Are GPC Signals Anti-Competitive?

I’m Alan Chapell. Over the past 20+ years, I’ve been outside privacy counsel to hundreds of digital media companies and write a monthly syndicated report called The Chapell Regulatory Insider. I’m also a regulatory analyst for The Monopoly Report. A warm thank you to everyone who came out to London last week to see my morning keynote at Prebid Ascent. 

The latest Monopoly Report podcast is out! This week, I welcome Mark Naples of WIT Strategy. We discuss how ad tech self-regulation really works—and what it misses. Check out the podcast here.

GPC is anti-competitive and also the future of the ads space.

That’s admittedly a strong statement. Before I even attempt to back it up, you might be wondering: What in the world is the Global Privacy Control (GPC)?

The GPC is an opt-out choice tool that enables a user to indicate that they don’t want to be tracked, targeted, or profiled. Several state privacy laws require that those of us operating in the ads space respect these signals as valid opt-out requests. In some states, including California, GPC signals also stop the sale and share of data as well as any automated decision-making tech. So that when we see the GPC signal in an adtech data flow, we need to treat the applicable user as having opted out of all of these aforementioned activities.

Yep. GPC is a powerful tool, but one that hasn’t gotten enough attention to date. Why? Well, mostly because we just don’t see too many GPC signals out there in the wild as of today.

GPC is hard to find due to lack of support from browsers.

For better or worse, the major browsers don’t currently support the GPC signal. So as of today, the only way you might see these GPC signals is if you happen to encounter a user who has downloaded a special Chrome plugin or uses a browser that does support GPC, such as DuckDuckGo, Brave, or Firefox.

Today, you’d be hard pressed to find someone using Chrome or Safari or Edge with the GPC signal enacted.

But all that is changing starting in January 2027, thanks to the California Opt-Me Out Act. And once browsers are required to provide GPC functionality to users, it’s not exactly a stretch to see California or some other state push mobile or CTV O/S providers to offer the same type of opt-out functionality.

In other words, GPC is the future of privacy in the ads space.

Is GPC friend or foe to the ads space?

If I’m being honest, the above question is a bit beside the point. We need to honor these signals as per any number of U.S. state privacy laws (not that I’m providing legal advice here).

Personally, I think the GPC signal helps address some of the biggest problems in the ads privacy space. For example:

• Cookie-based opt-outs are broken: Cookies don’t persist, they are clunky, and I’m kind of amazed that nobody in the ads space has been hit with an unfair or deceptive regulatory claim in connection with their use.

• Hashed email opt-outs have their own tradeoffs and challenges: For one thing, being in possession of hashed email addresses (and phone numbers) creates operational challenges in connection with consumer DSAR requests.

• Privacy controls in mobile and CTV worlds aren’t much better: I’ve been pretty vocal that the privacy controls in mobile are pretty crappy these days due in part to the fallout from Apple ATT. And the CTV space has its own endemic issues with privacy choices. As noted above, California law will require browsers to support GPC starting in January 2027. There is at least a chance that the mobile and CTV O/S could face similar requirements. And having those in place would help the ads space address one of the more glaring structural privacy issues.

But if you sense a big “however” coming, you are correct.

Why is GPC potentially anti-competitive?

Everyone’s gotta eat, including people who work at the browsers. There’s nothing wrong with that. But nobody in this space should get to quash someone else’s business in order to prop up their own. It’s probably worth noting that Mozilla has a long history of keeping privacy signals off by default. But we can’t count on other browsers to follow Mozilla’s lead.

My fear is that GPC will be used by browsers in the same way as do-not-track (DNT) was intended to be used — to favor one type of business over another under the guise of privacy. There’s a real risk that browsers could use GPC as a privacy cudgel and/or turn GPC on by default in order to stand-up the browsers’ own ad businesses.

If you think the above scenario is speculative or unlikely, I’d respectfully suggest that you haven’t paid attention to the ads space over the past several years.

In any event, check out the state of play in the browser world right now:

• Advertising is a critical monetization path for most browsers.

• Most major browsers are owned by Big Tech companies that have their own interests, and many of them are working collectively in groups such as the W3C in an attempt to exert even more control over the ads space.

• Many browser companies view their browser as less a user agent and more a piece of software they (and only they) get to monetize.

• Some browsers routinely engage in IP warfare (if not theft) by blocking or erasing publisher-controlled ads and replacing them with their own ads.

If you sat in on my fireside chat with FTC Commissioner Meador at Marketecture Live, you might recall that the Commissioner also flagged a concern when privacy becomes a pretext to lock up the browser market or access to critical data.

Other states have recognized the potential impact.

And it’s not just the FTC that recognizes the potential anti-competitive impact. Other states have already crafted anti-preferencing measures in their privacy laws. Two examples:

• Colorado: The Colorado AG’s office has crafted a set of regulations in connection to what it considers a valid opt-out request. Those regulations state that “Universal Opt-Out Mechanism may not be the default setting for a tool that comes pre-installed with a device, such as a browser or operating system.”

• Connecticut: Connecticut’s privacy law also doesn’t allow GPC or other online preference signals to be turned on by default. But it goes even further and states that these signals can’t unfairly disadvantage another controller. (PS: Let’s go Huskies!)

To be clear, GPC signals aren’t anti-competitive in Connecticut or Colorado, as the regulators there have put guardrails into place. What say you, California?

Privacy advocates love GPC.

Some privacy advocates have historically taken the position that anything that reduces “tracking” is a net positive, regardless of any downstream consequences. I believe that position to be short-sighted in that it creates incentives for the creation a cartel of large companies that collect data at the expense of smaller companies. I attempted to make this point in a recent TMR podcast discussion I had with Alan Butler of the advocacy group EPIC in connection with Apple ATT.

While I can understand this type of sentiment coming from privacy advocates, I don’t think that mindset is at all productive in connection with operating a regulatory agency - particularly an agency that came into existence promising to contain Big Tech.

I’m hopeful that CalPrivacy will view anti-preferencing and default setting measures as a part of its mandate to reign in Big Tech. But I also think we need more voices in this choir if we’re going to ensure that this message is truly heard.

Here’s my ask.

CalPrivacy is seeking public comment as it looks to create “new regulations that reduce friction in the exercise of privacy rights, or comment on how consumers use opt-out preference signals and how businesses process opt-out preference signals [like GPC]”.

Have your voice heard. Provide comments to CalPrivacy.

Or live with the consequences of doing nothing.

____________________________________________________________________________

If there’s an area that you want to see covered on these pages, if you agree or disagree with something I’ve written, if you want to tell me you dig my music, or if you just want to yell at me, please reach out to me on LinkedIn or in the comments below.

Miami, get ready. We’re bringing the heat.

For the third straight year, Marketecture Media is heading back to POSSIBLE, and we’re showing up bigger, louder, and more dialed in than ever.

We’re coming to capture the moments that matter by filming powerful conversations and creating the kind of content that keeps the industry talking long after the Miami sun sets. 

This year we’re recording high-impact interviews on site, hosting curated gatherings with the right people in the room, and yes, the AdTechGod event is back!

If you want to plug into the energy and partner with us at POSSIBLE, drop your info in the form in the comments.