webtracking.org · free tools

GPC & Do-Not-Track Signal Tester

See exactly which privacy signals your browser is sending right now — the legally enforceable Global Privacy Control and the dead Do-Not-Track flag — with a plain-English verdict and instructions for turning GPC on.

🔒 runs entirely in your browser — nothing is sent anywhere · works offline

checking…

Checking your GPC signal…

Why GPC matters: Global Privacy Control tells every site you visit "do not sell or share my personal data." Unlike Do-Not-Track, it is legally enforceable: under California's CPRA, a business must treat GPC as a valid opt-out of sale/sharing, and the Colorado and Connecticut privacy laws (among others) recognize it similarly. Sites subject to those laws are required to honor it.

GPC covers "sale" and "sharing" — which, under these laws, includes most cross-context advertising. It does not, by itself, stop first-party analytics or processing you've otherwise consented to. Full background: GPC, Do-Not-Track, and consent banners.

legacy signal

Do-Not-Track: checking…

DNT is effectively dead. It was the original "please don't track me" header, and it failed: there was never a legal requirement to honor it, almost no sites did, and major browsers have removed the setting. Whatever your browser reports above changes close to nothing in practice. GPC replaced it by fixing the fatal flaw — it attached a legal obligation to the signal instead of a polite request. Spend your effort on GPC.

What this page can and cannot see. GPC is transmitted two ways: a Sec-GPC: 1 request header on every request, and the JavaScript property navigator.globalPrivacyControl. A client-side page cannot read the headers of the request that fetched it — that would require a server echoing them back, and this tool deliberately talks to no server. So the verdict above reads the JS property and infers the header from it. In mainstream implementations the two are set together from the same preference, so the inference is usually reliable — but not always: an extension can add the Sec-GPC header without injecting the JS property, in which case this page under-reports. It is an inference, and this page is honest about that.

How to turn GPC on

Enable it, then reload this page to re-test. Settings below match our consent-signals guide.

Firefox built-in setting

Settings → Privacy & Security → check "Tell websites not to sell or share my data."

That single checkbox turns on both the Sec-GPC header and the JS property. Reload this page afterwards — the verdict at the top should flip to green.

Brave on by default

Brave sends GPC by default — there is nothing to configure. If this page shows GPC off in Brave, check that Shields are enabled in Settings → Shields.

DuckDuckGo browser / extension on by default

The DuckDuckGo browser and its browser extension send GPC by default.

Chrome & Edge extension required

Neither Chrome nor Edge ships a native GPC toggle. Install an extension that sends the signal — the Privacy Badger extension sends GPC, and some consent-management extensions do too.

After installing, reload this page: a GPC extension sets both the header and navigator.globalPrivacyControl, so the verdict here will reflect it.

Safari no native support

Safari has no built-in GPC setting, and the mainstream GPC extensions target Chromium and Firefox. On Apple platforms the practical route is to use a browser that ships GPC — Firefox, Brave, or DuckDuckGo — for the browsing you want covered by the opt-out.

Other readable signals

A few more privacy-relevant flags your browser exposes to every page. This tool deliberately does not fingerprint you: it reads only the handful of coarse flags below, renders them locally, and stores and transmits nothing.

SignalYour browserWhat it means
Raw values read by this page local only
Changed a browser setting? Most browsers apply GPC on the next page load — reload if re-checking shows no change.
next step

Your browser sends the signal.
ad.rip shows you which sites ignore it.

This page proves what you're broadcasting. It can't tell you whether the sites you visit actually honor it — that requires auditing what a site collects and where it sends it. That's what ad.rip does.