Is it legal to ignore &quot;Do Not Track&quot; for data subjects who fall under the GDPR?
<p>The "<a href="https://en.wikipedia.org/wiki/Do_Not_Track" rel="nofollow noreferrer">Do Not Track</a>" (DNT) flag is an optional header field in HTTP requests sent by web browsers to web servers. It requests that the website not track the user, or not track the user across different websites (the ambiguity remains unresolved, according to Wikipedia).</p>

<p>The GDPR provides a number of <a href="https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/" rel="nofollow noreferrer">lawful bases</a> for processing personal data, one of which is consent. If a website is relying on consent for collecting data about the user, would it therefore be a breach of the law to ignore the user's expressed preference in the form of the DNT flag?</p>

<p>I ask because it seems that DNT is <a href="https://gizmodo.com/do-not-track-the-privacy-tool-used-by-millions-of-peop-1828868324" rel="nofollow noreferrer">widely ignored</a>, at least in the US. As I am in the EU, and have DNT set in my browser, I wonder if anyone who tracks me across the Web is thereby breaking the law.</p>

<p>The GDPR actually does require you to follow DNT in Article 21:</p>
<blockquote>
<ol start="5">
<li>In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may exercise his or her right to object by automated means using technical specifications.</li>
</ol>
</blockquote>
<p>I think this is quite explicit.</p>

<p>DNT might interact with two legal bases: <em>consent</em> and <em>legitimate interests</em>.</p>
<p>The DNT header can have three states:</p>
<ul>
<li><code>1</code>: do not track, object, opt-out (sometimes a default setting)</li>
<li>(absent): no decision (usually the default setting)</li>
<li><code>0</code>: user prefers to allow tracking</li>
</ul>
<p>It is clear that <code>DNT: 0</code> cannot be GDPR-<strong>consent</strong> for tracking. While this would be an indication of the user's wishes to allow tracking, that is not sufficient to satisfy the GDPR criteria for consent. In particular, consent must be <em>specific</em> to a particular processing purpose. “Tracking” in general is too broad, since this doesn't distinguish between different kinds of tracking and tracking by different actors.</p>
<p>A more complex question is whether <code>DNT: 1</code> is an Art 21 GDPR objection to processing that was based on a <strong>legitimate interest</strong>. Objections via technical means are in principle valid, <a href="https://law.stackexchange.com/a/90002">as noted by Stephan in another answer</a>. However, there are a number of practical problems:</p>
<ul>
<li>“Tracking” is not further specified. It is possible that there would be substantial disagreement about whether a processing activity counts as tracking or not.</li>
<li>While objections to direct marketing purposes are automatically valid, some forms of tracking are not done for marketing-related purposes.</li>
<li>Objections shall be grounded on the data subject's individual circumstances. The DNT header does not provide sufficient nuance to account for this.</li>
<li>When <code>DNT: 1</code> is a system's default setting, it is possible that the presence of this header doesn't indicate that the data subject invoked their right to object.</li>
</ul>
<p>Thus, I think that it can often be safe to ignore this header.</p>
<ul>
<li>If the header is absent or if <code>DNT: 0</code> is set, no conclusions can be drawn. This does not consitute consent or the lack of opt out.</li>
<li>It is very likely safe to treat <code>DNT: 1</code> as an objection (opt-out). However, this might not be required.</li>
<li>If <code>DNT: 1</code> is set, it may arguably be OK to ignore this header. There is a risk to this, but it is currently the mainstream approach.</li>
</ul>
<p>Due to the confusion about this header's meaning, it has effectively failed. Users cannot be expected to use this mechanism, and site operators cannot be expected to use this rarely-used technology. If site operators rely on legitimate interests as a legal basis, they should satisfy their GDPR obligation to offer an opportunity to object, by implementing such an opt-out as part of the website.</p>
<p>There are approaches such as <a href="https://globalprivacycontrol.org/" rel="nofollow noreferrer">Global Privacy Control</a> to address the limitations of the failed DNT header. GPC is primarily designed to meet the requirements of the CCPA, though it also might indicate a GDPR Objection. By default, I think that GPC has limited use, because it fails to build consensus around what exactly this header is supposed to mean. However, the GPC mechanism is extensible, and those extensions might be useful to describe granular and mandatory choices around consent and objections in the future.</p>

<p>It may be that they'll claim that their processing of behaviour that doesn't take place within the Union falls outside the Territorial Scope (Paragraph 2(b), Article 3, <a href="https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&amp;from=EN" rel="nofollow noreferrer">2016/629</a>) :</p>

<blockquote>
  <ol start="2">
  <li>This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not
  established in the Union, where the processing activities are related
  to:</li>
  </ol>
  
  <p>(a) the offering of goods or services, irrespective of whether a
  payment of the data subject is required, to such data subjects in the
  Union; or</p>
  
  <p>(b) the monitoring of their behaviour as far as their behaviour takes
  place within the Union.</p>
</blockquote>

<p>If they're not claiming that, it would be difficult to argue informed consent at the moment of opening a web page, so any site relying on that could do with a better legal advisor. Website Terms and Conditions could fall under (basis (b)), or they could claim legitimate interests that are not overridden (basis (f)), Article 6.</p>

<p>Depending what the data collected is, and how it's processed, there may also be an argument that at time of processing it doesn't specifically identify a particular Natural Person.</p>

gdpr website