Do Not Track (DNT)

What Is Do Not Track

Do Not Track (DNT) is an HTTP header mechanism through which a web browser conveys the user's wish that a website not track them. When the user enables DNT in the browser settings, the header DNT: 1 is attached to every HTTP request.

DNT began in 2009 as a proposal that researchers implemented as a Firefox extension, and it drew broad attention when the FTC (US Federal Trade Commission) advocated the same kind of mechanism in a December 2010 report. Implementation in major browsers started in 2011, but what followed diverged sharply from those expectations.

Why DNT Does Not Work

The biggest problem with DNT is its lack of legal binding force. Websites have no obligation to comply with the DNT header. As a result, how the receiving side treats the header is left to each site and each company, so the mere fact that the header was sent is no confirmation that tracking has stopped.

The W3C (World Wide Web Consortium) officially discontinued DNT standardization work in 2019. The main reasons were:

The advertising industry refused to support DNT, making it ineffective
The percentage of users enabling DNT was too low, giving websites no incentive to comply
Paradoxically, having DNT enabled itself became a browser fingerprinting element, potentially aiding user identification

Alternatives to DNT

In the wake of DNT's failure, more effective mechanisms have appeared.

GPC (Global Privacy Control): A signal proposed in 2020 as the successor to DNT. California's CCPA/CPRA treats opt-out settings of this kind as something businesses are expected to respect, and that legal backing is the biggest difference from DNT (it does not mean that the EU's GDPR recognizes GPC by name). Browser defaults are not uniform: Brave sends the signal in ordinary windows as well, while Firefox enables it by default only in private windows and leaves ordinary windows to be switched on from the settings (as of August 2026).
Browser tracking protection features: Approaches in which the browser itself blocks tracking technically, such as Safari's ITP and Firefox's ETP (Enhanced Tracking Protection). Requiring no cooperation from the site is the decisive difference from DNT. Because they depend on lists of known trackers and on detecting tracking behavior, however, they miss newer techniques and the tactic of moving measurement onto the site's own domain.
Cookie consent banners: In the EU, the combination of the ePrivacy Directive (the Cookie Directive), which requires prior consent for storing cookies on a device in the first place, and the GDPR, which sets out what valid consent requires, obliges sites to obtain explicit consent before using tracking cookies.

Countermeasures That Actually Work

While enabling DNT is harmless, relying on it alone is risky. Combine it with countermeasures that actually work.

Block third-party cookies in your browser settings
Use browsers with strong tracking protection, such as Firefox or Brave
Install extensions that block tracking pixels (such as uBlock Origin)
Use browsers or extensions that support GPC
Use privacy-focused search engines

One more point worth keeping in mind is that DNT and GPC both merely append a single line stating that the user does not want to be tracked; neither changes the substance of the request. Turning DNT on leaves the IP address and connection details shown on an IP address checking page exactly as they were. If you want to change what is displayed, you need to replace the network path itself with a VPN or a proxy.

History of DNT and Evolution to GPC

Looking back over the history of DNT, the lesson that emerges is that a technical standard alone does not deliver privacy protection.

How DNT standardization unfolded: In 2009 the security researchers Christopher Soghoian and Sid Stamm implemented the original version as a Firefox extension, and in December 2010 the FTC advocated the same kind of mechanism in a report. In 2011 Firefox 4 became the first browser to implement the DNT header, with IE 9 following the same year (Safari and Chrome added support in 2012). W3C also set up the Tracking Protection Working Group in 2011 and began standardization work, but advertising industry representatives and consumer groups could not agree even on the definition of tracking, and the discussion stalled. In September 2013 the industry body DAA (Digital Advertising Alliance) withdrew from the Working Group, and in January 2019 W3C closed the group and formally abandoned standardization.

The legal backing behind GPC: GPC (Global Privacy Control) was designed on the premise of legal enforceability, drawing on the lessons of DNT. California's CCPA/CPRA recognizes the GPC signal as a legally valid request to opt out of the sale or sharing of personal information. In August 2022 a cosmetics retailer that had not processed opt-out requests sent via GPC settled with the California Attorney General for 1.2 million dollars, the first enforcement action under the CCPA. Privacy laws in Colorado and Connecticut also recognize GPC, and this legal backing is on a widening trend.

Practical steps for strengthening privacy: Rather than pinning hopes on the DNT setting, it is more realistic to start with the choice of browser and its settings. Firefox has ETP (Enhanced Tracking Protection) enabled by default and automatically blocks known trackers. Adding the official Multi-Account Containers extension lets you isolate tracking by social media and shopping sites on a per-site basis. Brave blocks ads and trackers by default and enables GPC as well. Among extensions, uBlock Origin blocks a broad range of trackers on the basis of filter lists, while Privacy Badger distributes a tracker list that EFF has trained in advance and blocks domains whose behavior tracks users across sites (learning inside the browser was disabled by default in October 2020). Combining these delivers effective privacy protection that does not depend on DNT.

Common Misconceptions

Enabling Do Not Track prevents websites from tracking you: DNT is merely a preference signal and has no legal binding force. Whether a site honors the request is left to its own discretion, and the W3C also ended its standardization work in January 2019.
Do Not Track has been discontinued, so there is no point in enabling it: While W3C standardization was discontinued, some privacy-focused websites still respect DNT. Additionally, its successor GPC has legal backing and is becoming more effective. There is no downside to enabling it.