Treat the privacy signal as a no

How to do it

Read the Sec-GPC: 1 header and navigator.globalPrivacyControl. Treat either as an opt-out of sale and sharing. Several US states, including California and Colorado, require this by law. Publish /.well-known/gpc.json to say you honour it.

Example

GET /.well-known/gpc.json HTTP/1.1
Host: example.com
Sec-GPC: 1

HTTP/1.1 200 OK
Content-Type: application/json

{ "gpc": true, "lastUpdate": "2026-01-15" }

if (navigator.globalPrivacyControl) {
  // Visitor opted out: load no sharing or ad scripts
}

How to check

Load the site with GPC turned on. No requests go to advertising or sharing partners, and /.well-known/gpc.json answers with "gpc": true.