API-Layer GPC Decisions

If a regulator asked what happened to a GPC signal last Tuesday, could your team show it?

GPCGuard validates requests sent to your API endpoint, records structured decision evidence for processed GPC requests, and fails closed when validation cannot complete.

CategoryNot a CMP replacement. The evidence layer for GPC signal handling.

See a decision recordStart free
01GPC Signal Detected02Request Validated03Policy Applied04Decision Recorded✓ HONORED

Synthetic decision record — scroll down to inspect sample evidence

Source-tracked

Jurisdiction status table

Per-signal

Structured decision records

Fail-closed

Default endpoint posture

Decision Records

Structured evidence for each GPC request GPCGuard processes.

Each request processed by the GPCGuard endpoint can create a tenant-scoped decision record for the endpoint decision path. Drill into these synthetic rows to inspect the signal source, decision outcome, policy flags, and configured compliance label in a dashboard-like format.

GPCGuard provides the decision record. To complete enforcement, customers must wire HONORED decisions to tag managers, CMPs, CDPs, server-side events, and ad partners.

HONOREDSignal validated — policy applied, decision recorded for the processed request. Wire to your data stack to suppress downstream flows.
DENIEDValidation failed — fail-closed. Decision still recorded. Investigate configuration.
NO SIGNALRequest processed, but no GPC opt-out was observed. This is not an opt-out-honored event.
signal_idsignal_sourcedecision_outcomegpc_enabledpolicycompliance_standard
See synthetic sample evidence →

Click any row to inspect the full decision record — field-by-field.

These are synthetic examples with the same representative structure as a processed decision record.

Signal IDSignal
Example records

↑ Synthetic examples · representative decision-record structure

Interactive sample decision stream · verify-contract.com · Active Session

SAMPLE DATA
Signal ID
ce7a0a67…
DecisionACKNOWLEDGED
Reasongpc_opt_out_honored
SourceSec-GPC header
TimestampSample record
Signal ID
8c98f1df…
DecisionACKNOWLEDGED
Reasonno_gpc_signal_detected
Sourceno GPC signal
TimestampSample record
Signal ID
7356c7f4…
DecisionDENIED
Reasonrejected
SourceSec-GPC header
TimestampSample record
Signal ID
d6ab6b53…
DecisionDENIED
Reasonmissing_api_key
Sourcenavigator.globalPrivacyControl
TimestampSample record
Signal ID
89333831…
DecisionDENIED
Reasoninvalid_api_key
SourceSec-GPC header
TimestampSample record

Synthetic example — representative decision records, not customer traffic.

Same structure as your operator dashboard.

Architecture

Four steps. One clear decision path.

Requests processed by your GPCGuard endpoint pass through a deterministic guard chain, producing structured decision outcomes with explicit HONORED / DENIED states.

01 / 04

Detect

The generated embed or SDK sends a request to your GPCGuard endpoint, where the incoming signal is evaluated for that site.

02 / 04

Validate

Fail-closed guards verify site configuration, origin, active status, DPA acceptance, and circuit state before the request can continue.

03 / 04

Decide

The endpoint returns a structured policy decision — HONORED when the signal is valid and policy is applied, DENIED when a compliance-critical guard fails. Wire the HONORED outcome to your tag manager, CDP, and ad partners to suppress downstream data flows.

04 / 04

Record

Processed signal requests create structured decision records that operators can review in logs and dashboard evidence views.

Comparison

The enforcement layer below your CMP.

Many CMPs can detect or honor GPC, and some publish audit or reporting features. GPCGuard is designed for teams that need request-level API guard-chain records and downstream handoff evidence below or alongside their CMP.

How this fits with your CMP

CMP

Handles banners, preference collection, and opt-in flows at the UI layer.

GPCGuard

Validates GPC signals and records structured evidence at the API layer.

Together

Use both when you need proof of what happened to each GPC request.

Primary layer

Typical CMP
Banner / preference collection
GPCGuard
API decision path

Evidence granularity

Typical CMP
Often preference-level
GPCGuard
Request-level decision records

Downstream integration

Typical CMP
Product / stack dependent
GPCGuard
Explicit handoff required

Guard-chain decision evidence

Typical CMP
Varies by provider
GPCGuard
Core product surface

Fail-closed behavior

Typical CMP
Not typically applicable
GPCGuard
Default endpoint posture

GPCGuard is not a CMP replacement. It sits below your CMP to provide API-layer decision evidence. Wire HONORED decisions to your tag manager, CDP, and ad partners to suppress downstream data flows.

gpcguard · embed
<!-- GPCGuard embed — generated per site after DPA acceptance -->
<script
  src="https://<project-ref>.supabase.co/storage/v1/object/public/public/gpc-sdk.js"
  data-endpoint="https://<project-ref>.supabase.co/functions/v1/gpc-signal"
  data-domain="<your-domain>"
  data-show-notification="true"
  async>
</script>
Paste after the opening <body> tag on your target domain

Integration

Generated snippet first. Full enforcement depends on your stack.

GPCGuard onboarding mirrors the actual product surface: create a site, accept the DPA, retrieve the generated snippet, then verify endpoint decisions in the analytics and evidence views. Many teams can install the snippet quickly. Complete rollout includes verifying how HONORED decisions flow into your CMP, tag manager, CDP, server-side events, and ad partners.

01

Create a site, accept the DPA

The embed snippet is generated by the dashboard only after the Data Processing Agreement is accepted for the site.

02

Install the generated snippet

Copy the snippet from the site detail page and place it on your domain so supported browsers can call your configured GPCGuard endpoint. Your endpoint is tenant-isolated — signal data from your sites is never readable across tenants.

03

Verify signals inside the product

After installation, inspect decision records and analytics from the same operator flow that generated the snippet.

Compliance Coverage

Jurisdiction coverage, stated plainly.

GPCGuard tracks public universal opt-out and GPC sources separately from product-support status. Supported and beta entries describe the API-layer evidence workflow; they do not mean every customer, data flow, or downstream partner is automatically covered.

This table describes GPCGuard product-support status and public source tracking. It is not legal advice. Applicability depends on the customer's role, processing activities, consumer location, data flows, and legal counsel's interpretation.

California

CCPA / CPRA

Supported

Colorado

Colorado Privacy Act

Beta

Connecticut

Connecticut Data Privacy Act

Beta

New Jersey

New Jersey Data Privacy Act

Beta
+ 4 more tracked jurisdictions — explore full coverage →

Sample evidence pack

Synthetic JSON, CSV, and packet examples show the kind of records GPCGuard is designed to produce.

View samples →

Decision model

Public docs explain the ordered guard chain, API-layer boundary diagram, and common response contracts.

Read docs →

Security overview

The product publishes its current security posture without claiming certifications the infrastructure does not hold.

Review posture →

Architecture commitments

Non-negotiable boundaries — guard-order preservation and JWT + RLS tenant isolation — are documented publicly.

See commitments →
Product status: supported / beta / planned / legal review pending — see decision model for API-layer boundaries

Get Started

Your team should be able to show what happened to processed GPC requests.

Connect a site, install the embed, and see your first structured decision record — HONORED or DENIED, with guard-chain context. Free to start.

See a decision recordStart free →

No credit card required · See full pricing · Enterprise inquiry? Talk to us