Category: Consumer Privacy Rights

Do Not Track

Also known as: DNT, Do Not Track signal, DNT header

Simply put

Do Not Track (DNT) is a browser setting that, when enabled by a user, sends a signal to the websites they visit expressing a preference not to be tracked across their web browsing. Because it communicates only a request, websites and advertising companies have generally not been required to honor it, and support for the feature has declined over time.

Formal definition

Do Not Track (DNT) is a non-standard HTTP header field, typically transmitted as 'DNT: 1', through which a browser communicates a user's expressed preference to opt out of tracking by websites and third-party services. It functions as a unilateral signal rather than an enforcement mechanism: the standard was never finalized and is now widely regarded as deprecated, so recipients are generally under no technical obligation to act on it. Whether a site must respond to DNT depends on the applicable legal regime and any voluntary commitments a site makes; DNT should be distinguished from later opt-out signals such as Global Privacy Control, which some US state privacy frameworks may treat as a legally recognized opt-out request. The scope of any legal effect is jurisdiction-dependent and not addressed by this definition.

Why it matters

Do Not Track represents an early attempt to give users a simple, browser-level way to express a preference against being tracked across the web. For privacy and compliance teams, understanding DNT matters because it illustrates a recurring challenge in the industry: a technical signal can communicate a user's wishes, but it carries weight only if recipients are willing or legally obligated to honor it. Because DNT was a unilateral request rather than an enforcement mechanism, websites and advertising companies have generally not been required to act on it, and support for the standard has declined over time. The standard was never finalized and is now widely regarded as deprecated.

The practical significance of DNT today lies largely in what it teaches about its successors. Compliance professionals should not assume that the presence of a DNT header creates any obligation on its own; whether a site must respond depends on the applicable legal regime and any voluntary commitments the site has made. This is an important distinction to draw when advising on how automated browser signals fit into a consent strategy, because treating DNT as a binding opt-out could create a false sense of compliance.

DNT should be carefully distinguished from later opt-out signals such as Global Privacy Control, which some US state privacy frameworks may treat as a legally recognized opt-out request. Whether any particular signal carries legal effect is jurisdiction-dependent, and enforcement positions continue to evolve. Teams operating across the EU, the UK, and individual US states should evaluate each signal against the specific requirements of the relevant regime rather than assume a uniform treatment.

Who it's relevant to

Privacy officers and data protection professionals

DNT is relevant when assessing how browser-level signals fit into a broader consent and opt-out strategy. Because DNT is generally not binding on its own and is widely regarded as deprecated, professionals should be careful to distinguish it from signals such as Global Privacy Control that some US state privacy frameworks may treat as legally recognized opt-out requests, and should evaluate obligations against the specific applicable jurisdiction.

Legal counsel and compliance advisors

Counsel advising on tracking practices need to understand that whether a site must respond to a DNT signal depends on the applicable legal regime and any voluntary commitments the site has made. Advising that a DNT header creates a universal obligation, or that ignoring it is definitively unlawful, would overstate the position, since the standard was never finalized and legal treatment varies by jurisdiction.

Web developers and engineering teams

Developers may encounter the 'DNT: 1' header in incoming requests and should understand that it is a non-standard, deprecated field carrying no inherent technical obligation. When implementing responses to browser privacy signals, teams should distinguish DNT from newer signals and confirm with legal or compliance stakeholders which signals, if any, must be acted upon in the relevant regions.

Marketing and advertising compliance teams

Because advertising companies have generally not been required to honor DNT, marketing teams should not rely on the absence of a DNT signal as evidence of valid consent, nor treat DNT as a substitute for the consent or opt-out mechanisms required under applicable frameworks. Consent and opt-out obligations differ between the EU, the UK, and individual US states, and should be assessed accordingly.

Inside DNT

DNT HTTP header

Do Not Track (DNT) is a browser signal transmitted via an HTTP header field that communicates a user's preference not to be tracked across websites. When enabled, the browser sends a value indicating the user's tracking preference with outgoing requests.

Voluntary, non-binding nature

DNT was designed as a standardized preference signal, but honoring it has generally been voluntary for website operators. There has been no broadly adopted regulatory mechanism compelling sites to respond to the signal, which contributed to inconsistent adoption.

Preference signal, not a consent mechanism

DNT expresses a user's desire to avoid tracking, but it does not by itself constitute valid consent or a valid objection under any specific legal framework. Its legal effect depends on how a given jurisdiction or website chooses to treat it.

Relationship to newer opt-out signals

DNT is often discussed alongside later browser-based opt-out signals such as Global Privacy Control (GPC). GPC was developed more recently and, unlike DNT, is referenced in connection with certain US state privacy frameworks. DNT and GPC are distinct signals and should not be treated as interchangeable.

Scope limitation

DNT concerns the transmission of a tracking preference at the browser level. It does not itself set or read cookies, determine which cookies are strictly necessary, or govern the downstream processing of personal data, which fall under the ePrivacy rules and the GDPR respectively in the EU.

