What Is Do Not Track (DNT)? The Privacy Signal That Makes You More Trackable

Do Not Track is a browser privacy feature that sends an HTTP header asking websites not to track you. It was well-intentioned — but it backfired in a way almost nobody anticipated. Enabling DNT can make your browser more identifiable, not less. You can see your own DNT status and full browser fingerprint right now on whatsmy.fyi.

TL;DR

Do Not Track (DNT) sends an HTTP header telling websites you prefer not to be tracked. Most sites ignore it — the W3C abandoned the standard in 2019 after a decade of failed adoption. Worse, because so few users enable DNT, having it turned on makes your browser statistically unusual, which increases your fingerprint entropy and makes you easier to identify. The successor, Global Privacy Control (GPC), faces the same structural problem.

What Is Do Not Track (DNT)?

Do Not Track is a browser setting that adds an HTTP request header — DNT: 1 — to every page request you make. When set, it signals to the receiving server that you prefer not to have your activity tracked across websites. When disabled, the browser either sends DNT: 0 (explicitly allowing tracking) or omits the header entirely (no preference stated).

JavaScript can read the same preference via navigator.doNotTrack, which returns "1", "0", or null. That single property is enough to read your DNT preference from any webpage — no server log required.

The idea originated at the Electronic Frontier Foundation in 2009 and was endorsed by the US Federal Trade Commission in 2010. Firefox and Safari both shipped support in 2011, and the W3C formed a Tracking Protection Working Group to standardise the protocol. For a moment, it looked like online privacy had a real technical solution.

It did not. The DNT initiative is a textbook case of how a browser fingerprinting signal can be introduced with the best of intentions and become a privacy liability.

How Does the DNT Header Work?

DNT is a pure opt-in signal. The browser adds it to HTTP requests; the server reads it and is expected (under the voluntary standard) to adjust its behaviour accordingly. There is no technical enforcement — it is a polite request, not a technical barrier.

// The HTTP request header sent when DNT is enabled
DNT: 1

// Reading DNT preference in JavaScript
const dntEnabled = navigator.doNotTrack === '1';
// Returns true if user has opted out of tracking

// Some browsers expose it differently
// (legacy inconsistency)
const dnt =
  navigator.doNotTrack ||       // Standard
  window.doNotTrack ||          // IE / Edge legacy
  navigator.msDoNotTrack;       // Very old IE

// What a tracking script sees
console.log(navigator.doNotTrack);
// "1"  → user opted out
// "0"  → user opted in to tracking
// null → no preference set

The header is visible to every server and every script that runs on a page. It costs nothing to read. And here is the problem: reading it is perfectly legitimate and indistinguishable from honoring it — a tracker can read your DNT preference and then track you anyway.

Why DNT Failed — and Why the W3C Abandoned It

The W3C Tracking Protection Working Group disbanded in January 2019 after nearly a decade of work produced no enforceable standard. The reasons were structural:

• Voluntary compliance only. No law in the US, EU, or elsewhere required websites to honour the DNT signal. The Digital Advertising Alliance explicitly told its members they were not obligated to comply.
• No agreement on what "tracking" means. Stakeholders spent years arguing over whether first-party analytics, fraud detection, and frequency capping counted as tracking. The working group never reached consensus.
• Browsers shipped it before the spec was ready. Microsoft controversially enabled DNT by default in Internet Explorer 10, which the advertising industry argued invalidated the signal — a default-on preference cannot represent a genuine user choice, they argued.
• Major platforms simply ignored it. Google never supported DNT in any meaningful way. Facebook disabled DNT support. Most ad networks continued tracking regardless of the header.

Apple removed DNT from Safari 12.1 in 2019, citing an ironic but decisive reason: the DNT header had itself become a fingerprinting variable that could be used to track users. Firefox removed the preference UI in version 135 (2025). The feature is now a historical curiosity — still technically present in some browsers, but functionally dead.

