Skip to content
Universal Manifest

Global Privacy Control (GPC)

This page defines the Global Privacy Control (GPC) integration lane for Universal Manifest.

Boundary: normative vs non-normative

Section titled “Boundary: normative vs non-normative”
  • Normative contract: Specification and Conformance
  • Non-normative guidance: this page

What you implement

Section titled “What you implement”

Inputs

Section titled “Inputs”
  • Runtime GPC signal from Sec-GPC and/or navigator.globalPrivacyControl
  • Valid Universal Manifest with standard required fields and TTL
  • Optional pointer to /.well-known/gpc.json support resource

Outputs

Section titled “Outputs”
  • Deterministic active / inactive_or_not_sent / unknown decision state
  • Scope-limited policy behavior for sale/share/cross-context targeted advertising
  • Optional consent projection with provenance and timestamp

Minimum behaviors

Section titled “Minimum behaviors”
  • Runtime channel is authoritative for request-time decisions
  • Optional manifest projection is treated as descriptive evidence
  • Support resource is treated as support statement, not request-level proof
  • Unknown fields are ignored safely
  • GPC is not modeled facet-first

Suggested keys (non-normative)

Section titled “Suggested keys (non-normative)”

Suggested consent keys:

  • privacy.globalOptOut.gpc
  • privacy.globalOptOut.scope
  • privacy.globalOptOut.source
  • privacy.globalOptOut.observedAt

Suggested pointer name:

  • privacy.gpcSupportResource

Integration posture

Section titled “Integration posture”

Preferred model: hybrid.

  • Runtime GPC signals are authoritative.
  • Optional UM projection records evidence for portability/audit.
  • Any overlap with local permissive settings is handled with scope-limited supersession for GPC-covered decisions.

Next

Section titled “Next”