Do Not Track Test

Your browser can broadcast a quiet request to every website you visit, asking them not to track you. There are two such signals: the older Do Not Track and the newer Global Privacy Control. This test reads both straight from your browser and shows whether each is switched on, along with a plain explanation of what they actually do.

Both work the same way in principle. When you enable one, your browser attaches an extra line to the requests it sends, and exposes a matching JavaScript property so a page can read your stated preference. A site is then expected to change its behaviour accordingly. Nothing about the mechanism forces that, which is the whole story of why one of these signals quietly failed and the other is slowly acquiring teeth.

Do Not Track launched with real optimism. The idea was simple: flip a setting, and your browser would tell every site you preferred not to be tracked. The flaw was equally simple. Honouring the request was entirely voluntary, with no standard for what compliance even meant and no consequence for ignoring it.

Predictably, the advertising industry did not adopt it. Firms argued that a single header could not distinguish a genuine preference from a browser default, and since some browsers shipped it switched on, that objection was not unreasonable. Over time major browsers and websites concluded the signal was meaningless. Chrome never honoured it, Safari removed the toggle in 2019, and Firefox still offers it but treats it as advisory.

If your DNT shows as on, that is fine, but do not mistake it for protection: the overwhelming majority of sites treat it as if it were not there.

Global Privacy Control learned from that failure. Technically it works much like Do Not Track, a signal sent with your requests, but it was designed from the start to plug into privacy law rather than rely on goodwill. That single design choice is what separates the two.

In jurisdictions such as California, sending GPC can legally count as exercising your right to opt out of the sale or sharing of your personal information, and businesses covered by the law are required to respect it. The California Attorney General has indicated that a site ignoring a recognised opt-out signal can be treated as non-compliant, which gives the header a real consequence that DNT never carried.

That is a fundamental shift: for the first time the signal can create obligations, at least for companies within reach of those regulations. Where no such law applies, GPC reverts to a polite request and behaves no better than DNT. The Global Privacy Control test checks only that signal on its own.

Both signals travel as ordinary HTTP request headers, which means they appear on every request to every domain, not just the page you are reading. Do Not Track sends DNT: 1, and Global Privacy Control sends Sec-GPC: 1. Alongside the header, each is surfaced to JavaScript: navigator.doNotTrack returns a string, and navigator.globalPrivacyControl returns a boolean.

You can watch them leave. Open your browser’s developer tools, switch to the Network tab, reload the page and inspect any request’s headers; whichever signal is enabled will be sitting there. The HTTP headers test does the same job without the developer tools.

Support differs sharply. Firefox and Brave send GPC, Chromium browsers do not, and Safari implements neither beyond a legacy DNT default. Because the header is per-request, a proxy or extension that strips or adds headers can change what a server sees, so what this page reads from JavaScript is not always what the network carried.

Both signals are usually off until you enable them. The exact path varies by browser, but the general routes are:

• Do Not Track. Look in your browser’s privacy settings for a "Send a Do Not Track request" or similarly worded toggle. Firefox keeps it; Chromium browsers have largely retired it.
• Global Privacy Control. Brave and Firefox can send GPC through their privacy settings. On other browsers a reputable privacy extension can add the header to outgoing requests.

After changing a setting, use the re-check button above to confirm the signal is now being sent. If it still reads as not set, the browser does not expose that property at all, and no amount of configuration will change it.

Be realistic about the outcome. Do Not Track achieves almost nothing today. Global Privacy Control is genuinely useful where the law backs it, and harmless where it does not, so enabling GPC is a sensible, low-effort step. But neither signal stops a determined tracker, and neither touches fingerprinting at all.

Think of them as declarations rather than defences. They record your preference for anyone willing to listen, and they create legal exposure for the companies that must. They do not remove a cookie, block a script or change the pixels your browser paints.