Implements Global Privacy Control (GPC) universal opt-out for US state privacy laws: state requirements, JS/browser detection, Node.js/Express header handling.
npx claudepluginhub mukul975/privacy-data-protection-skills --plugin us-state-privacy-skillsThis skill uses the workspace's default tool permissions.
A universal opt-out mechanism is a browser or device-level signal that communicates a consumer's privacy preferences to websites and online services. The Global Privacy Control (GPC) is the leading universal opt-out mechanism, supported by major browsers (Firefox, Brave, DuckDuckGo) and browser extensions (Privacy Badger, Disconnect). Multiple US state privacy laws now require businesses to rec...
Generates design tokens/docs from CSS/Tailwind/styled-components codebases, audits visual consistency across 10 dimensions, detects AI slop in UI.
Records polished WebM UI demo videos of web apps using Playwright with cursor overlay, natural pacing, and three-phase scripting. Activates for demo, walkthrough, screen recording, or tutorial requests.
Delivers idiomatic Kotlin patterns for null safety, immutability, sealed classes, coroutines, Flows, extensions, DSL builders, and Gradle DSL. Use when writing, reviewing, refactoring, or designing Kotlin code.
A universal opt-out mechanism is a browser or device-level signal that communicates a consumer's privacy preferences to websites and online services. The Global Privacy Control (GPC) is the leading universal opt-out mechanism, supported by major browsers (Firefox, Brave, DuckDuckGo) and browser extensions (Privacy Badger, Disconnect). Multiple US state privacy laws now require businesses to recognize and honor these signals.
GPC is defined in the Global Privacy Control specification (published by the GPC project), transmitted via the Sec-GPC: 1 HTTP header and the navigator.globalPrivacyControl JavaScript API.
| State | Law | Signal Required | Effective Date | Scope |
|---|---|---|---|---|
| California | CCPA/CPRA | Yes | Jan 1, 2023 | Sale + Sharing |
| Colorado | CPA | Yes | Jul 1, 2024 | Targeted ads + Sale |
| Connecticut | CTDPA | Yes | Jan 1, 2025 | Targeted ads + Sale |
| Montana | MTDPA | Yes | Oct 1, 2025 | Targeted ads + Sale |
| Texas | TDPSA | Not required | N/A | N/A |
| Virginia | VCDPA | Not required | N/A | N/A |
| Oregon | OCPA | Not required | N/A | N/A |
| Kentucky | KPPA | Not required | N/A | N/A |
Sec-GPC: 1
The Sec-GPC header is a structured header with a bare item value of 1 (true) or absent (no preference expressed). The Sec- prefix indicates it is a fetch metadata header set by the browser, not by JavaScript.
navigator.globalPrivacyControl // boolean: true or undefined
The navigator.globalPrivacyControl property returns true if the user has enabled GPC in their browser or extension, or undefined if GPC is not active.
function detectGPC() {
// Check JavaScript API
const jsGPC = navigator.globalPrivacyControl === true;
// The HTTP header is checked server-side
// This function covers client-side detection only
return {
gpcEnabled: jsGPC,
timestamp: new Date().toISOString(),
userAgent: navigator.userAgent,
};
}
function checkGPCHeader(req) {
const gpcHeader = req.headers['sec-gpc'];
return gpcHeader === '1';
}
app.use((req, res, next) => {
if (checkGPCHeader(req)) {
req.gpcOptOut = true;
// Apply opt-out before rendering page
res.locals.suppressThirdPartyTags = true;
res.locals.suppressCrossSiteBehavioralAds = true;
}
next();
});
HTTP Request Arrives
│
├─► Server-Side Check
│ └─ Parse Sec-GPC header from request
│
├─► Client-Side Check (for SPAs)
│ └─ Read navigator.globalPrivacyControl
│
└─► Combined Result
├─ GPC detected = true → Apply opt-out
└─ GPC not detected → Normal processing
| State | Sale Opt-Out | Sharing Opt-Out | Targeted Ads Opt-Out | Profiling Opt-Out |
|---|---|---|---|---|
| California | Yes | Yes | Implied (sharing = cross-context behavioral ads) | No (separate) |
| Colorado | Yes | N/A | Yes | No (separate) |
| Connecticut | Yes | N/A | Yes | No (separate) |
| Montana | Yes | N/A | Yes | No (separate) |
Authenticated Consumer (logged in):
sale_opt_out = true, targeted_ads_opt_out = trueUnauthenticated Consumer (not logged in):
Upon detecting GPC signal, the system must:
Suppress third-party advertising tags before page render:
Allow first-party processing:
Update server-side systems:
Sec-GPC: 1 header detectednavigator.globalPrivacyControl === trueTechnology stack: Consent management platform (CMP) with GPC signal handler, tag management system (TMS) with server-side control, privacy operations dashboard.
Architecture:
Sec-GPC: 1 header on incoming requestsgpc_opt_out: true flag