Gpc Cookie Integration

Sec-GPC: 1

navigator.globalPrivacyControl  // Returns true if GPC is enabled

Page Load
    │
    ├── Check for GPC signal
    │   ├── navigator.globalPrivacyControl === true
    │   │   OR
    │   └── Server detects Sec-GPC: 1 header
    │
    ├── Determine user jurisdiction
    │   ├── IP geolocation → US state mapping
    │   └── Check if state has GPC legal requirement
    │
    ├── If GPC detected AND applicable jurisdiction:
    │   ├── Automatically set consent state:
    │   │   ├── ad_storage: denied
    │   │   ├── ad_user_data: denied
    │   │   ├── ad_personalization: denied
    │   │   ├── analytics_storage: [per CMP default — GPC does not cover]
    │   │   └── sale_of_data: opted_out
    │   │
    │   ├── Block advertising cookies and tags
    │   ├── Do NOT fire: Meta Pixel, Google Ads remarketing, third-party ad tags
    │   ├── DO fire: GA4 (if analytics consent separate from GPC)
    │   │
    │   ├── Display modified banner (optional):
    │   │   "We detected your Global Privacy Control preference.
    │   │    We will not sell or share your personal information.
    │   │    [Manage Other Preferences]"
    │   │
    │   └── Record GPC opt-out in consent log
    │
    └── If GPC detected but NON-applicable jurisdiction (e.g., EU):
        └── Treat as privacy signal but apply jurisdiction's own rules
            (EU still requires opt-in consent regardless of GPC)

function detectGPC(req, res, next) {
  const gpcHeader = req.headers['sec-gpc'];
  const gpcEnabled = gpcHeader === '1';

  req.gpcSignal = gpcEnabled;

  if (gpcEnabled) {
    // Determine jurisdiction from IP
    const userState = geolocateToState(req.ip);

    // States where GPC is legally binding
    const gpcMandatoryStates = ['CA', 'CO', 'CT', 'MT', 'TX', 'OR', 'DE', 'NH', 'NJ'];

    req.gpcLegallyBinding = gpcMandatoryStates.includes(userState);
    req.gpcOptOut = {
      sale: gpcEnabled && req.gpcLegallyBinding,
      sharing: gpcEnabled && req.gpcLegallyBinding,
      targetedAdvertising: gpcEnabled && req.gpcLegallyBinding,
    };
  }

  next();
}

function handleGPCSignal() {
  const gpcEnabled = navigator.globalPrivacyControl === true;

  if (!gpcEnabled) return;

  // Get user's jurisdiction (from server or geolocation)
  const userJurisdiction = getUserJurisdiction();
  const gpcBindingStates = ['CA', 'CO', 'CT', 'MT', 'TX', 'OR', 'DE', 'NH', 'NJ'];

  if (gpcBindingStates.includes(userJurisdiction)) {
    // Update Google Consent Mode
    gtag('consent', 'update', {
      'ad_storage': 'denied',
      'ad_user_data': 'denied',
      'ad_personalization': 'denied',
      // analytics_storage not affected by GPC
    });

    // Update CMP state
    updateCMPState({
      sale_optout: true,
      sharing_optout: true,
      targeted_advertising_optout: true,
      source: 'gpc_signal',
    });

    // Remove any existing advertising cookies
    removeAdvertisingCookies();

    // Log GPC opt-out
    logConsentEvent({
      type: 'gpc_auto_optout',
      jurisdiction: userJurisdiction,
      timestamp: new Date().toISOString(),
      gpc_header_present: true,
    });
  }
}

function removeAdvertisingCookies() {
  const adCookies = ['_fbp', '_fbc', '_gcl_au', 'IDE', 'fr', 'NID'];
  adCookies.forEach(name => {
    document.cookie = `${name}=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/; domain=.pinnacle-ecommerce.com`;
  });
}

// Run on page load
handleGPCSignal();