Do-Not-Track

When you visit a website, your program for browsing the web — the browser — automatically sends a few pieces of additional information to the provider of the site. This includes, for example, which program you are using and which language you prefer. Do-Not-Track was another such piece of information. It consisted of a single value and meant, roughly: Please do not collect data about my behavior. The user set this once in the settings, after which the request was automatically sent along with every page visit. The crucial word is please: the website could read the signal, but did not have to do anything about it.

A request without any teeth

Do-Not-Track emerged starting in 2009 from a real problem. Advertising networks track users across many sites and build profiles from this: what topics interest someone, what they might buy, how old they presumably are. This observation across site boundaries is called tracking. The idea was appealingly simple: instead of objecting on every single site, you say it once in the browser.

The catch lay not in the technology, but in the law. There was no law forcing websites to heed the signal. For advertising companies, heeding it meant immediately less revenue. So most simply ignored it. A traffic rule that nobody enforces is hardly followed — and that is exactly what happened.

The problem was made worse by the fact that Microsoft's browser Internet Explorer enabled the setting by default in 2012. This made it impossible to distinguish whether a user deliberately wanted this or had simply never changed it. The advertising industry used this as an argument to ignore the signal entirely. In 2019, the responsible working group of the web standards body W3C officially discontinued its work.

A value in the header

Technically, Do-Not-Track is about as simple as it gets. Every request to a website contains what is called a header, a kind of letterhead with additional information. Do-Not-Track inserts a line there: DNT with the value 1 for do not track. If the line is missing, the user is making no statement at all.

The website’s server reads this value and decides for itself what to do with it. It can turn off tracking, it can write a note in a log, it can discard the value. The browser has no way of checking what actually happens. This is exactly where Do-Not-Track fundamentally differs from an ad blocker: the blocker actively prevents the connection to the advertising network and needs no consent from the other side.

A common misconception is that Do-Not-Track makes you anonymous. The opposite can occur. Because only few users enable the setting, it makes their own browser somewhat more conspicuous. Together with screen size, fonts, and time zone, this creates a recognition pattern, the fingerprint. An additional characteristic tends to help with this rather than hinder it.

From a failed checkbox to GPC

You can still find the option in browser settings today in some cases, usually under privacy. Firefox and Safari have since removed it or significantly downgraded it, as it is considered ineffective. Instead, modern browsers block trackers directly — Safari with Intelligent Tracking Prevention, Firefox with enhanced tracking protection.

The idea itself is not dead, however. Its successor is called Global Privacy Control, or GPC for short, and works on the same principle. The decisive difference is legal: in California, GPC has been considered a legally valid objection to the sale of personal data since 2021. Companies must comply with it, or face penalties. In Germany, courts and data protection authorities are discussing something similar within the framework of the General Data Protection Regulation.

In the news, Do-Not-Track therefore usually appears as a cautionary tale. It shows that a good technical idea remains ineffective without legal enforcement. Anyone who wants less tracking today gets further with cookie settings, tracker blockers, and a privacy-conscious browser than with a checkbox that only sends a request.