← Back to Blog
Privacy·5 min read

Is Do Not Track Dead? Understanding GPC and Modern Privacy Laws

In 2009, privacy researchers proposed Do Not Track (DNT) — a simple HTTP request header that users could toggle in browser settings. The concept was straightforward: if a browser sent the header DNT: 1, websites were requested to disable tracking cookies, behavioral profiles, and data sharing.

While DNT was adopted by major browsers, it never gained consistent site compliance. Global Privacy Control (GPC) is a newer opt-out preference signal that is recognized by some privacy laws and regulators.

Why Do Not Track Failed

The fatal flaw of Do Not Track was its voluntary nature. DNT was a polite request, not a legal mandate.

When the header was finalized, major ad tech companies and data brokers openly ignored it. There was no regulatory penalty for tracking users who had DNT enabled. In 2012, Internet Explorer enabled DNT by default, prompting the advertising lobby to argue that the signal did not represent active user choice, rendering it invalid.

Standardization groups reached a deadlock, and the W3C tracking protection working group officially disbanded in 2019.

DNT can also add one observable bit to a browser profile when its value differs across users. Whether that materially improves recognition depends on the rest of the dataset.

The Rise of Global Privacy Control (GPC)

Global Privacy Control (GPC) was created by a coalition of privacy organizations, browser vendors, and legal experts to succeed DNT.

GPC works under the hood via two methods:

  1. An HTTP Header: Your browser sends Sec-GPC: 1 with every web request.
  2. A JavaScript Property: The browser exposes the property navigator.globalPrivacyControl set to true.
code
[Browser (Sec-GPC: 1)] ---> [Website Server] ---> Read GPC, Opt-Out User

The crucial difference: GPC can carry legal effect in covered jurisdictions.

For example, California says covered businesses must honor a user-enabled GPC signal as a valid request to stop the sale or sharing of personal information. Requirements and scope vary by jurisdiction and business; GPC is not a universal technical block. See the California Attorney General's GPC guidance.

California's 2022 Sephora settlement included allegations that the company failed to process GPC opt-out requests. It is an important enforcement example, not proof that every site everywhere has the same obligation.

How to Check and Enable GPC

To verify if your browser is actively protecting your legal rights:

  1. Visit BrowserProbe's Do Not Track Test.
  2. Look at the Global Privacy Control row.
  3. If it displays "Enabled," your browser is correctly broadcasting your opt-out preferences.

To turn GPC on, use a browser that supports GPC natively:

  • Brave Browser: GPC is enabled by default.
  • Mozilla Firefox: Go to Settings -> Privacy & Security -> and check the box for "Tell websites not to sell or share my data".
  • Browser Extensions: If you use Chrome or Edge, you can enable GPC by installing the Privacy Badger or Opt-Out Easy extension.

Enabling GPC is a low-friction way to express an opt-out preference. It does not block tracking by itself, and its legal effect depends on the applicable law and whether the business is covered.