Both are signals your browser sends to ask sites not to track you, but only one carries legal weight. Here is what each header does and how to check yours.
On this page
Which of the two privacy signals sitting inside your browser is actually worth sending?
Both say something like “please do not track me.” Both live in the same settings area, if they live anywhere at all, and both are easy to confuse. One is a relic that promised a great deal and delivered almost nothing. The other is newer, narrower in scope, and — in some places — actually enforceable. Knowing which is which tells you a lot about how much a “please do not track me” request is worth.
One idea, two implementations
Both Do Not Track and Global Privacy Control express the same wish: that a website not track what you do. They differ in how the message is sent, who agreed to listen, and what happens when a site ignores it. Strip away the acronyms and the distinction is simple.
| Signal | What it is |
|---|---|
| Do Not Track | A polite request with no consequence |
| Global Privacy Control | A structured opt-out that some laws now recognise |
Reading the do-not-track signal
Do Not Track travels as an HTTP request header. When the setting is switched on, your browser attaches DNT: 1 to the requests it makes, and page scripts can read the same preference through navigator.doNotTrack.
The idea was reasonable, and browsers adopted it readily. The fatal flaw was that participation was voluntary at every level. A site could honour the header, ignore it, or never think about it, and nothing distinguished those cases. No regulator required compliance, so there was no penalty for simply doing nothing.
Why the browsers dropped it
Over the years the major browser makers quietly removed the switch from their settings screens. A signal almost nobody acts on is worse than no signal at all, they reasoned, because it hands users a false sense of protection.
What Global Privacy Control adds
Global Privacy Control rewrote the same idea with teeth. It uses a different header, Sec-GPC: 1, and a matching JavaScript property, navigator.globalPrivacyControl. When the signal is off, the header is omitted entirely, which avoids the ambiguity that made DNT so easy to dismiss.
Where the teeth come from
The decisive difference is legal recognition. In some jurisdictions — parts of the United States, most notably California — regulators have treated GPC as a valid, binding opt-out of the sale or sharing of personal information. A business that ignores it there is not merely being impolite; it may be breaking the law. In other regions, including under European data protection rules, the signal is not automatically binding, though it can still be read as a clear statement of preference.
The two headers side by side
| Do Not Track | Global Privacy Control | |
|---|---|---|
| Header sent | DNT: 1 | Sec-GPC: 1 |
| Script property | navigator.doNotTrack | navigator.globalPrivacyControl |
| Legally binding? | No | In some jurisdictions |
| Offered in mainstream browsers | Rarely | Mixed |
| Honoured by ad networks | Largely no | Sometimes |
Who honours each signal
Support for Do Not Track today is close to theoretical. A few sites still read it, mostly out of habit, but the header no longer changes much about what a tracker does. GPC fares better, though unevenly.
- Privacy-focused browsers. Some send GPC by default, with no switch involved.
- Content blockers and extensions. Some add the header on your behalf even when the underlying browser offers no switch.
- Ad networks. Whether one respects GPC depends on where you are and which laws apply to that company. A signal that binds a business in one market may be ignored by the same business in another.
That patchwork is worth remembering. A signal is only as strong as the obligation behind it, and the obligation depends on where the company operates and where you are sitting.
How to check what your browser sends
You cannot assume either signal is present. The setting lives in different places, or nowhere at all, depending on your browser, and an extension can change the answer without you noticing. The honest way to know is to look at the request your browser actually makes.
- Check Do Not Track. Use the Do Not Track test to see whether the
DNTheader and its JavaScript counterpart are being sent. - Check Global Privacy Control. Run the Global Privacy Control test to confirm the
Sec-GPCheader and thenavigator.globalPrivacyControlvalue. - Check what is acting on your browsing. Because extensions and ad blockers can add or alter these signals, an ad blocker detector shows you part of that picture — useful context when a signal you did not configure turns out to be present.
The two results together describe exactly what you are telling every site you visit.
Signalling is not the same as resisting
A privacy signal is a request about how your data may be used; it is not a shield against being recognised in the first place. Even a site that honours GPC can still build a profile from data it collects directly, and no header stops a browser fingerprint from being computed. Signalling intent and resisting identification are separate problems, and the second one is far harder to solve.
What would change the conclusion
The verdict here is conditional, and it is worth saying what would move it. Do Not Track would become worth more than a shrug if a rule ever required sites to honour it, or if browsers put the switch back and made it mean something. GPC would matter less if the laws that give it force were narrowed or abandoned, and more if other jurisdictions started treating it as binding too.
Until one of those things changes, treat these headers as one useful layer rather than a cure. The honest reading is that GPC is the one worth checking, because it is the one that can carry a consequence.