Is it legal to ignore "Do Not Track" for data subjects who fall under the GDPR?

Question

The "Do Not Track" (DNT) flag is an optional header field in HTTP requests sent by web browsers to web servers. It requests that the website not track the user, or not track the user across different websites (the ambiguity remains unresolved, according to Wikipedia).

The GDPR provides a number of lawful bases for processing personal data, one of which is consent. If a website is relying on consent for collecting data about the user, would it therefore be a breach of the law to ignore the user's expressed preference in the form of the DNT flag?

I ask because it seems that DNT is widely ignored, at least in the US. As I am in the EU, and have DNT set in my browser, I wonder if anyone who tracks me across the Web is thereby breaking the law.

Answer 1

DNT might interact with two legal bases: consent and legitimate interests.

The DNT header can have three states:

• 1: do not track, object, opt-out (sometimes a default setting)
• (absent): no decision (usually the default setting)
• 0: user prefers to allow tracking

It is clear that DNT: 0 cannot be GDPR-consent for tracking. While this would be an indication of the user's wishes to allow tracking, that is not sufficient to satisfy the GDPR criteria for consent. In particular, consent must be specific to a particular processing purpose. “Tracking” in general is too broad, since this doesn't distinguish between different kinds of tracking and tracking by different actors.

A more complex question is whether DNT: 1 is an Art 21 GDPR objection to processing that was based on a legitimate interest. Objections via technical means are in principle valid, as noted by Stephan in another answer. However, there are a number of practical problems:

• “Tracking” is not further specified. It is possible that there would be substantial disagreement about whether a processing activity counts as tracking or not.
• While objections to direct marketing purposes are automatically valid, some forms of tracking are not done for marketing-related purposes.
• Objections shall be grounded on the data subject's individual circumstances. The DNT header does not provide sufficient nuance to account for this.
• When DNT: 1 is a system's default setting, it is possible that the presence of this header doesn't indicate that the data subject invoked their right to object.

Thus, I think that it can often be safe to ignore this header.

• If the header is absent or if DNT: 0 is set, no conclusions can be drawn. This does not consitute consent or the lack of opt out.
• It is very likely safe to treat DNT: 1 as an objection (opt-out). However, this might not be required.
• If DNT: 1 is set, it may arguably be OK to ignore this header. There is a risk to this, but it is currently the mainstream approach.

Due to the confusion about this header's meaning, it has effectively failed. Users cannot be expected to use this mechanism, and site operators cannot be expected to use this rarely-used technology. If site operators rely on legitimate interests as a legal basis, they should satisfy their GDPR obligation to offer an opportunity to object, by implementing such an opt-out as part of the website.

There are approaches such as Global Privacy Control to address the limitations of the failed DNT header. GPC is primarily designed to meet the requirements of the CCPA, though it also might indicate a GDPR Objection. By default, I think that GPC has limited use, because it fails to build consensus around what exactly this header is supposed to mean. However, the GPC mechanism is extensible, and those extensions might be useful to describe granular and mandatory choices around consent and objections in the future.

Answer 2

The GDPR actually does require you to follow DNT in Article 21:

5. In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may exercise his or her right to object by automated means using technical specifications.

I think this is quite explicit.

Answer 3

It may be that they'll claim that their processing of behaviour that doesn't take place within the Union falls outside the Territorial Scope (Paragraph 2(b), Article 3, 2016/629) :

2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:

(a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or

(b) the monitoring of their behaviour as far as their behaviour takes place within the Union.

If they're not claiming that, it would be difficult to argue informed consent at the moment of opening a web page, so any site relying on that could do with a better legal advisor. Website Terms and Conditions could fall under (basis (b)), or they could claim legitimate interests that are not overridden (basis (f)), Article 6.

Depending what the data collected is, and how it's processed, there may also be an argument that at time of processing it doesn't specifically identify a particular Natural Person.

Answer 4

According to the relevant Wikipedia article

There are no legal or technological requirements for the use of DNT. Websites and advertisers may either honor or ignore DNT requests. The Digital Advertising Alliance, Council of Better Business Bureaus and the Direct Marketing Association does not require its members to honor DNT signals. There are organizations such as DataNeutrality that are involved in setting DNT guidelines for private companies involved in data collection.

Microsoft itself does not obey the DNT header, stating "Because there is not yet a common understanding of how to interpret the DNT signal, Microsoft services do not currently respond to browser DNT signals." (Reference citations omitted)

The GDPR does not explicitly mention DNT. I know of no law or regulation, in the US or the EU (or indeed anywhere) which requires anyone to honor the DNT header. At this time it is a purely voluntary request, although many sites choose to honor it. That could change in the future.