Global Privacy Control is the signal sites actually have to honour. Do Not Track, sent as a DNT: 1 header, never gained legal force, was ignored by nearly every site and was removed from Firefox in 2025. Global Privacy Control, sent as Sec-GPC: 1, is recognised under California's CCPA regulations and the Colorado and Connecticut privacy laws as a valid opt-out from the sale and sharing of personal data.
Two headers, two very different histories
Both signals are a single HTTP request header that your browser attaches to every request, telling the site something about your preference. The mechanism is nearly identical; the outcomes could not be more different. Do Not Track was a request that came with no obligation and no definition, and the industry treated it accordingly. Global Privacy Control was designed from the start to plug into laws that already obliged businesses to honour a user's opt-out, so the question of whether to respect it was answered by regulators rather than by the sites themselves.
The lesson is one this site keeps returning to: a preference signal is only as strong as the consequence of ignoring it. The tracking guide explains why sites had every incentive to ignore DNT.
Do Not Track: what it was and why it failed
Do Not Track appeared in 2009 as a proposal and shipped in Firefox in 2011, followed by every major browser. Enabled, it adds one line to each request:
DNT: 1The W3C convened a Tracking Protection Working Group to define what a site receiving DNT: 1 was obliged to do. Advertisers and privacy advocates could not agree on the definition of tracking, the group produced a Tracking Preference Expression specification for the header itself but never a binding compliance standard, and it closed in January 2019 with its output published as a Note rather than a Recommendation. No jurisdiction gave the header legal effect. A handful of sites honoured it; the vast majority did not, and some that did stopped after Microsoft briefly enabled it by default in Internet Explorer 10, which advertisers used as an argument that the signal no longer reflected a user's choice.
Browsers drew the conclusion. Apple removed the setting from Safari in 2019, stating that the header had become a fingerprinting signal, since a minority of users sending it were easier to distinguish. Mozilla removed it from Firefox in version 135 in early 2025, pointing users at Global Privacy Control instead. Chrome and Edge still expose a Do Not Track toggle, but sending it accomplishes nothing. Our browser check reports the Do Not Track signal for completeness; if you see it set, treat it as harmless legacy rather than protection.
Global Privacy Control: what it is
Global Privacy Control was published in 2020 by a group of browser makers, publishers and privacy organisations, and the specification now lives in the W3C Privacy Community Group. It has two parts. The request header:
Sec-GPC: 1And a JavaScript property that scripts on the page can read, so that consent-management and analytics code can react without inspecting headers:
if (navigator.globalPrivacyControl === true) {
// treat the visitor as opted out of sale and sharing
}The Sec- prefix is deliberate: browsers refuse to let page scripts set headers beginning with Sec-, so a site can trust that the value came from the browser and not from injected code. The header is sent only as 1; a browser that has not been set to opt out omits it rather than sending 0, which removes the fingerprinting concern that plagued DNT's three states.
The specification defines what the signal means precisely, and narrowly. It is an expression of the user's intent to opt out of the sale or sharing of their personal data, and to invoke whatever right the applicable law grants to that effect. It is not a request to stop tracking in general, and it makes no technical demand of the site. That narrowness is what let it succeed: it maps onto rights that already exist in law.
The laws that give GPC force
California. The CCPA, as amended by the CPRA, gives residents the right to opt out of the sale or sharing of their personal information, and the regulations issued under it require businesses to treat an opt-out preference signal sent by a browser or extension as a valid request. The California Attorney General's office has named Global Privacy Control as such a signal, and in 2022 settled an enforcement action against the retailer Sephora that included, among other allegations, a failure to honour the signal. That settlement is the reason large publishers and retailers built GPC handling into their consent systems.
Colorado. The Colorado Privacy Act required controllers to honour a universal opt-out mechanism from 1 July 2024, and the Colorado Attorney General maintains a public list of recognised mechanisms; Global Privacy Control is on it.
