Global Privacy Control locks withdraw

Sec-GPC: 1 is treated as an opt-out. Withdraw stays disabled while GPC is on.

headerHasGpc reads Sec-GPC / sec-gpc. When the browser sends 1, privacyChoiceStatus returns source gpc and gpcLocked true.

assertCanWithdrawPrivacyOptOut throws while GPC is present. The web form and native screens disable Withdraw until the signal is off.