DNT stands for Do Not Track, an HTTP request header a browser attaches to outbound requests to tell every server it reaches that the person operating the browser objects to being tracked across sites. The field carries one character. A value of 1 signals a preference not to be tracked on that request; 0 signals consent; when no preference has been set, the header is absent. It existed because the alternative around 2010 was a separate opt-out cookie at every ad network, a system that broke whenever cookies were cleared. DNT collapsed hundreds of scattered opt-outs into one checkbox. What it never carried was any obligation.

The W3C specification, Tracking Preference Expression, defines the field tersely: DNT-field-value = ( "0" / "1" ) *DNT-extension, with at most one DNT header allowed per request. Enabled, it adds eight bytes to every HTTP request a browser makes, including requests for embedded images, scripts and ad tags.

Two rules shaped everything that followed. A user agent must default to unset, because the specification argues that a preconfigured DNT:1 would "violate the field's semantics, make its presence in a request meaningless, and add eight extra bytes to every HTTP request (with no effect)." And intermediaries are barred from touching it, so an internet service provider may not inject DNT:1 on behalf of subscribers who never asked.

Two companion mechanisms sit alongside the header. Navigator.doNotTrack lets page scripts read the value without a server round trip. A promise-based exceptions API records consent as [site domain, target domain] pairs scoped by cookie domain rules, with an optional lifetime in seconds, so a publisher could obtain consent and send DNT:0 to its named vendors while DNT:1 continued elsewhere.

The half of the standard almost nobody deployed was the response half. Servers were meant to publish a machine-readable status at /.well-known/dnt/, served as application/tracking-status+json, and answer individual requests with a Tk header.

That status is one case-sensitive character: ! under construction, ? dynamic, G gateway, N not tracking, T tracking, Ctracking with prior consent, P tracking only if consent is later confirmed, D disregarding the signal outright, and U for a status that just changed. The P value carried a deadline, promising deletion or permanent de-identification of DNT:1 data within forty-eight hours if consent could not be established. A server unwilling to serve a DNT:1 visitor at all was directed to return HTTP 409.

The G value was written for programmatic. It describes a server acting as a gateway to an exchange involving multiple parties, where a response "involves an automated selection process, such as dynamic bidding." A gateway had to forward the preference to every party receiving data, hold contracts ensuring only the winning party could retain tracking data from a DNT:1 request, and return a status-id identifying that party. Exchanges were asked to reconcile a dozen bidders' compliance postures into one character inside the auction window.

The header survives in programmatic plumbing regardless. The OpenRTB Device object carries dnt, defined as the standard Do Not Track flag as set in the header by the browser, where 0 means tracking is unrestricted and 1 means do not track. Section 2.7 of the specification still lists do not track header status among the privacy features OpenRTB supports.

Beside it sits lmt, the Limit Ad Tracking signal endorsed by mobile platforms, using the same encoding. The two exist separately because of a dispute on the openrtb-dev mailing list, where David Hernandez argued against reusing dnt for mobile opt-outs since it was meant to indicate what the browser sent, adding that there was "some disagreement as to whether DNT signals are really honoured or not." Others replied that they already derived dnt from the iOS and Android flags. MoPub's integration guide told bidders dnt was set to 1 on every request. A buyer seeing dnt=1 cannot reliably tell whether a browser header, a device setting, or exchange policy produced it.

Regulatory signals moved elsewhere. The Regs object carries coppa, gdpr, us_privacy, gpp and gpp_sid, the last two holding the Global Privacy Platform consent string and the applicable section identifiers.

Christopher Soghoian and Sid Stamm built a prototype Firefox add-on in July 2009, and the FTC's December 2010 privacy report called for a do-not-track system. Mozilla shipped support in Firefox 4 on 22 March 2011, eight days after Internet Explorer 9. Safari followed in July 2012, Chrome that November.

The W3C chartered the Tracking Protection Working Group in 2011. It never resolved what "tracking" meant. When the Digital Advertising Alliance walked out in September 2013, its stated reasons were that the group had failed to define the harm it sought to prevent, failed to define tracking, and failed to determine the effect of user choice.

