What the DNT header actually does
When a browser has Do Not Track turned on, it adds a single line to every HTTP request it sends, DNT colon 1, before the page even loads. That is the entire mechanism. There is no enforcement built into the header itself, no blocking of scripts, no cookie prevention. It is a request, phrased as a flag, sent to a server that is free to read it, log it, or ignore it completely. Whether anything changes on the receiving end depends entirely on whether that site chose to write code that checks for the header and behaves differently when it is present, which the large majority of sites never did.
Why it failed, and it is a structural reason, not a popularity one
The usual explanation for why Do Not Track never worked is that "not enough sites respected it," which is true but skips the actual cause. The header was standardized around what a browser sends, but the working group responsible for defining what a compliant server does in response, the World Wide Web Consortium's Tracking Protection Working Group, never reached agreement on that half of the spec. Advertising industry representatives and privacy advocates could not agree on a definition of tracking itself, let alone on what an acceptable response looked like, and the group's charter eventually expired without a finished standard (which tells you most of what you need to know about how those talks went). The result is a header with a sender and no defined receiver behavior. A site could claim to honor DNT while doing almost anything, because there was never an agreed answer to what honoring it meant.
What replaced it
Global Privacy Control, usually written GPC, is the newer signal built to avoid the same failure. It is sent the same way, as a browser flag on outgoing requests, but it was designed from the start to map onto an existing legal right rather than a voluntary courtesy. California's CCPA and CPRA, along with privacy laws in Colorado and Connecticut, recognize a GPC signal as a valid method for a visitor to exercise their opt-out of sale or sharing of personal information, which means a site covered by those laws has an actual legal obligation to respond to it, not just a social expectation to. That gap, a signal backed by an enforceable right against one backed by nothing, is the entire reason GPC caught on where DNT never did.
DNT compared with what replaced and surrounded it
| Signal | What it signals | Legal weight | Current browser support |
|---|---|---|---|
| Do Not Track (DNT) | General preference not to be tracked | None in most jurisdictions, voluntary only | Removed from Safari, ignored by most sites where it survives |
| Global Privacy Control (GPC) | Opt-out of sale or sharing of personal information | Legally recognized under CCPA, CPRA, Colorado and Connecticut privacy laws | Built into Firefox and Brave, available as an extension elsewhere |
| Cookie consent banner | Explicit opt-in or opt-out to specific cookie categories | Required under EU ePrivacy Directive and UK PECR for non-essential cookies | Site-implemented, not a browser feature |
Does Do Not Track actually work
In practical terms, no, not as a way to stop tracking. Apple removed the Do Not Track setting from Safari in 2019, stating publicly that the header had become more useful as a way to fingerprint a browser, since so few users had it turned on that having it set made a visitor stand out, than as a genuine privacy tool. Chrome and Firefox still expose a DNT setting, but neither browser nor any regulator requires a site to change its behavior because of it. A handful of sites do check the header voluntarily, and some ad networks made early promises around it that were later dropped or scaled back. Treat the presence of a Do Not Track option in browser settings as a leftover, not a working control.
What to use instead
If reducing cross-site tracking is the actual goal, GPC is the signal with real backing behind it in the jurisdictions that recognize it, and it is worth turning on in Firefox or Brave, or installing as a browser extension elsewhere. For everything outside the reach of GPC's legal recognition, tracking prevention comes down to browser-level defaults, Safari's Intelligent Tracking Prevention and Firefox's Enhanced Tracking Protection block a meaningful share of third-party cookies regardless of any header, plus whatever a cookie consent banner actually offers on a given site. None of this is legal advice about what any specific site or business is required to honor. It is a map of which signals carry weight and which ones are decorative.
How this connects to click and campaign data
None of these signals block click tracking outright, and that is a common misreading. A DNT or GPC header does not stop a link from being clicked, does not stop a server from logging a referrer, and on its own does not stop a UTM-tagged campaign link from resolving. What it can affect, on sites that choose to respect it, is whether a cookie gets set or a third-party pixel fires afterward. A visitor who has GPC enabled and lands on a page through a tracked link will typically still show up in that page's own first-party analytics. First-party attribution and the opt-out signals GPC is legally tied to answer different questions. One is who sent the visit. The other is whether that visitor's data gets sold or shared onward. That distinction is exactly why a link-in-bio tool's own click count and a downstream ad platform's reported clicks can diverge once opt-out signals enter the picture, since each system may be reading, and reacting to, the header differently, a pattern covered in more depth in why click counts differ between tools.
A quick way to check what your own browser is sending
Most browsers surface this setting somewhere under privacy preferences, though the exact wording varies. Firefox and Brave expose Global Privacy Control directly and enable it by default in Brave. Chrome has never shipped a native DNT toggle in its main settings, leaving it to extensions. Checking what is actually being sent, rather than assuming a setting does what its label suggests, is a more reliable way to know your own tracking exposure than trusting the name of a checkbox.