The Irony: DNT as a Fingerprinting Signal

This is where the story turns against the users who were trying to protect themselves. Browser fingerprinting works by combining many small signals into a unique identifier. The more unusual any single signal is, the more entropy it adds to the fingerprint — and the more identifiable you become.

DNT is enabled by only a small minority of users. In typical website traffic, between 8% and 12% of visitors have DNT enabled. That means having DNT on immediately puts you in a minority group. A fingerprinting script that reads navigator.doNotTrack now knows something specific and unusual about your browser that most browsers do not share.

Combined with your OS, browser version, installed fonts, screen resolution, timezone, language settings, and GPU data, the DNT signal increases the overall uniqueness of your fingerprint. You tried to hide, and instead you waved a flag.

This is not a hypothetical concern. Apple's engineering team cited it explicitly when removing DNT from Safari. The W3C Fingerprinting Guidance document explicitly lists user preference signals as a fingerprinting surface. Research showed that 96% of websites that received a DNT header continued collecting fingerprint-quality data regardless.

DNT Adoption and Compliance: The Numbers

Who Uses DNT in the Real World?

Websites That Honoured DNT

A small number of consumer platforms committed to honouring the DNT signal. Medium and Pinterest implemented DNT support, stopping behavioural tracking for users who opted out. Twitter announced limited DNT compliance in 2012, committing not to collect browsing data on third-party sites for users with DNT enabled.

These commitments were notable precisely because they were rare. No advertising network and no major data broker implemented DNT compliance. The companies that did comply tended to have subscription-based revenue models where tracking was not central to the business.

Websites That Ignored DNT

Google never implemented meaningful DNT support across its advertising infrastructure, despite shipping the header option in Chrome. Facebook formally abandoned its DNT commitment in 2018. Most ad-tech platforms — including the real-time bidding infrastructure that powers programmatic advertising — continued operating without any DNT consideration.

Fraud Detection and Security

Security platforms such as Fingerprint (formerly FingerprintJS) use browser signals for fraud detection and bot prevention. For these platforms, the DNT header is one data point among dozens — it informs the fingerprint but does not exempt a browser from analysis. GDPR's legitimate interest basis typically covers fraud prevention even when DNT is set.

Global Privacy Control: DNT's Successor

Global Privacy Control (GPC) is a newer privacy signal introduced in 2020, sending the Sec-GPC: 1 HTTP header. Unlike DNT, GPC has legal teeth in some jurisdictions: California's CCPA and CPRA recognise GPC as a valid opt-out of the sale of personal data, and the California Attorney General has taken enforcement action against sites that ignored it.

However, GPC faces the same fundamental fingerprinting problem as DNT. The navigator.globalPrivacyControl property is readable by any JavaScript running on a page, and having GPC enabled is unusual enough to add entropy to your fingerprint. The pattern repeats: a privacy signal designed to reduce tracking becomes a tracking signal in its own right.

Brave Browser and Firefox with privacy.resistFingerprinting enabled both support GPC. DuckDuckGo's browser and browser extension also send GPC by default. Enforcement and adoption are meaningfully better than DNT achieved, but the underlying tension between "expressing a privacy preference" and "being identifiable by that preference" remains unresolved.

How to Protect Yourself

The most effective approaches avoid the fingerprinting trap that DNT fell into — they normalise your browser rather than flagging it as unusual.

• Do not rely on DNT: Enabling DNT on a standard browser provides no meaningful privacy protection today and may slightly increase your fingerprint uniqueness. Turn it off if your browser still exposes the setting.
• Use Brave Browser: Brave randomises fingerprint signals per session and per site (a technique called Farbling), making tracking unreliable without flagging your browser as unusual. See the canvas fingerprinting guide for how Farbling works in detail.
• Use Tor Browser for maximum anonymity: Tor normalises every fingerprint signal — including navigator.doNotTrack — so that all Tor users appear identical. The trade-off is browsing speed.
• Enable Firefox's privacy.resistFingerprinting: This flag in about:config normalises many fingerprint signals including DNT, user agent, screen dimensions, and canvas output. It is the most effective fingerprint protection available in a mainstream browser.
• Use the EFF's Privacy Badger: Since websites do not honour DNT voluntarily, the EFF's Privacy Badger extension detects and blocks trackers through behavioural analysis — it enforces privacy technically rather than relying on a signal that trackers can ignore.
• Understand what signals you expose: Check your current browser fingerprint on whatsmy.fyi to see which signals — including DNT status — are visible to every site you visit.

