News
GPC vs DNT Privacy Signals for Public Sites
January 20, 2024
GPC vs DNT for public sites is a privacy-signal decision: DNT (Do Not Track) is a legacy header most sites ignore, while Global Privacy Control (Sec-GPC) is the browser signal many US state privacy laws treat as a legally meaningful opt-out of sale or sharing. Honor GPC in your consent and ad stack if those laws apply. RoastMyOpsec does not score GPC or DNT as a standalone F; it is not a CMP auditor.
The practical difference
DNT: 1 asked sites not to track. There was never a consistent legal or industry requirement to obey it, and the W3C Tracking Preference Expression work did not become universal practice. GPC is a newer signal (Sec-GPC: 1 and a JS navigator.globalPrivacyControl) defined so that a user agent can express an opt-out that maps onto “do not sell/share” style rules.
Honoring GPC is a product and legal implementation: your tag manager, ad partners, and server-side analytics have to actually change behavior. Sending a marketing pixel anyway is the miss. DNT can still appear; treating it as equivalent to GPC without counsel is how teams write a privacy page that disagrees with the network tab.
These signals are not security headers like CSP. They do not stop XSS. They are preference flags. First-party analytics with a real opt-out is still a different architecture than a third-party tag blob.
How to choose based on what you shipped
If you run ads or “sale/share” of personal information into regions where GPC is recognized, wire Sec-GPC into the same path as your privacy-choice UI. If you only use first-party, cookieless, aggregate analytics, document that and still do not ignore GPC where the law says it counts. Do not advertise “we honor DNT” if the stack never did.
| Option | When it wins | Watch-out | Takeaway |
|---|---|---|---|
| Honor GPC (Sec-GPC) | You sell or share personal info in GPC-relevant jurisdictions | UI says opted out while pixels still fire | Wire it into the real consent path |
| DNT | Almost never as a sole control | Privacy policy that claims DNT without behavior | Legacy signal, weak practice |
| First-party analytics | You can answer product questions without ad pixels | Reintroducing a tag manager “just for one test” | Smaller blast radius |
| Ignore both | You have no tracking to honor — rare on marketing sites | Still loading third-party ad scripts | The scripts are the story |
When DNT still wins
DNT still wins only as a historical header you might log. GPC still wins as the signal to implement if sale/share opt-outs apply. Missing GPC handling is a privacy-program gap, not a RoastMyOpsec headers F. A site with no third-party pixels has less to honor.
Common mistakes
The first mistake is claiming you honor DNT or GPC in the privacy page while the tag manager ignores the header.
The second mistake is treating DNT as legally equivalent to GPC without checking the rules that apply to you.
The third mistake is expecting a URL roast to certify Global Privacy Control compliance.
What a URL roast can prove
RoastMyOpsec does not score GPC, DNT, JSON-LD, Open Graph, or AI crawler groups as standalone Fs. The free roast may still surface third-party tracker-shaped hosts in HTML, plus security headers, TLS, cookies, path probes, and js-secrets. Honor GPC in your own consent stack; use the roast for origin hygiene, not as a privacy-law audit.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Is DNT the same as GPC?
- No. DNT is a legacy Do Not Track header with weak adoption. GPC is a distinct opt-out signal many privacy regimes recognize.
- Does CSP replace honoring GPC?
- No. CSP restricts what the page may load. GPC is a preference about sale, sharing, and tracking behavior.
- Does RoastMyOpsec fail missing Sec-GPC handling?
- No. GPC is not a standalone F. Tracker-looking hosts in the document can still appear as tracker findings.