Global Privacy Control, Do-Not-Track, and Consent Banners

Consent signals are where law and technology meet. Knowing which signal matters saves you effort and gives you actual legal standing.

Global Privacy Control (GPC) — use this

GPC is a browser signal that tells every site “do not sell or share my personal data.” Unlike its predecessor, GPC is legally enforceable: under California’s CPRA, a business must treat GPC as a valid opt-out of sale/sharing, and several other US state privacy laws (Colorado, Connecticut, and others) recognize it similarly. Sites subject to those laws are required to honor it.

How to turn it on:

• Firefox: Settings → Privacy & Security → check “Tell websites not to sell or share my data.”
• Brave: enabled by default.
• Chrome / Edge: no native toggle — install an extension that sends GPC (the Privacy Badger extension sends GPC, and some consent extensions do too).
• DuckDuckGo browser/extension: sends GPC by default.

GPC covers “sale” and “sharing” (which, under these laws, includes most cross-context advertising). It does not, by itself, stop first-party analytics or processing you’ve otherwise consented to.

Do-Not-Track (DNT) — effectively dead

DNT was the original “please don’t track me” header. It failed: there was never a legal requirement to honor it, almost no sites did, and major browsers have removed the setting. If you still see a DNT toggle, it does close to nothing in practice. Spend your effort on GPC instead.

Consent banners and “Reject All”

Cookie banners exist mainly because of the EU’s ePrivacy/GDPR regime (and increasingly US state laws). What the buttons do:

• “Reject All” should disable non-essential cookies and tags — analytics, advertising, personalization. On compliant sites it genuinely limits collection. On non-compliant sites it may do less than it claims, which is one of the things a data-collection audit reveals.
• “Accept All” turns everything on. The deliberately tedious “Manage preferences” flows are designed to make rejecting harder — dark patterns.
• Automate it: Consent-O-Matic answers banners with your “reject non-essential” preference automatically so you don’t have to.

The limit, again

A consent choice only binds collection that flows through the consent system. Server-side tracking a site performs outside that system isn’t governed by the banner you clicked, and you can’t see it from the browser. If you want to know what a specific site is actually collecting and sending — including the parts that ignore or bypass your consent — that requires auditing the site’s behavior directly, which is what ad.rip does.