# Do Not Track (DNT) and its successor, Global Privacy Control

Source: https://analyzine.com/explained/do-not-track/  
Author: Hasan Misbah  
Updated: 2026-11-02

Quick answer

Do Not Track (DNT) is a browser setting that adds a small signal, the header `DNT: 1`, to every request, asking websites not to track you. Honouring it was voluntary, few sites did, and it is now deprecated. Its practical successor is Global Privacy Control, which has legal weight in some US states.

## How the DNT signal works

When you load a web page, your browser sends a set of short notes along with the request, called HTTP headers. They say things like which language you prefer, what kind of browser you're using and often the page that sent you, known as the [referrer](https://analyzine.com/explained/referrer/). DNT added one more note: `DNT: 1`, meaning "please don't track me". Scripts on the page could read the same preference through JavaScript.

That's all it was. A request. The browser couldn't enforce anything, and nothing in the signal stopped a site from setting cookies or sending data to an ad network. Whether anything changed was entirely up to the site receiving it.

If you've seen "Send a 'Do Not Track' request with your browsing traffic" in your browser settings, this is what it means. Turning it on adds that header. It doesn't block anything by itself.

## A short history

The idea came from privacy researchers around 2009, and Mozilla added the setting to Firefox in 2011. Other browsers followed within a year or so. US regulators spoke in favour of a simple browser-level opt-out, and the web's standards body, the W3C, set up a working group to define what "tracking" meant and how sites should respond.

That last part is where it stalled. Advertisers, browser makers, privacy groups and publishers couldn't agree on what a site should stop doing when it saw the signal. Should it stop collecting data altogether? Stop showing targeted ads but keep measuring? Did first-party analytics count? After years of debate, the working group closed in 2019 without a standard that sites were obliged to follow.

## Why Do Not Track failed

### No legal force

Nothing in law required sites to obey the signal. In the US, California did pass a rule in 2013, but it only required certain sites to say in their privacy policy how they respond to DNT. A site could comply simply by writing "we don't respond to it". Many did exactly that.

### The default-on argument

In 2012, Microsoft switched DNT on by default in Internet Explorer 10. That sounds pro-privacy, but it handed the advertising industry an argument: if the browser turns it on for everyone, the signal no longer reflects a choice the user made, so it can be ignored. Industry groups said as much, and even some web server software added options to disregard the signal from that browser. Microsoft later dropped the default.

### Ignored by most sites

With no legal duty, no agreed meaning and a reason to doubt the signal, most sites carried on as before. The few that did honour it, often privacy-minded services, were the exception.

### It made people easier to identify

There was an odd side effect too. Only a minority of people turned it on, so the extra header became one more detail that could help tell browsers apart. Apple cited this when it removed DNT from Safari in 2019. A privacy setting that makes you stand out is not much of a privacy setting.

## Does DNT still work today?

Mostly, no. The header is deprecated in web standards and documentation, and browser makers have been dropping it. Safari removed it. Firefox, the first browser to ship it, has since removed the option from its settings and points people towards Global Privacy Control instead. Some browsers still show a DNT switch, but turning it on is unlikely to change how most sites treat you.

There's one place it may still carry a little weight. The GDPR says people can exercise their right to object to some kinds of processing "by automated means using technical specifications". A browser signal is the obvious example of that, so in the EU a DNT signal isn't legally meaningless. In practice, though, it's rarely acted on, and Global Privacy Control has taken over as the signal people talk about.

### Should Do Not Track be on or off?

Leaving it on does little harm, but don't rely on it. If you want real protection as a visitor, a browser with built-in tracker blocking, a reputable content blocker or turning on Global Privacy Control will do far more.

## Global Privacy Control: the successor

Global Privacy Control (GPC) launched in 2020, backed by a group of browser makers, privacy organisations and publishers. Technically it looks a lot like DNT: the browser sends a header, `Sec-GPC: 1`, and exposes the same preference to JavaScript.

The big difference is legal standing and a clearer meaning.

|  | DNT | Global Privacy Control |
| --- | --- | --- |
| Signal | `DNT: 1` | `Sec-GPC: 1` |
| What it asks | "Don't track me" (never clearly defined) | "Don't sell or share my personal data" |
| Legal weight | Disclosure only (California), no duty to obey | Must be honoured under some US state laws |
| Status | Deprecated, being removed from browsers | Supported in several browsers and extensions |

In California, the state's privacy law treats GPC as a valid request to opt out of the sale or sharing of personal data, and the regulator has enforced it. Colorado also recognises it as a universal opt-out signal, and several other states have similar rules. In the EU, GPC can be read as an objection or a withdrawal of consent in some situations, though how much weight it carries there is less settled.

Analyzine respects Global Privacy Control. You can read what that means in practice on our [Global Privacy Control page](https://analyzine.com/compliance/global-privacy-control/).

## What this means for your site

If you run a WordPress site, here's a sensible approach:

1. **Check your privacy policy.** If you have visitors in California and your policy doesn't mention how you handle DNT signals, that's a small gap worth closing. A short, honest sentence is enough.
2. **Honour GPC, especially if you serve US visitors.** Check that your analytics, advertising and marketing tools respect the signal, and test it with a browser that sends it.
3. **Reduce what needs opting out of.** The less you track, the less any signal has to switch off. [First-party analytics](https://analyzine.com/explained/first-party-analytics/) that keeps data on your own server and [cookieless tracking](https://analyzine.com/explained/cookieless-tracking/) both shrink the amount of data that could be sold or shared in the first place. Keeping data on infrastructure you control is the idea behind [data sovereignty](https://analyzine.com/explained/data-sovereignty/).
4. **Don't treat any browser signal as the whole job.** Consent banners, retention limits and data deletion requests still matter, and the rules vary by country and state. This is general information, not legal advice.

A good test for any tracking you run: if a visitor did send a signal asking you to stop, would you be comfortable explaining exactly what you did with it?

## Frequently asked questions

### What does "send a Do Not Track request" mean?

It's a browser setting that adds a small `DNT: 1` header to every page you visit, asking sites not to track you. The site decides whether to act on it, and most don't. The setting doesn't block anything on its own.

### Does Do Not Track actually work?

Not in any reliable way. Following it was voluntary, there was never an agreed definition of what sites should stop doing, and most ignored it. For a signal with legal backing in some places, look at Global Privacy Control instead.

### How do you respond to Do Not Track requests?

For a site owner, the honest answer is to state in your privacy policy if your site changes its behaviour when it sees the signal. If it doesn't, say so plainly. More useful today is making sure your tools respect Global Privacy Control.

### Is DNT the same as Global Privacy Control?

No, though they work in a similar way. DNT asked sites to stop "tracking", which was never defined and had no legal backing. Global Privacy Control asks sites not to sell or share your personal data, and some US state laws require businesses to honour it.

### Is DNT worth turning on?

It won't hurt much, but it won't do much either, and in older browsers it could make you slightly easier to identify. Turning on Global Privacy Control and using a browser with built-in tracker blocking will do more.