Privacy signals (GPC and DNT)

Browsers and extensions can broadcast a visitor's privacy choice before any banner interaction. CookieBeam detects two signals and can apply them to the visitor's stored consent state automatically.

What the signals do

When a respected signal is present for a visitor in an opt-out region, CookieBeam removes the signal-covered categories from the pre-activated defaults before writing the visitor's initial record. Concretely:

• The stored record contains only the categories that survive the strip — readOnly (necessary) categories are never removed, even if misconfigured into the block list.
• The record is stamped gpcRespected: true (when GPC applied), so the audit trail shows the choice came from the signal.
• Because the strip happens before any tags fire, the blocked categories never execute for that visitor.

Which categories a signal covers is configurable per rule or globally (categoriesToBlock); with no list configured, a respected signal strips every non-readOnly category.

Global Privacy Control (GPC)

GPC is read from navigator.globalPrivacyControl. Honoring is on when either:

• you enable it (globally via the privacy-signals settings, or via the gpc configuration key — an explicit gpc key wins over the general setting), or
• the visitor matches a US opt-out regional rule (the CCPA or US opt-out framework presets, or any rule whose privacy-signal mode is hard_optout).

The second case is a hard floor: for visitors under US opt-out regimes, GPC honoring cannot be switched off by banner settings. Everywhere else the toggle is advisory and yours to set.

Signal modes

Each regional rule (or the global default) picks how a respected signal presents:

• hard_optout — the signal is the visitor's choice. The banner does not auto-show (the visitor has nothing left to opt out of), and an optional toast acknowledges "Your Global Privacy Control preference has been respected." The banner stays reachable through the floating settings button and the JavaScript API. The toast only renders when the governing record is the machine-written, signal-shaped default — never over a visitor's earlier explicit choice.
• preselect_deny — the banner still auto-shows, with the signal-covered categories pre-set to denied so the visitor can confirm or adjust.

Do Not Track (DNT)

DNT is a deprecated signal and is off by default. If you enable it, a DNT visitor gets the same category stripping and the same mode semantics as GPC — but not the same audit stamp. The gpcRespected record marker is GPC-specific: a record shaped only by DNT has no marker on the stored record showing a signal shaped it. If your audit process needs to distinguish signal-shaped records, only GPC provides that today. Most sites should leave DNT off and rely on GPC.

Where to configure signals

Privacy-signal settings live on the banner's Integrations page. Use the Privacy Signals card and its Enable Privacy Signals integration control. Per-rule signal behavior (mode and covered categories) is set on each regional rule (see Regional rules). Changes take effect on the next publish.

Detection discipline

Signal detection is deliberately strict: if the browser environment can't be read, CookieBeam assumes no signal rather than opting everyone out. The signal only shapes the machine-written default record; a visitor's later explicit choice in the banner or preferences panel replaces it.