Syllabus Lesson 19 of 156 · Fingerprinting: tracking without cookies
Fingerprinting: tracking without cookies

Do Not Track and Global Privacy Control

Why it matters There is a simple switch that tells every site you visit "please do not sell or share my data". It is not magic, but it is free, takes a minute to switch on, and some sites honour it. Its older cousin, Do Not Track, is a lesson in why polite requests need clear meaning.

A sign on the door

Imagine hanging a "no junk mail" sign on your letterbox. It does not physically stop anyone; it works only if the people delivering leaflets agree to respect it. Both signals in this lesson are signs on the door.

HTTP header: a short labelled line your browser sends with every request, such as Accept-Language: en-GB. Sites read headers to decide how to respond.

Do Not Track: a good idea that faded

Around 2010, browsers added a setting that sent the header DNT: 1, meaning "do not track me". It failed for three reasons:

  • No agreed meaning. Sites and advertisers never agreed what "track" covered, so most simply ignored it.
  • Default on. When one browser turned it on for everyone, some sites argued it no longer reflected a real choice, and ignored it more.
  • It became a trait. Because few people sent it, DNT: 1 added a bit to their fingerprint.

Safari removed its Do Not Track setting in 2019, and Firefox removed its setting in 2025 in favour of Global Privacy Control (checked October 2026).

Global Privacy Control: narrower and clearer

Global Privacy Control (GPC): a signal that means one specific thing: "do not sell or share my personal data". Your browser sends the header Sec-GPC: 1, and page scripts can read navigator.globalPrivacyControl, which is true when it is on.

Because it asks for one clear thing, sites can build a clear response: turn off ad sharing for this visitor. Some sites and services treat it as a firm opt-out; others ignore it. This course does not cover the legal side.

Which browsers send it (checked October 2026)

  • Brave and the DuckDuckGo browser send it by default.
  • Firefox has a setting under Settings, Privacy & Security: "Tell websites not to sell or share my data". It is also on in private windows.
  • Chrome has no built-in switch; privacy extensions can add it.

Try it After switching GPC on, open the browser console (see the previous lab) and type navigator.globalPrivacyControl. If it says true, your browser is sending the signal. The project's own site, globalprivacycontrol.org, also shows whether it detects it.

A common misconception

"GPC blocks trackers." It does not block anything. It is a request. Pair it with real protections such as tracker blocking and third-party cookie blocking. And if you build websites, read the Sec-GPC header and honour it: it is the clearest wish a visitor can send you.

Recap

  • Do Not Track failed because nobody agreed what it meant, and it became a fingerprint trait.
  • GPC asks one clear thing: do not sell or share my data, via Sec-GPC: 1.
  • Brave and DuckDuckGo send it by default; Firefox has a setting; Chrome needs an extension (checked October 2026).
  • It is a request, not a blocker, so combine it with real protections.

Spotted a problem in this lesson? Report it

Code · runs in your browser
Output

        

      

      
      

        Back