| Both sides previous revisionPrevious revision | |
| privacy:data_subject_rights [2026/09/16 11:19] – Generic review: correct the Kempen Table 1 description (13 rows, 55-100%, three of them in this population), samarin asked 109 not 160, DNT/GPP alive-or-dead contradictions, five arithmetic slips, and deliver the data-donation use case the lede promises. karel.kubicek.claude | privacy:data_subject_rights [2026/09/16 11:20] (current) – State the GPC boundary with Privacy:Consent on this side too, and prefer the browser preference over header injection. Authored by Claude karel.kubicek.claude |
|---|
| **This is about to change by statute, and it will change what a crawl can do.** California AB 566 was approved by the Governor on 8 October 2025 as Chapter 465 and adds §1798.136 to the Civil Code: //"beginning January 1, 2027"//, it prohibits a business //"from developing or maintaining a browser, as defined, that does not include functionality configurable by a consumer that enables the browser to send an opt-out preference signal, as defined, to businesses with which the consumer interacts through the browser"//.((California AB 566 (Lowenthal), //California Consumer Privacy Act of 2018: opt-out preference signal//, Chapter 465, approved by the Governor 8 October 2025, adding Civil Code §1798.136. https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260AB566 , read 2026-09-16.)) Chrome has a ''chromestatus'' entry for GPC whose stated motivation is precisely that bill — //"This year California signed a bill under the CCPA/CPRA that obligates the browsers to provide ability to communicate do-not-sell-or-share preference before 2027"// — but it is at stage **Proposed**, was last touched on 2026-01-02, has no milestone attached and was not filed by a Google address.((chromestatus.com feature 5137324344213504, //Global Privacy Control//; read through the chromestatus API on 2026-09-16. Read the ''stages'' array, not the summary ''status'' field: here they agree, and there is no origin-trial or ship milestone in either.)) **Nothing has shipped.** If you are planning a longitudinal crawl that spans 1 January 2027, pin and record the browser build, because the baseline for "does this browser send GPC" is a statutory deadline away from moving. | **This is about to change by statute, and it will change what a crawl can do.** California AB 566 was approved by the Governor on 8 October 2025 as Chapter 465 and adds §1798.136 to the Civil Code: //"beginning January 1, 2027"//, it prohibits a business //"from developing or maintaining a browser, as defined, that does not include functionality configurable by a consumer that enables the browser to send an opt-out preference signal, as defined, to businesses with which the consumer interacts through the browser"//.((California AB 566 (Lowenthal), //California Consumer Privacy Act of 2018: opt-out preference signal//, Chapter 465, approved by the Governor 8 October 2025, adding Civil Code §1798.136. https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260AB566 , read 2026-09-16.)) Chrome has a ''chromestatus'' entry for GPC whose stated motivation is precisely that bill — //"This year California signed a bill under the CCPA/CPRA that obligates the browsers to provide ability to communicate do-not-sell-or-share preference before 2027"// — but it is at stage **Proposed**, was last touched on 2026-01-02, has no milestone attached and was not filed by a Google address.((chromestatus.com feature 5137324344213504, //Global Privacy Control//; read through the chromestatus API on 2026-09-16. Read the ''stages'' array, not the summary ''status'' field: here they agree, and there is no origin-trial or ship milestone in either.)) **Nothing has shipped.** If you are planning a longitudinal crawl that spans 1 January 2027, pin and record the browser build, because the baseline for "does this browser send GPC" is a statutory deadline away from moving. |
| |
| Three consequences for [[Programming:Crawler|the crawler]]: | Three consequences for [[Programming:Crawler|the crawler]] — and note that **[[Privacy:Consent]] owns the mechanics** of making a browser send the signal, including the fact that Firefox removed its DNT checkbox in version 135 and points users at GPC instead. Prefer setting the browser's own preference over injecting the header; inject only when your browser has no preference to set. |
| | |
| |
| * **Chrome, and the plain Chromium your automation library bundles, cannot send GPC natively** — Brave is Chromium and does, which is the point: it is a browser-vendor choice, not a Chromium limitation. If your instrument is Puppeteer or Playwright over stock Chromium — which is most of [[Programming:Crawler|the field]] — you must inject ''Sec-GPC: 1'' yourself on every request, and separately define ''navigator.globalPrivacyControl'' in the page context, because a site may check either. Checking only the header under-detects sites that read the DOM property, and vice versa. | * **Chrome, and the plain Chromium your automation library bundles, cannot send GPC natively** — Brave is Chromium and does, which is the point: it is a browser-vendor choice, not a Chromium limitation. If your instrument is Puppeteer or Playwright over stock Chromium — which is most of [[Programming:Crawler|the field]] — you must inject ''Sec-GPC: 1'' yourself on every request, and separately define ''navigator.globalPrivacyControl'' in the page context, because a site may check either. Checking only the header under-detects sites that read the DOM property, and vice versa. |
