The opt-out that only stopped half of the tracking.

What the law asks, and why it lands on the server

Twelve US states now require two things of a site. It must honour Sec-GPC: 1, the Global Privacy Control signal a browser sends when the user has turned it on. It must also offer a working "Do Not Sell or Share My Personal Information" link for everyone else. Send a conversion event with a hashed email to an ad platform and you are sharing for targeted advertising. That is what both laws let people refuse. The pixel is the part everyone remembers. The Conversions API call is the part that carries the personal data.

What breaks

The usual implementation is a button on the privacy page that sets a cookie and a pixel loader that reads the cookie and does not load. That is all of it. It passes every check a person makes by opening the page and watching the network tab: no pixel, no requests to Meta. Meanwhile the confirm endpoint, which runs on the server and never looks at the page, hashes the phone and email and sends the booking event (Schedule) to Meta as it always has. The opt-out stops the half that carries no personal data and lets through the half that does. The person who asked not to be shared is shared, on the one action that carried their details.

The rule

• Two signals, both read on the server, on every send. The Sec-GPC header and the opt-out cookie. Most browsers send no GPC signal at all. For most people the cookie is the only opt-out. It has to reach the server call, not just the script tag.
• Make the opt-out a property of the person, not of one request. Someone books with GPC on. Later they tap a link from an email, on a phone that sends no signal. They must still stay out of every send. Record it once on their row and check the row inside every sender, as well as the request.
• Record which signal asked. "They opted out" and "they opted out with Global Privacy Control on 3 September" answer different questions. Only the second survives a question a year later.
• Trust the client in this one direction. The only thing a browser achieves by claiming either signal is suppressing its own tracking. There is no reason to verify it.

How to check it yourself

Turn on Global Privacy Control in the browser and book through your own flow. Then look in Events Manager for the server event. If it is there, your opt-out stops the pixel and nothing else. The network tab cannot show you this; the server call never passes through the browser.

What this does not cover

• Whether a hashed email is personal data under a given state's statute. This note assumes the strict reading, because the alternative is arguing with a regulator about hashing.
• Google. Its consent mode has its own signals, and a server-side offline import needs the same gate.