The rupture came earlier, over defaults. Microsoft turned DNT on in the express setup path for Internet Explorer 10 and Windows 8. On 7 September 2012 Roy Fielding, a co-editor of the specification, committed a patch making the Apache HTTP Server ignore DNT from IE10 entirely; it was commented out a month later. Microsoft reversed the default on 3 April 2015.

Tracking Preference Expression reached Candidate Recommendation in August 2015 and again in October 2017. On 17 January 2019 the working group closed, republishing its work as Notes citing insufficient deployment. Apple removed the setting from Safari 12.1 that March, arguing an unusual DNT value adds entropy to a browser fingerprint. Mozilla removed it from Firefox 135 on 4 February 2025, stating that many sites do not respect it and that in some cases it can reduce privacy. Chrome and Microsoft Edge still ship the setting, off by default.

Two statutes attached consequences without requiring compliance. California's AB 370, signed 27 September 2013 and effective 1 January 2014, amended the California Online Privacy Protection Act to require operators to disclose how they respond to browser do-not-track signals. It mandated disclosure, not honour, with fines up to $2,500 per violation. Delaware later adopted a comparable duty.

That disclosure requirement produced the one ruling giving DNT force. LinkedIn published a notice stating it did not use DNT signals because the standard was not commonly adopted. The Federation of German Consumer Organisations sued, arguing the notice misled users because objection to processing under the GDPR may be made by automated means. The Regional Court of Berlin agreed in case 16 O 420/19, ruling on 31 August 2023. The court barred the statement rather than ordering LinkedIn to honour the signal, and LinkedIn appealed.

Global Privacy Control appeared in 2020 with a narrower design and a legal hook. It carries a single value rather than two, minimising fingerprinting surface, travels as a Sec-GPC header or DOM property, and lets sites declare support at /.well-known/gpc.json. Unlike DNT, GPC is already legally binding in five US states: California since January 2021, Colorado since July 2024, Connecticut since January 2025, New Jersey since July 2025 and Oregon since January 2026. Roughly 388,000 sites publicly supported it as of 5 April 2026. The California Attorney General's $1.55 million settlement with Healthline.com, the largest CCPA penalty to date, cited data sharing that continued after users sent GPC signals.

Ad tech has wired it in. Adform announced GPC support in July 2024. Google triggers Restricted Data Processing from GPC signals in Delaware and Oregon, after rollouts across eight states and three more in late 2025. California's AB 566, signed 8 October 2025 and operative 1 January 2027, will require every browser sold to California residents to include the functionality, putting Chrome, Safari and Edge in scope.

The circularity is the core criticism. Browsers withdrew the setting because sites ignored it; sites ignored it partly because browsers kept it off by default, leaving volumes low and authenticity uncertain. The specification concedes in its privacy considerations that "the DNT signal alone does nothing to enhance a user's privacy."

Authorities still disagree on whether the header carries legal weight. The W3C treats the standard as concluded. The Berlin court treated an activated setting as a valid automated objection under the GDPR, and a German ruling holding third-party cookie providers liable without consent points the same way. The European Commission's Digital Omnibus proposes an Article 88b GDPR giving machine-readable signals statutory footing, though Europe's data protection supervisors pushed back on 10 February 2026, part of a wider set of GDPR amendments proposed in Brussels. For supply-side operators the residue is a bid request field whose provenance is unverifiable and whose meaning was never settled.

DNT and GPC. Both are browser signals. DNT expressed a general objection to cross-context tracking with no statutory backing. GPC objects to the sale or sharing of personal information and to cross-context ad targeting, is enforceable under several state laws, and omits the opt-in value, so it cannot signal consent.

DNT and LMT. Limit Ad Tracking is a device-level setting from Apple and Google, surfaced as lmt, enforced by platform policy rather than the browser. Apple's App Tracking Transparency, introduced with iOS 14.5, superseded the original toggle with a per-app prompt.