Frequently Asked Questions

Does enabling Do Not Track actually stop tracking?

No, not in practice. DNT is a voluntary signal with no technical enforcement. Research found that approximately 96% of websites that received a DNT header continued collecting tracking data. The W3C formally abandoned the standard in 2019 after reaching no enforceable agreement. Enabling DNT is the digital equivalent of putting a "no junk mail" sticker on your letterbox — polite, but legally and technically unenforceable in most countries.

Why did Apple remove Do Not Track from Safari?

Apple removed DNT from Safari 12.1 in March 2019, explicitly citing the risk that the DNT setting had itself become a fingerprinting variable. Because a minority of users enable DNT, having it set makes your browser statistically distinctive. Apple concluded that the privacy cost of keeping DNT — increased fingerprint entropy — outweighed any benefit from the ignored signal.

What is the difference between DNT and Global Privacy Control?

Both are HTTP headers that express a tracking opt-out preference. The key difference is legal enforceability: California's CCPA and CPRA explicitly recognise GPC (Sec-GPC: 1) as a valid opt-out signal, making non-compliance legally actionable in California. DNT had no legal backing anywhere. GPC also has better browser support from privacy-focused browsers than DNT achieved at its peak.

Can a website read my DNT preference without me visiting it?

No. DNT is sent as an HTTP header in each browser request and is only accessible to the server receiving that specific request. However, any JavaScript loaded on a page you do visit can read navigator.doNotTrack immediately, before any user interaction — the same as any other browser property used in fingerprinting.

Does DNT affect GDPR consent requirements?

No. Under GDPR, the legal basis for processing personal data is separate from any browser-level signal. GDPR requires either explicit consent (via a cookie banner or equivalent mechanism), a legitimate interest assessment, or another specified legal basis. A DNT header does not constitute GDPR-valid consent withdrawal, nor does it override a legitimate interest basis. GDPR compliance requires a compliant consent mechanism, not a browser preference header.

Does disabling DNT make me harder to fingerprint?

Marginally, yes — because the majority of browsers do not send DNT, having it disabled (or absent) makes that one signal less distinctive. But this is a minor effect. Your browser fingerprint consists of dozens of signals — screen resolution, timezone, GPU data, canvas output, audio fingerprint, and more. Turning off DNT alone has negligible practical impact compared to using Brave or enabling privacy.resistFingerprinting in Firefox.

Is Global Privacy Control (GPC) also a fingerprinting risk?

Yes, by the same logic. navigator.globalPrivacyControl is a boolean property readable by any page script, and having it set to true is unusual — only browsers with explicit GPC support (Brave, Firefox with the flag, DuckDuckGo) send it. GPC has stronger legal backing than DNT ever did, so the trade-off is more favorable, but the underlying fingerprinting exposure exists. Browsers like Brave mitigate this by normalising many signals simultaneously rather than exposing an unusual preference in isolation.

Related Articles

• What Is Browser Fingerprinting? How Sites Track You Without Cookies — the complete guide to all fingerprinting signals combined
• What Is Browser Language Fingerprinting? How Your Language Settings Track You — how another "preference signal" becomes a tracking vector
• What Is Canvas Fingerprinting? How Websites Track You Without Cookies — the high-entropy GPU rendering signal that DNT cannot protect against
• What Is Audio Fingerprinting? How AudioContext Tracks Your Browser — how your device's audio stack produces a unique identifier