GPC beats account and cookie

privacyChoiceStatus checks GPC, then account, then cookie. None means not opted out.

If Sec-GPC is on, source is gpc even when User.doNotSellAt or fameo_dns is missing. Next is account, then cookie.

Kumir never ranks a weaker signal above GPC. That matches the CPRA Global Privacy Control requirement.