Do Not Track and Global Privacy Control: on or off?

Last checked: 14 Oct 2026 (browsers, cookies, ad IDs); legal section 28 Sep 2026; three pages combined 6 Nov 2026

Short answer: both are browser settings that send every website a request. Global Privacy Control (GPC) asks websites not to sell or share your data, and some US states require businesses to respect it. Do Not Track is the older request: websites can ignore it, Mozilla says many do, and Mozilla says it can sometimes reduce your privacy (why).

Edge: you can turn Do Not Track on. Microsoft says sites "may still track your activities" when it's sent. Edge has no GPC setting.
Firefox: Do Not Track has gone (version 135, February 2025). Turn on GPC instead; it's already on in private windows.
Safari: neither setting. Safari removed Do Not Track in 2019 and limits tracking across websites by default instead.
Brave, DuckDuckGo, Tor Browser and Mullvad Browser: they send GPC automatically, so there's nothing to do.

Each browser at a glance

Browser	Sends Do Not Track?	Sends GPC?	On by default?	Where the switch is
Microsoft Edge	If you turn it on	No setting	No	Settings → Privacy, search, and services
Firefox (computer)	No (removed in version 135)	Yes	GPC on in private windows; off in normal windows	Settings → Privacy and security
Firefox (Android)	No	Yes	GPC on in private tabs; off in normal tabs	Settings → Enhanced Tracking Protection
Safari (Mac, iPhone, iPad)	No (removed in 2019)	No setting	Its own cross-site tracking limit is on	Safari settings → Privacy
Brave	Has a setting, off by default	Yes (computer and Android); a more limited version on iPhone and iPad	GPC on	Nothing to do
DuckDuckGo browser	No setting	Yes	On	Nothing to do
Tor Browser and Mullvad Browser	Not described	Yes	On	Nothing to do
Chrome and Opera	Not covered here	No setting	n/a	No built-in GPC setting
Samsung Internet	Unverified	Unverified	Unverified	No current Samsung page found

Why websites don't have to honour Do Not Track

Do Not Track was never agreed as a rule websites must follow. The group that was writing the standard stopped work in 2019, because not enough websites or browsers had taken it up. No browser maker says websites must act on it, and Mozilla says many don't. Mozilla says it can sometimes reduce your privacy, and Apple removed it because having it switched on is one more detail that can help websites recognise your browser (see fingerprinting).

GPC is a newer draft standard from the same web standards body. Whether a site has to act on it depends on where you are (see what the law says). Some companies say in their own privacy notices that they honour it; for example, Microsoft says it receives and responds to the GPC signal. For website developers, the signal's technical name is Sec-GPC.

Each browser in detail

Microsoft Edge (Windows and Mac)

Settings and more → Settings → Privacy, search, and services → Privacy → Send "Do Not Track" Requests

Off by default. Microsoft says the requests "let the websites you visit know that you don't want your browsing activity to be tracked", and that websites may still track you. Edge has no GPC setting.

Its separate tracking prevention setting, in the same section, has three levels: Basic, Balanced (recommended) and Strict. Microsoft says Strict may stop some websites working as expected. All three levels block fingerprinting Microsoft judges harmful; Microsoft says fingerprinters it considers "non-malicious" aren't blocked. Settings and more → Settings → Privacy, search, and services → Tracking prevention

Firefox

Firefox removed the Do Not Track setting in February 2025 (version 135). Use "Tell websites not to sell or share my data" instead, which sends GPC (Mozilla). On a computer (Firefox 120 and later): Settings → Privacy and security → Additional protections → Tell websites not to sell or share my data

On Android (Firefox 122 and later): Settings → Enhanced Tracking Protection → Tell websites not to share & sell data Mozilla says it's already on in private windows on a computer (source) and in private tabs on Android (source).

Cookies and fingerprinting: Firefox limits third-party cookies by default (Mozilla) and blocks known fingerprinting companies. Stronger fingerprinting protection, which limits what Firefox reveals, is on in private windows and in Strict mode (Mozilla). To use it in all windows: Settings → Privacy & Security → Enhanced Tracking Protection → Custom → Suspected fingerprinters then choose all windows. Mozilla says this may stop some websites working properly.

