Client-side Global Privacy Control (GPC)

Global Privacy Control (GPC) provides a global way to opt out of the sale or sharing of personal data at the browser level. For more information about GPC, see About Global Privacy Control.

The needs and requirements of our customers vary widely, so we intend to provide a flexible foundation for our customers to build upon.

This article describes Tealium’s client-side support for GPC. For information on server-side support, see Server-side Global Privacy Control

Client-side support

Since the GPC signal is a simple Boolean, CCPA and similar opt-out type regulations are the most relevant and accepted applications today (see About Global Privacy Control for more detail).

A strict interpretation might lead to a decision that Tealium iQ shouldn’t load at all if the GPC signal is set to true. If all the tags implemented in Tealium iQ sell or share data, this might be the right choice.

That can be implemented with a Pre Loader JavaScript extension:

if (navigator.globalPrivacyControl === true) {
    // Tealium iQ not loaded due to Global Privacy Control out-out signal
    window.utag_cfg_ovrd = window.utag_cfg_ovrd || {};
    window.utag_cfg_ovrd.noload = true;
}

Opt-out models (like CCPA/CPRA)

Starting with cmDoNotSell v1.1.0, the logical flow from the diagram below is implemented in the opt-out model.

That behavior is provided as a starting point, and the specific behavior should be discussed with your legal team and clearly explained to your users. That behavior can easily be changed or removed with a simple edit to the cmDoNotSell template.

Opt-in models (like GDPR)

The GPC signal is intended for opt-out models such as CCPA/CPRA and not opt-in models such as GDPR. Customers needs vary widely, and as such, our models are designed to be customized, and tailored GPC logic can be added as needed to support your needs and interpretations.