DNT and the us_privacy or GPP strings. These are payloads generated by a consent management platform and carried in the Regs object, encoding what a user chose under a named legal regime. DNT is a raw header with no jurisdictional context.

DNT and tracking protection. Intelligent Tracking Prevention in Safari and Enhanced Tracking Protection in Firefox block or partition storage without asking. DNT asked and waited.

• July 2009: Christopher Soghoian and Sid Stamm build a prototype DNT add-on for Firefox
• December 2010: the FTC privacy report calls for a do-not-track mechanism
• 14 March 2011: Internet Explorer 9 ships with DNT support
• 22 March 2011: Firefox 4 ships with DNT support
• 21 to 22 September 2011: the W3C Tracking Protection Working Group holds its first face-to-face meeting
• July 2012: Safari 6 adds DNT
• 7 September 2012: Roy Fielding patches Apache HTTP Server to ignore DNT from Internet Explorer 10; reverted 9 October 2012
• November 2012: Chrome 23 adds DNT
• 27 September 2013: California AB 370 signed, effective 1 January 2014
• September 2013: the Digital Advertising Alliance quits the W3C working group
• 3 April 2015: Microsoft stops enabling DNT by default
• August 2015: Tracking Preference Expression reaches Candidate Recommendation
• October 2017: a second Candidate Recommendation is published
• 17 January 2019: the working group closes; the specification is republished as a Note
• 25 March 2019: Safari 12.1 removes the setting
• October 2020: Global Privacy Control is announced
• 31 August 2023: the Regional Court of Berlin rules against LinkedIn in case 16 O 420/19
• 4 February 2025: Firefox 135 removes the setting
• 8 October 2025: California AB 566 signed, operative 1 January 2027
• 5 April 2026: roughly 388,000 sites publicly declare GPC support

• GPC could cut EU consent banners but law must catch up first covers the May 2026 peer-reviewed study comparing GPC with DNT and mapping the signal against GDPR and the ePrivacy Directive.
• Adform now supports Global Privacy Control signals in browsers reports the demand-side platform's July 2024 adoption of the successor signal.
• Google activates privacy controls in Delaware and Oregon via GPC signals documents Restricted Data Processing being triggered automatically by browser signals.
• Google expands privacy controls to eight additional US states sets out the earlier state-by-state rollout of the same mechanism.
• Google quietly adds three states to privacy compliance toolkit tracks the further expansion of GPC-linked controls in late 2025.
• German court holds third-party cookie providers liable without consent covers a ruling extending liability for consentless tracking in Germany.
• Europe's privacy watchdogs reject Commission's plan to narrow GDPR protections reports the EDPB and EDPS joint opinion on the Digital Omnibus.
• Brussels proposes sweeping GDPR changes to benefit AI developers covers the package containing the proposed Article 88b on automated privacy signals.

Who: Proposed by researchers Christopher Soghoian and Sid Stamm, standardised at the W3C by editors Roy Fielding of Adobe and David Singer of Apple, implemented by every major browser vendor, and largely ignored by publishers, ad networks and the Digital Advertising Alliance.

What: A one-character HTTP request header, paired with a DOM property, an exceptions API, a Tk response header and a machine-readable tracking status resource, through which a user expressed a preference against cross-context tracking and a server described how it responded.

When: Prototyped in July 2009, shipped by browsers from March 2011, abandoned as a standards effort on 17 January 2019, removed from Safari in March 2019 and from Firefox in February 2025. It remains present in Chrome and Edge and in the OpenRTB Device object.

Where: In HTTP requests from browsers to origin servers, in the device.dnt field of OpenRTB bid requests, and in the privacy policy disclosures that California and Delaware still require.

Why: Compliance was voluntary, the working group never agreed a definition of tracking, a default-on implementation destroyed confidence that the signal reflected a real choice, and an enabled header added fingerprinting entropy. Its successor, Global Privacy Control, carries the statutory backing DNT lacked, which is why browser-level opt-out signals now matter commercially in a way DNT never did.