Safari (Mac, iPhone and iPad)

Apple removed Do Not Track from Safari in March 2019 (Safari 12.1), and Safari has no GPC setting. Instead, Safari limits tracking across websites, including third-party cookies, by default. To check it's on:

On a Mac: Safari → Settings → Privacy → Prevent cross-site tracking

On an iPhone: Settings → Apps → Safari → Prevent Cross-Site Tracking

Apple says it's on by default, and turning it off lets companies track you from one website to another.

Greyed out? If an organisation manages the iPhone, iPad or Mac (a work or school device, for example), it can lock this setting on so you can't change it. We haven't found an Apple source for any other cause.

Fingerprinting on a Mac: Apple says Safari always shows websites a simplified version of your Mac's setup, so it "looks more like everyone else's Mac". A stronger setting is on by default in Private Browsing. To use it for all browsing: Safari → Settings → Advanced → Use advanced tracking and fingerprinting protection (source)

Fingerprinting on iPhone and iPad: Apple says Private Browsing adds protections against advanced fingerprinting. We haven't found an Apple page giving the setting for all browsing, so we don't list one.

Brave

Brave says it sends GPC automatically on computers and Android phones (Brave help). On iPhone and iPad it sends a more limited version that websites have to look for. Brave also has a Do Not Track setting, off by default, but Brave doesn't publish where to find it.

Fingerprinting protection is on already: Brave adds "a small amount of randomness" to what it reveals.

DuckDuckGo browser

DuckDuckGo says it sends GPC automatically, so there's nothing to do, though it may turn it off on sites where it breaks things. On its iPhone, iPad, Android and Mac apps, the full request goes only to websites known to respect it; other sites get a more limited version. It has no Do Not Track setting.

Fingerprinting protection is on already: DuckDuckGo makes some browser features return less useful information.

Tor Browser and Mullvad Browser

Both send GPC by default (Tor Browser's default settings), so there's nothing to do. Tor Browser also tries to make its users look alike, to protect against fingerprinting.

Samsung Internet: Unverified

We didn't find a current page from Samsung about a Do Not Track or GPC setting in its Samsung Internet browser.

What the law says

We haven't found a UK or US law that makes websites act on Do Not Track. California makes some websites say in their privacy policy how they respond to it, but they don't have to obey it. GPC is different.

United States

California: businesses that sell or share personal information must process opt-out signals (regulations), and the Attorney General says GPC must be honoured as a valid request. From 1 January 2027, the Opt Me Out Act (AB 566) requires browsers to include a setting consumers can switch on to send an opt-out signal.
Colorado: since 1 July 2024, businesses in scope must let consumers opt out of sale and targeted advertising using GPC, the only universal opt-out the Attorney General recognises. It doesn't accept Do Not Track.
Connecticut (since 1 January 2025, source) and Oregon (since 1 January 2026, source): businesses must honour opt-out signals such as GPC.
California's privacy agency says it's one of about a dozen states that require businesses to honour such signals. Each covers residents of that state, and the GPC draft standard notes that many states don't accept signals that are switched on by default.

United Kingdom

There's no official regulator position on GPC. The UK GDPR says you can exercise your right to object "by automated means using technical specifications", so a signal like GPC may count as an objection in principle, but no regulator or court has said so. The regulator's April 2026 cookie guidance says websites must not rely solely on browser settings as consent. You can always tell a company directly to stop using your data for marketing: see the right to object.

European Union

The GDPR has the same "automated means" wording. A European Commission proposal (the Digital Omnibus) would require websites to accept machine-readable choices and large browser makers to support them, but on 28 September 2026 it was still awaiting a committee decision in the European Parliament.

Cookies, advertising IDs and fingerprinting, in brief

Websites and apps use three main ways to recognise the same browser, phone or TV again. They usually work with a random-looking number rather than your name or email address.