Connecticut. The Connecticut Data Privacy Act required recognition of opt-out preference signals from 1 January 2025.
Several other state laws, including those of Texas, Oregon, Montana, Delaware, New Jersey and New Hampshire, contain similar universal opt-out provisions with their own effective dates, and the list grows each session. Outside the US, the GDPR contains no explicit equivalent, though the right to object to direct marketing under Article 21 is absolute and some regulators have suggested that a clear browser signal could constitute an objection. That remains an argument rather than settled practice.
| Do Not Track | Global Privacy Control | |
|---|---|---|
| Header | DNT: 1 | Sec-GPC: 1 |
| JavaScript property | navigator.doNotTrack (deprecated) | navigator.globalPrivacyControl |
| Meaning | Undefined; "please do not track" | Opt out of sale and sharing under applicable law |
| Legal force | None | CCPA/CPRA regulations; Colorado, Connecticut and other state laws |
| Browser support in 2026 | Removed from Safari and Firefox; toggle remains in Chrome and Edge | Native in Firefox, Brave, DuckDuckGo; extension in Chrome, Edge, Safari |
| Set by page scripts? | Not applicable | Blocked by Sec- prefix |
What GPC does and does not do
Be precise about the effect, because it is easy to overstate. When a site that is subject to one of these laws receives Sec-GPC: 1 from a resident of that state, it must stop selling or sharing that visitor's personal data, which in practice means suppressing the advertising and data-broker integrations that pass the visitor's data to third parties. It does not have to stop collecting data for its own use, stop first-party analytics, or stop showing ads. It does not have to verify residency before honouring the signal, and many sites apply it to everyone rather than attempt geolocation.
Technically, GPC changes nothing in your browser. Trackers still load, cookies are still set, your fingerprint is still readable. A site that ignores the signal, or is outside any jurisdiction that enforces it, is unaffected. That is why GPC belongs alongside a tracker blocker and automatic cookie deletion rather than in place of them: the blocker prevents the data from leaving, and GPC makes it unlawful for a compliant site to sell what it does collect. Together they cover both the sites that comply and the ones that do not. Where the site does comply, GPC reaches the one thing a blocker cannot touch, which is what the site does server-side with data it collected first-party. The data broker guide covers the downstream market that the opt-out interrupts.
How to send it
- Firefox: Settings, Privacy & Security, Website Privacy Preferences, tick "Tell websites not to sell or share my data". Firefox enables it by default in private windows and offers it for normal windows.
- Brave: on by default for every request.
- DuckDuckGo browser and extension: on by default.
- Chrome, Edge and Safari: no native setting. Extensions such as Privacy Badger add the header and the JavaScript property; several ad blockers include it as an option. Check the extension actually sets both parts, since some set only the header.
Our browser extension sends the signal alongside its tracker blocking and cookie deletion, so the three protections this guide keeps pairing arrive together. Whatever you use, verify it: the browser check reports whether the Global Privacy Control header and property are present.
How to check whether a site is listening
The specification defines an optional resource a site can publish to state that it honours the signal:
GET /.well-known/gpc.json
{
"gpc": true,
"lastUpdate": "2026-01-15"
}Fetch that path on any site to see whether it claims support. Absence means nothing, since publishing it is optional; presence is a public commitment a regulator can hold the site to. Beyond that, a site honouring GPC will typically show its privacy-choices page with the "do not sell or share" option already selected, and its cookie banner may acknowledge the signal. If you are a California resident and a site with a "Do Not Sell or Share" link ignores the signal, that is a complaint the California Privacy Protection Agency accepts.
The position to take
Turn GPC on, turn DNT off if your browser still offers it, and do not expect either to be visible in your day-to-day browsing. GPC works in the background, on the servers of the sites that are obliged to honour it, and its value grows as more jurisdictions adopt the model. It is the rare privacy control that costs nothing and breaks nothing, which is why we treat it as a default rather than a choice. The privacy hub places it among the protections that do the visible work.
