The "Do Not Track" (DNT) flag is an optional header field in HTTP requests sent by web browsers to web servers. It requests that the website not track the user, or not track the user across different websites (the ambiguity remains unresolved, according to Wikipedia).

The GDPR provides a number of lawful bases for processing personal data, one of which is consent. If a website is relying on consent for collecting data about the user, would it therefore be a breach of the law to ignore the user's expressed preference in the form of the DNT flag?

I ask because it seems that DNT is widely ignored, at least in the US. As I am in the EU, and have DNT set in my browser, I wonder if anyone who tracks me across the Web is thereby breaking the law.


According to the relevant Wikipedia article

There are no legal or technological requirements for the use of DNT. Websites and advertisers may either honor or ignore DNT requests. The Digital Advertising Alliance, Council of Better Business Bureaus and the Direct Marketing Association does not require its members to honor DNT signals. There are organizations such as DataNeutrality that are involved in setting DNT guidelines for private companies involved in data collection.

Microsoft itself does not obey the DNT header, stating "Because there is not yet a common understanding of how to interpret the DNT signal, Microsoft services do not currently respond to browser DNT signals." (Reference citations omitted)

The GDPR does not explicitly mention DNT. I know of no law or regulation, in the US or the EU (or indeed anywhere) which requires anyone to honor the DNT header. At this time it is a purely voluntary request, although many sites choose to honor it. That could change in the future.


It may be that they'll claim that their processing of behaviour that doesn't take place within the Union falls outside the Territorial Scope (Paragraph 2(b), Article 3, 2016/629) :

  1. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:

(a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or

(b) the monitoring of their behaviour as far as their behaviour takes place within the Union.

If they're not claiming that, it would be difficult to argue informed consent at the moment of opening a web page, so any site relying on that could do with a better legal advisor. Website Terms and Conditions could fall under (basis (b)), or they could claim legitimate interests that are not overridden (basis (f)), Article 6.

Depending what the data collected is, and how it's processed, there may also be an argument that at time of processing it doesn't specifically identify a particular Natural Person.

  • This answer seems to be correct as far as it goes, but does not answer the question's issue about the Do Not Track (DNT) header. Feb 22 '19 at 0:17
  • @DavidSiegel - Fair point. I'd edit, but there seems to be a fine answer covering that aspect... Feb 22 '19 at 8:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.