Cookie: a small piece of text a website saves in your browser and gets back next time, to remember things like your login, basket or language. Mozilla says websites can only store personal details in a cookie if you've given them those details. A third-party cookie comes from a different company whose content is on the page, such as an advert, a video or a share button; because that content appears on many websites, its cookie can recognise your browser on all of them, which Mozilla calls cross-site tracking. "Tracking cookie" isn't a legal term; the ICO, the UK's data protection regulator, says cookies can be used for "tracking users' browsing behaviour".
Advertising ID: a long random-looking code a phone or TV makes for apps to use for ads instead of your name. You can reset it, delete it or stop apps seeing it (table below).
Fingerprinting: your browser tells each website details such as screen size, language, time zone, fonts and browser version so pages display properly. The ICO says together they can "uniquely identify a particular device". Nothing is saved on your device, so clearing cookies doesn't remove a fingerprint. It has other uses too: the ICO gives detecting fraudulent log-ins as an example, and Brave notes that games, maps and editing tools use some of the same browser features. Mozilla and Apple both list your add-ons and installed fonts among the details it uses. No browser maker says it can stop all fingerprinting; each browser's protection is in its card above.

A website must ask before using cookies (and similar technology) that aren't essential to the service you asked for. The ICO's guidance says:

refusing must be as easy as accepting, and it shows equally clear "accept all" and "reject all" buttons as good practice
if you ignore the banner, the site must not use them: "Silence or inactivity doesn't qualify"
cookies for advertising always need your agreement, and a website "must also get consent if you are using device fingerprinting techniques for online advertising purposes" (ICO)

Some cookies don't need your agreement, such as ones that keep you logged in or remember your basket. The US consumer regulator's guide doesn't describe a rule like this; it suggests choosing the cookie option that suits you. In the UK, you can report a website's cookie use to the ICO.

Advertising IDs on phones and TVs

Device	What the maker says it is	Your settings
iPhone and iPad	Apple: "an alphanumeric string that's unique to each device". If you don't let an app track you, it gets all zeros instead.	iPhone ad settings
Android	"a unique, user-resettable and user-deletable ID for advertising". If you delete it, apps get a string of zeros.	Android ad settings
Samsung TVs	The PSID: "a randomised, non-persistent, and resettable device identifier" (Samsung UK).	Samsung TV settings guide
Roku	"unique, non-permanent, identifiers" (Roku).	Roku settings guide
Fire TV	"a user-resettable, unique identifier" (Amazon).	Fire TV settings guide

What a reset does: Samsung says data linked to your old ID "will no longer be used in the delivery of ads to you"; Roku says the old IDs "will no longer be used to display personalized ads". Google and Amazon's rules for app makers say they mustn't link a new ID to the old one without your consent. These are company rules, not something your device can enforce. Resetting doesn't affect fingerprinting. LG TVs also have an ad ID you can reset, but LG doesn't say how it's made: see the TV settings guides.

Apps: Apple doesn't allow iPhone apps to fingerprint: "Regardless of whether a user gives your app permission to track, fingerprinting is not allowed." It says apps that do it may be rejected from the App Store (Apple). Amazon's rules for Fire TV apps also forbid using fingerprinting for interest-based ads (Amazon).

Is a random ID "personal information"?

UK: UK data protection law covers information about someone who can be identified "directly or indirectly", including by "an online identifier". The ICO lists advertising IDs, cookie IDs and device fingerprints as identifiers that may be personal data, and says: "You do not need to hold an individual's name in order to identify them."
California: the CCPA counts "cookies, beacons, pixel tags, mobile ad identifiers" as identifiers that can be personal information. It also covers identifying someone as "more probable than not" from pieces of information, which, in our reading, includes fingerprinting.

So both things are true: these IDs are usually just numbers, and the law can still give you rights over them, such as the right to object in the UK.

Sources

This page describes your options and how organisations say they handle requests. It isn't legal advice. See About & sourcing, or report a correction.