Study recommends EU clarify how the GPC signal maps to GDPR

A new peer-reviewed study published in Computer Law & Security Review examines the Global Privacy Control (GPC) standard as a solution for cookie consent fatigue in the EU. Authored by a coalition of international researchers, the paper concludes that while GPC can reduce the prevalence of deceptive consent banners, its effectiveness depends on EU regulators clarifying how the technical signal aligns with existing data protection laws.

The GPC signal, currently being standardised by the W3C, allows users to broadcast an automated opt-out request through their browser. This single-bit design minimises fingerprinting risks while expressing a preference against data selling and cross-context ad targeting. GPC has been legally binding in California since 2021.

The European Commission's Digital Omnibus package for data proposes making such machine-readable signals enforceable under a new Article 88b of the EU General Data Protection Regulation (GDPR). While the study identifies a challenge with the terminology used by GPC in the US, which does not neatly map to GDPR concepts, the authors recommend that EU lawmakers explicitly recognise GPC and provide interpretive guidance so that websites can utilise the standard. They describe GPC as an infrastructure ready for regulators to use to improve data protection and reduce user burden.

Training Announcement: The IAPP Certified Information Privacy Technologist (CIPT) is a privacy-focused professional IT certificate from the IAPP that addresses data protection requirements and controls within complex technological environments. It explores the data lifecycle, privacy risk models and frameworks, the principles of Privacy by Design, and the role of privacy-enhancing technologies within the organisation. Find out more.