That's why I don't understand GPC (https://globalprivacycontrol.org/). GPC setting is for opt-out, without GPC header it's treating like opt-in.

> Now you can exercise your legal privacy rights in one step via Global Privacy Control (GPC), required under the California Consumer Protection Act (CCPA) and Europe’s Global Data Protection Regulation (GDPR).

I don't think this is consistent with GDPR. GDPR require opt-out by default - no data can be sent without person consent.

> GDPR require opt-out by default

You probably meant to write either "optED-out by default" or "opt-in default", right?