How Chromium Handles Do Not Track and Global Privacy Control

This article provides a technical overview of how the open-source Chromium web browser processes user-requested privacy preferences, specifically focusing on Do Not Track (DNT) headers and Global Privacy Control (GPC) signals. While Chromium provides built-in settings for users to broadcast the older DNT request to websites, it lacks native support for the newer, legally binding GPC signal, requiring users to rely on browser extensions or modified Chromium forks to transmit the request.

Do Not Track (DNT) Handling

Chromium natively supports the Do Not Track standard, even though the World Wide Web Consortium (W3C) officially disbanded the DNT working group and deprecated the standard in 2019. By default, the DNT setting in Chromium is turned off.

When a user manually navigates to Chromium's privacy settings and enables the "Send a 'Do Not Track' request with your browsing traffic" toggle, the browser alters its network behavior in two specific ways:

  1. HTTP Header Injection: Chromium's network stack automatically appends the DNT: 1 header to all outgoing HTTP and HTTPS requests, including main document loads, subresources, and third-party scripts. If the user disables the setting, Chromium does not send DNT: 0; instead, it simply omits the header entirely to minimize fingerprinting data.
  2. JavaScript Property Exposure: Chromium updates the Document Object Model (DOM) to reflect the user's choice. When scripts query the navigator.doNotTrack property, Chromium returns the string "1". If the setting is disabled, it returns null.

Chromium does not enforce DNT. It merely acts as a messenger. Once the DNT: 1 header leaves the browser, it is entirely up to the receiving web server to honor or ignore the request. Because there is no legal mandate forcing websites to respect DNT, most websites ignore this signal.

Global Privacy Control (GPC) Handling

Global Privacy Control (GPC) was created to replace DNT as a legally enforceable signal under frameworks like the California Consumer Privacy Act (CCPA) and Europe's GDPR. It functions similarly to DNT by asking websites not to sell or share personal data.

Despite GPC's growing legal recognition, base Chromium does not natively support the GPC signal. There is no built-in toggle in the standard Chromium settings menu to turn GPC on or off.

Technically, the GPC specification requires a browser to send the Sec-GPC: 1 HTTP header and return true when a website queries the navigator.globalPrivacyControl JavaScript property. Because base Chromium lacks this feature, querying navigator.globalPrivacyControl in an unconfigured Chromium browser returns undefined.

How Users Send GPC Signals in Chromium

Because the core Chromium project has not implemented native GPC support, users who wish to broadcast this signal must rely on workarounds within the Chromium ecosystem. Chromium handles these workarounds in two ways:

1. Browser Extensions

In standard Chromium, users must install third-party privacy extensions (such as OptMeowt, Privacy Badger, or DuckDuckGo Privacy Essentials) to send GPC signals. When a user requests GPC via an extension, Chromium handles the request through its Extension APIs:

  • Network Modification: The extension uses Chromium's declarativeNetRequest API. This instructs the Chromium network stack to intercept outgoing web traffic and append the Sec-GPC: 1 header before the request reaches the server.
  • DOM Modification: Because declarativeNetRequest only handles network headers, the extension must also inject a content script into every webpage before the page's own scripts load. This content script manually defines the navigator.globalPrivacyControl property and sets its value to true.

2. Chromium Forks

Because Chromium is open-source, other browser developers can modify its underlying C++ source code. Privacy-focused browsers built on Chromium—most notably Brave—have manually patched the Chromium network stack and the V8 JavaScript engine. In these modified versions of Chromium, the Sec-GPC: 1 header and the JavaScript property are hardcoded into the browser and enabled by default, functioning identically to how base Chromium handles DNT.

Summary of Differences

When requested by the user, Chromium's handling of these two privacy signals comes down to native integration versus API reliance:

  • Do Not Track: Handled natively by the Chromium engine. Flipping the built-in switch alters the core network stack to send DNT: 1 and updates the navigator object automatically.
  • Global Privacy Control: Ignored natively by the Chromium engine. Sending the Sec-GPC: 1 header requires hijacking the network stack via Chromium's extension APIs or using a third-party browser that has altered the base Chromium source code.