Purpose-conditional GPC signal: implementation experience

[fdezdaniel]

ProtoConsent is a Chromium extension (GPL-3.0+, in review at Chrome Web Store, Edge, and Opera) that sends Sec-GPC: 1 conditionally, based on per-purpose user preferences rather than as a global toggle.

The extension defines six data-processing purpose categories aligned with the Consent Commons taxonomy. Three of them trigger GPC when denied: ads, third-party sharing, and advanced tracking. Functional, analytics, and personalisation do not. If any triggering purpose is denied for a site, GPC is sent; if all are allowed, it is not. The decision is per-site.

Implementation uses declarativeNetRequest modifyHeaders for the Sec-GPC: 1 header and a MAIN-world content script for navigator.globalPrivacyControl, both per-site.

Happy to discuss the approach.

Architecture (§10 covers GPC integration): https://github.com/ProtoConsent/ProtoConsent/blob/main/design/architecture.md#10-global-privacy-control-gpc

Source: https://github.com/ProtoConsent/ProtoConsent

Consent Commons taxonomy: https://consentcommons.com/

[pachakkulamv-cell]

Nice work

[SebastianZimmeck]

That is an interesting idea. There is a lot of discussion right now in the context of the EU's Digital Omnibus, especially, the EU Commission's proposed GDPR Article 88b, where this approach could fit int.

[fdezdaniel]

That is an interesting idea. There is a lot of discussion right now in the context of the EU's Digital Omnibus, especially, the EU Commission's proposed GDPR Article 88b, where this approach could fit int.

Hi Sebastian,

The Digital Omnibus draft makes this even more relevant, especially the interaction between Articles 88a and 88b.

The text clearly separates what requires consent from what can be exempted. Article 88a(3)(c) allows strictly first-party audience measurement without consent, while commercial tracking and advertising sharing require it.

The main challenge around Art. 88b is automating choices without a total blackout that treats basic analytics and invasive tracking the same way. By handling purpose choices inside the extension, you don't need to change the GPC spec to handle complex EU rules: the complexity stays in the browser settings, not the network protocol. It respects the automated rejection in Art. 88b(1)(b) while still allowing the analytics exemptions of Art. 88a(3).

It's already live in Chrome, Edge, and Firefox so it can be tested directly.