Do Not Track vs Global Privacy Control: The Short Version

Do Not Track (DNT) and Global Privacy Control (GPC) are both browser signals that tell websites what you want, but only GPC is still being developed and used. DNT asked websites not to track you and had no legal link. GPC asks websites not to sell or share your personal information and is made to work with privacy laws. This guide explains how the two signals differ, what happened to DNT, how GPC works, how to switch GPC on and how to check what your browser sends.

Both signals are opt-out signals. Your browser sends them with each page request, and the website decides what to do with them. Neither one blocks trackers by itself.

What Is Do Not Track?

Do Not Track is a browser setting that sends a signal asking websites not to track you across sites. Your browser adds the signal "DNT: 1" to its requests, and scripts can read it as navigator.doNotTrack. The idea was to give people one switch instead of many opt-out forms.

The problem was that no rule made websites follow the signal. The W3C Tracking Protection Working Group published the specification as a Working Group Note on 17 January 2019 and stated that there had not been sufficient deployment to justify further advancement, nor indications of planned support among browsers, third parties and the wider ecosystem (W3C, 2019). In short, the work on the standard stopped.

What Is Global Privacy Control?

Global Privacy Control is a browser signal that asks websites not to sell or share your personal information with third parties. The GPC specification describes it as a signal sent over HTTP and through the browser's DOM, and says it is meant to work with existing and upcoming legal frameworks that make such requests enforceable (GPC specification, 2026).

Technically, GPC has three parts:

  • Header: The browser sends "Sec-GPC: 1" with page requests. The value 1 is the only defined value, and the header is absent when no preference is set.
  • Script property: Pages can read navigator.globalPrivacyControl. It is true when the signal is sent and false when the browser supports GPC but no preference is set (MDN, 2026).
  • Support file: A website can publish a file at /.well-known/gpc.json to say that it supports GPC.

Do Not Track vs Global Privacy Control: What Is the Difference?

The main difference is purpose and legal link: DNT is a general request not to track, while GPC is a specific request not to sell or share data that is built for privacy laws. The table sums up the points.

PointDo Not Track (DNT)Global Privacy Control (GPC)
RequestDo not track meDo not sell or share my personal information
HTTP headerDNT: 1Sec-GPC: 1
Script propertynavigator.doNotTracknavigator.globalPrivacyControl
Status of the standardW3C Working Group closed, final Note in 2019Specification in development (2026)
Link to lawsNone in the specificationBuilt to work with legal opt-out rights

Do Websites Have to Follow GPC?

It depends on where you live and on the website. The signal itself has no power. A rule that makes a website follow it has to come from a law or from the website's own policy. In the United States, the California Attorney General stated in 2022 that under the California Consumer Privacy Act (CCPA), businesses must treat opt-out requests made by user-enabled global privacy controls as valid. The same year, the Attorney General announced a settlement of $1.2 million with the retailer Sephora, in a case that included the allegation that Sephora did not honour opt-out requests sent through such controls (California Attorney General, 2022).

This is one example from one US state. This guide does not cover the law in other countries and is not legal advice. For your own case, ask a lawyer or read the privacy notice of the website.

What Happened to Do Not Track?

Browsers have started to remove the setting. Mozilla states that Firefox removed its Do Not Track setting in version 135, because many sites do not respect the signal and it can even reduce privacy in some cases. Mozilla points users to Global Privacy Control instead, which Firefox has supported since version 120 (Mozilla, 2026). One reason a signal can reduce privacy is simple: if only a small share of people send it, it adds to your browser fingerprint.

How Do I Turn On Global Privacy Control?

You turn on GPC in your browser settings or with a browser extension, depending on the browser. In Firefox, open Settings, go to Privacy & Security and check the option "Tell websites not to sell or share my data" (Mozilla, 2026). Other browsers use different menus or extensions, so use the help page of your browser to find the setting. GPC is a signal. It does not stop trackers from loading. Pair it with tracking protection if you want technical blocking. Our guide Brave vs Firefox vs Tor compares the privacy tools of three browsers.

How Do I Check Whether My Browser Sends GPC or DNT?

You can check both signals in a few seconds:

  1. DNT: Open the SpeedIQ test page and run the check named "TLS / DNT". It reads whether your browser sends the Do Not Track signal and shows "DNT: ON" or "DNT: OFF". Many current browsers no longer offer the setting, so "OFF" is common.
  2. GPC: The SpeedIQ check does not read GPC. Open the developer console of your browser and type navigator.globalPrivacyControl. A result of true means the signal is sent. A result of false means your browser supports GPC but no preference is set. If you see undefined, your browser does not support GPC.

A second source is the page Browser Fingerprint Test, which shows the other values your browser shares with every site.

Will GPC or DNT Make Me Anonymous?

No. Both signals only express a wish. They do not hide your IP address, they do not change your browser fingerprint in a helpful way and they do not remove cookies. For a broader look at what websites can see, run the checks in our online privacy check guide. If you want to hide your address, a VPN or Tor is a different tool; see the Tor Browser guide and the IP reputation check.

Which Signal Should You Use?

Use GPC if your browser offers it, because it is the signal that is still in use and that privacy rules refer to. Leave DNT as it is if your browser still has it, but do not expect websites to react. Add real protection on top: tracking protection in the browser, a content blocker and careful cookie choices on each site.

Summary

DNT asks websites not to track you, and its standard ended in 2019. GPC asks websites not to sell or share your data and is made for privacy laws such as the CCPA. Firefox has dropped the DNT setting and supports GPC. Check your browser with navigator.globalPrivacyControl and the SpeedIQ DNT check.

FAQ

What is GPC?

GPC stands for Global Privacy Control. It is a browser signal that asks websites not to sell or share your personal information. Browsers send it as the header "Sec-GPC: 1" and expose it to scripts as navigator.globalPrivacyControl.

Is Do Not Track still used?

Hardly. The W3C working group closed and published a final Note in January 2019 because the signal was not widely supported. Firefox removed its Do Not Track setting in version 135.

Does GPC replace Do Not Track?

In practice, yes. Mozilla recommends GPC instead of Do Not Track. GPC differs in what it asks for: it asks websites not to sell or share your data, not to stop all tracking.

Do websites have to respect Global Privacy Control?

Only where a law or the site's own policy requires it. California's Attorney General stated in 2022 that businesses under the CCPA must treat opt-out requests made by user-enabled global privacy controls as valid. This does not cover other countries.

How can I tell if my browser sends the GPC signal?

Open the browser console and type navigator.globalPrivacyControl. True means the signal is sent, false means the browser supports it but no preference is set, and undefined means the browser does not support it.

Sources