DNT might interact with two legal bases: consent and legitimate interests.
The DNT header can have three states:
1: do not track, object, opt-out (sometimes a default setting)
- (absent): no decision (usually the default setting)
0: user prefers to allow tracking
It is clear that
DNT: 0 cannot be GDPR-consent for tracking. While this would be an indication of the user's wishes to allow tracking, that is not sufficient to satisfy the GDPR criteria for consent. In particular, consent must be specific to a particular processing purpose. “Tracking” in general is too broad, since this doesn't distinguish between different kinds of tracking and tracking by different actors.
A more complex question is whether
DNT: 1 is an Art 21 GDPR objection to processing that was based on a legitimate interest. Objections via technical means are in principle valid, as noted by Stephan in another answer. However, there are a number of practical problems:
- “Tracking” is not further specified. It is possible that there would be substantial disagreement about whether a processing activity counts as tracking or not.
- While objections to direct marketing purposes are automatically valid, some forms of tracking are not done for marketing-related purposes.
- Objections shall be grounded on the data subject's individual circumstances. The DNT header does not provide sufficient nuance to account for this.
DNT: 1 is a system's default setting, it is possible that the presence of this header doesn't indicate that the data subject invoked their right to object.
Thus, I think that it can often be safe to ignore this header.
- If the header is absent or if
DNT: 0 is set, no conclusions can be drawn. This does not consitute consent or the lack of opt out.
- It is very likely safe to treat
DNT: 1 as an objection (opt-out). However, this might not be required.
DNT: 1 is set, it may arguably be OK to ignore this header. There is a risk to this, but it is currently the mainstream approach.
Due to the confusion about this header's meaning, it has effectively failed. Users cannot be expected to use this mechanism, and site operators cannot be expected to use this rarely-used technology. If site operators rely on legitimate interests as a legal basis, they should satisfy their GDPR obligation to offer an opportunity to object, by implementing such an opt-out as part of the website.
There are approaches such as Global Privacy Control to address the limitations of the failed DNT header. GPC is primarily designed to meet the requirements of the CCPA, though it also might indicate a GDPR Objection. By default, I think that GPC has limited use, because it fails to build consensus around what exactly this header is supposed to mean. However, the GPC mechanism is extensible, and those extensions might be useful to describe granular and mandatory choices around consent and objections in the future.