The method
Two Chromium visits, no clicks, ten seconds recorded after each load. The first is a plain visit. The second sends Global Privacy Control. Every third party that answered the second visit is a row in red.
What Global Privacy Control is
Global Privacy Control (GPC) is a browser setting. With it on, the browser adds the header Sec-GPC: 1 to every request it sends and sets navigator.globalPrivacyControl to true for every page script. It means one thing: do not sell or share my personal information. Twelve states require a business to treat it as that request; California calls it an opt-out preference signal and Colorado a universal opt-out mechanism. The twelve-state table cites each statute from the state's own site.
What the two passes do
- Both passes run in headless Chromium on one Vercel server in San Francisco (region
sfo1), identify as desktop Chrome of the same version, and use a fresh profile each: no cookies, no storage, no history. - Pass A visits your page with nothing added.
- Pass B sends
Sec-GPC: 1on every request, to your servers and to every third party, and definesnavigator.globalPrivacyControlas true before any of your page's scripts run. - Each pass waits for the load event (up to 15 s), then records for 10 s: every host the browser sent a request to, every cookie a third party set through a
Set-Cookieheader, the names readable throughdocument.cookie, and thelocalStoragekeys. - A third party is any host whose registrable domain differs from your page's own:
www.google-analytics.comonshop.example.comis one;cdn.example.comis not. - The finding is the list of third-party hosts that fired in pass B. A host that fired in pass A and went quiet in pass B is listed too, with an empty pass-B column: the signal was honoured for it.
What they do not do
- Neither pass clicks anything. The consent banner stays unanswered and every menu stays shut. A tracker that waits for a scroll, a click or an answer to the banner appears in neither column.
- Both passes come from one place, US-West. A consent platform that keys on geolocation may show your visitors in Texas, New Jersey or Maryland something else. The receipt prints this in its header, in the same type as the finding, because a limit that counsel finds later would discredit every row.
- A first-party subdomain that forwards to an ad platform (a CNAME-cloaked tracker, such as
metrics.yourstore.compointing at an analytics vendor) counts as first party here and is not listed. - The browser reaches public addresses only. A page or redirect that points it at a private or loopback address is refused, and the receipt says so.
A finding is not a verdict
A host that fired with GPC on is a fact about one visit. Whether that request is a sale or a share of personal information, under which of the twelve statutes, is a question about your contracts and your data, and it is for your counsel. The paid receipt lists, beside each host that fired in pass B, the states whose signal duty would reach it if it is a sale or a share. It never says a site is compliant or not, and never says a law was broken.
The classification beside each host (Google, advertising; OneTrust, consent platform) comes from EasyPrivacy, a public list of tracking servers kept by the EasyList authors, and from a short map of the largest companies' domains that we wrote. A host on neither list is still listed, marked "not on our lists".
We sell no consent platform
Signal Honored sells no consent platform, no banner and no remediation, so the receipt can name the one on your site. When your consent manager's own script loaded and seven advertising hosts still fired with the signal on, the receipt prints both, in the same ledger. A company that sells a consent platform cannot publish that row about its own product.
Settlements over opt-outs
-
.75 million
The Walt Disney Company
, California Attorney General
Opt-outs sent through Global Privacy Control were applied only to the device that sent them, even for a consumer logged into an account.
-
.55 million
Healthline Media
, California Attorney General
Data kept going to some advertising third parties after readers opted out. The release says requests sent through Global Privacy Control must be honoured.
-
.35 million
Tractor Supply Company
, California Privacy Protection Agency
No effective way to opt out of selling and sharing, including through opt-out preference signals such as Global Privacy Control.
-
$632,500
American Honda Motor Co.
, California Privacy Protection Agency
Opt-outs of sale and sharing demanded verification and excess personal information. The release does not mention Global Privacy Control.
-
Letters
Joint sweep: California, Colorado, Connecticut
, Three attorneys general and the California Privacy Protection Agency
Letters to businesses that did not appear to process opt-out requests sent through Global Privacy Control, asking for immediate compliance.
The receipt
Every run produces a receipt: both passes in full, the ledger, the disclosure findings, the time, the server's region and the browser's version. Its name is the SHA-256 hash of its own contents, so changing one character of it breaks the match, and anyone can check it in their own browser. A paid receipt is also signed with a key held on our server; the same page asks the server whether the signature is ours.
The free run covers your home page: the count, the host list and the disclosure findings. The $249 receipt adds two inner pages you choose (a product page and the cart, say), maps each host that fired with GPC on to the statutes, and signs the result.