requests at all, so they do not appear in your pageviews, sessions, events, recordings, or heatmaps
- Has nothing written to their browser by Zenovay
If a visit for that person reaches Zenovay some other way, for example because your backend sends a server-side event carrying their GPC header, then the request is rejected, and any visit recorded outside that path is flagged as a GPC opt-out and is not enriched with company data or demographic signals.
This applies whether or not your site shows a consent banner.
What you need to do as a site owner
Nothing. GPC honoring is on by default for every Zenovay-tracked website. There is no toggle to flip and no setting to configure, and no way to switch it off.
If you build your own consent layer on top of Zenovay (for example using data-cookieless="true" or a custom CMP integration), GPC still wins. Even if a visitor's stored cookie says "accept all", the script still stops for a GPC browser.
How to verify it's working
- Install a GPC-enabled browser (Brave is the easiest) or enable GPC in Firefox via
about:config→privacy.globalprivacycontrol.enabled→true. - Open a private/incognito window and visit a page on a site you own that has the Zenovay tracker installed.
- Open your browser's DevTools console and confirm
navigator.globalPrivacyControlreturnstrue. - Open the network panel and filter for
api.zenovay.com(or your first-party subdomain). You should see the script file load and then no tracking requests at all. That absence is the signal working.
You can confirm the same thing from the other side: the visit does not show up in Live View, and Zenovay sets no cookie or storage entry in the visitor's browser.
How GPC interacts with the rest of your privacy stack
| Surface | Behaviour |
|---|---|
| Browser tracking script | Stops before it sends anything, so a GPC visitor produces no pageview, event, recording, or heatmap data |
data-ignore-dnt="true" | Has no effect on GPC. It applies to Do Not Track only |
| Cookie consent banner | GPC wins. A GPC browser is opted out even if a stored cookie says "accept all" |
Cookieless mode (data-cookieless="true") | Independent setting. GPC still stops the script either way |
| Server-side events API | Events sent with a Sec-GPC: 1 header are rejected at the ingest endpoint |
| B2B company identification | Skipped for a GPC request that reaches the server |
| Demographic signals | Language, locale, and timezone are not inferred or stored for a GPC request |
Audit trail
GPC-driven decisions are recorded so you can evidence your honoring behaviour. Where a request does reach the server, the visitor record carries the gpc_opted_out flag, and the consent provenance log notes a gpc_opt_out collection basis for that visit.
Your analytics tables hold a hashed identifier derived from the IP rather than the address itself. See IP Address Handling for what that hash is, and for the bounded places a raw address does exist.
What GPC does not do
- It is not the same as Do Not Track (
DNT). Zenovay does act on DNT: the tracking script stops fornavigator.doNotTrack === "1"in the same way it stops for GPC. The difference is that DNT can be switched off withdata-ignore-dnt="true", and that the first-party proxy sets that override automatically, while GPC cannot be overridden at all. See Cookieless Tracking Mode for the details. - It does not reach visits that never run the browser script. A request sent from your own backend is checked for the
Sec-GPCheader and has its enrichment suppressed, but a visitor row is still written for it. - It does not replace your obligation to publish a privacy policy describing what you collect.