Privacy ChoicesApps & admin
The form never fakes a GPC withdraw
While GPC is on, withdraw stays blocked. Status comes from GPC, account, or cookie.
Kumir never invents a successful GPC withdraw. assertCanWithdrawPrivacyOptOut throws while Sec-GPC: 1 is present. The UI disables Withdraw and GET /api/v1/privacy-choices still returns gpcLocked.
This hub does not invent optedOut: false under a GPC lock.