Common questions

Answers to the questions practitioners most commonly ask about DNT.

Does a website have to honor Do Not Track signals?

In most jurisdictions, no. Do Not Track (DNT) is a voluntary browser signal, and there has generally been no broad legal mandate requiring websites to act on it. Because honoring the signal was left to each website's discretion and no consensus enforcement mechanism emerged, adoption was inconsistent and many sites ignored it. Some newer frameworks treat certain browser-based signals as legally meaningful in specific contexts, but that is distinct from the original DNT header, and the scope of any such obligation depends on the applicable law. You should not assume DNT alone satisfies consent or opt-out obligations under any particular regime.

Is Do Not Track the same as a valid cookie consent or opt-out mechanism?

Not inherently. DNT is a technical signal expressing a user preference against tracking, but on its own it typically does not constitute the freely given, specific, informed, and unambiguous consent required under EU law, nor does it automatically function as a recognized opt-out under US state privacy laws. Whether a browser-based signal carries legal weight depends on the specific framework and how that framework defines and treats such signals. DNT should be understood as a preference indicator rather than a complete consent or opt-out solution, and it does not replace a properly implemented consent management approach.

How does Do Not Track relate to newer signals like Global Privacy Control?

Both are browser-based signals communicating a user preference, but they differ in design intent and legal treatment. DNT was a general anti-tracking header without a widely adopted enforcement basis, whereas Global Privacy Control (GPC) was developed to express opt-out preferences that certain frameworks may treat as legally significant in specific contexts. Whether a given signal must be honored depends on the applicable law and how that law recognizes such signals. Organizations should evaluate each signal separately rather than assuming they are interchangeable or governed by the same obligations.

Should our website detect and respond to the DNT header?

Whether to detect and respond to the DNT header depends on your legal obligations and your organization's privacy posture. Because DNT has generally not carried a broad legal mandate, some organizations choose to honor it as a matter of policy while others do not. If you decide to respond to it, you should document how the signal is interpreted and what actions follow. This is a decision that should be made with legal input, since the treatment of browser signals differs across jurisdictions and continues to evolve.

If we honor DNT, do we still need a consent management platform?

Generally yes. Honoring DNT does not, on its own, satisfy the consent requirements that apply in most EU jurisdictions or the opt-out requirements under various US state laws. A consent management platform (CMP) supports functions such as presenting notice, capturing user choices, and logging consent records that DNT was not designed to provide. DNT can be one input a site chooses to consider, but it does not replace the broader consent or opt-out infrastructure. Note that a CMP supports compliance efforts but does not by itself guarantee compliance.

How should we document our handling of DNT signals?

It is generally advisable to record your organization's policy on DNT, including whether the signal is detected, how it is interpreted, and what technical response follows. Clear internal documentation helps demonstrate a consistent approach and supports accountability, particularly where record-keeping obligations apply under the relevant framework. Because the legal significance of DNT varies by jurisdiction and remains subject to evolving guidance, you should confirm with legal counsel how your documentation aligns with the specific obligations that apply to you.

Common misconceptions

Enabling Do Not Track legally prevents websites from tracking the user.

Responding to the DNT signal has generally been voluntary, and there is no broadly adopted requirement obligating operators to honor it. A DNT header may be ignored unless a particular website or jurisdiction chooses to give it effect.

A DNT signal satisfies EU consent obligations or removes the need for a consent banner.

Under EU law, the ePrivacy rules generally require prior consent before placing non-essential cookies or similar technologies, and valid GDPR consent must be a freely given, specific, informed, and unambiguous affirmative action. DNT is a preference signal, not affirmative consent, and does not by itself replace a compliant consent mechanism. Its treatment as an objection or opt-out depends on the applicable framework.

Do Not Track and Global Privacy Control are the same thing.

They are distinct browser signals developed at different times. DNT was a general, largely voluntary tracking-preference signal, while GPC is a more recent opt-out signal discussed in connection with certain US state privacy laws. Their legal significance differs, and one should not be assumed to carry the same weight as the other.

Best practices

Document how your systems detect and handle the DNT header, and do not assume the signal must be honored in the absence of an applicable legal requirement in the relevant jurisdiction.

Do not rely on a DNT signal as a substitute for a compliant consent mechanism; in most EU jurisdictions, obtain prior consent for non-essential cookies and similar technologies through a clear affirmative action.

Treat DNT and Global Privacy Control as separate signals, and evaluate each against the specific legal frameworks that may reference them rather than conflating the two.

Consult legal counsel or your data protection function on whether, and how, to give effect to browser preference signals, since interpretation and enforcement positions vary by region and may evolve.

Where you choose to honor DNT or similar signals, keep records of that decision and the technical implementation to support your accountability and record-keeping obligations.

Clearly describe in your privacy or cookie notice how your site responds to browser tracking-preference signals, so users understand the practical effect of enabling them.