Global Privacy Control and Do Not Track

OctoDoc's post-v1.0 read-link design would read one privacy signal only: the Sec-GPC request header. Where its field value is the single character 1, the telemetry question would be treated as already answered no, the consent interstitial would not render, and the document would still open without per-page dwell, scroll depth, country, referrer host, or user-agent family being recorded.

The Do Not Track header is not read. It is not weighted, not stored as a preference, and not used to infer anything about a visitor. The two headers sit a line apart in the same HTTP request and are a decade apart in standing.

The asymmetry is not a judgement about which privacy preference is more sincere. It is a difference in what each specification defines on the receiving side, and in whether a named regulator has published a position on it.

The Global Privacy Control specification is published by the W3C. Its status section states: "This document was published by the Privacy Working Group as a Working Draft using the Recommendation track." Its abstract describes the signal as one "that conveys a person's request to websites and services to not sell or share their personal information with third parties".

The header is narrow by design. The field name is Sec-GPC and the grammar admits exactly one field value, Sec-GPC-field-value = "1". The specification then places a normative requirement on the receiving side: a server processing a request that carries a Sec-GPC header is directed to ignore that header and process the request as if it had not been specified, unless the field value is exactly the character 1. That sentence is quoted in full in the sources below. There is no range of intensities and no negotiation. The value is present and exactly 1, or it carries nothing.

The specification defines the preference in prose as well as in grammar. A do-not-sell-or-share preference arises when a person requests that their data not be sold or shared, for instance by activating a Global Privacy Control setting with their user agent, or by using tools that default to such a setting; the closing parenthetical attributes that default to the setting matching the most common expectations of the tool's users. The full sentence, parenthetical included, is quoted in the sources below. The parallel DOM surface is navigator.globalPrivacyControl, which the specification says "enables a client-side script to determine what Sec-GPC header field value was sent when loading the top-level browsing context's active document".

The introduction bounds the signal rather than inflating it: "However, while the Global Privacy Control is designed to allow users to express a preference to opt out of sharing and cross-context targeted advertising, the control is not intended to exercise every possible privacy right, nor even every right to opt out of advertising or ad targeting." It adds: "GPC is not designed to exercise deletion rights, for example."

On the W3C maturity ladder the two documents do not rank the way the rest of this page might suggest. GPC is a Working Draft. Do Not Track reached Candidate Recommendation before its working group concluded. The distinction this page turns on is not maturity: it is that one specification defines what a receiving server does with the header and is named on a regulator's page, and the other does neither.

Do Not Track was specified as the Tracking Preference Expression, in which the value 1 meant "This user prefers not to be tracked on this request." That document is now a W3C Working Group Note dated 17 January 2019, and its Status of This Document section records why: "Since its last publication as a Candidate Recommendation, there has not been sufficient deployment of these extensions (as defined) to justify further advancement, nor have there been indications of planned support among user agents, third parties, and the ecosystem at large."

The consequence follows in the same section: "The working group has therefore decided to conclude its work and republish the final product as this Note, with any future addendums to be published separately."

Mozilla's MDN reference marks the header Deprecated and Non-standard, records that "The DNT (Do Not Track) specification has been discontinued", and names the successor: "DNT is deprecated in favor of Global Privacy Control, which is communicated to servers using the Sec-GPC header, and accessible to clients from navigator.globalPrivacyControl."

A header whose specification defines no handling rule for the receiving server leaves the receiving system to invent one. An invented rule is difficult to describe precisely two years later in front of someone who disputes the record. The post-v1.0 OctoDoc design therefore keeps DNT out of its planned proof file and reading log.

The California Attorney General's CCPA page describes the mechanism in its own words as "a 'stop selling or sharing my data switch' that is available on some internet browsers, like Mozilla Firefox, Duck Duck Go, and Brave, or as a browser extension", and states: "Under law, it must be honored by covered businesses as a valid consumer request to stop the sale or sharing of personal information."

The same page lists it among acceptable methods: "For businesses that collect personal information from consumers online, one acceptable method for consumers to opt-out of sales or sharing is via a user-enabled global privacy control, like the GPC."

California AB 566, titled "California Consumer Privacy Act of 2018: opt-out preference signal.", moves the signal down into the browser layer. Its operative text reads: "A business shall not develop or maintain a browser that does not include functionality configurable by a consumer that enables the browser to send an opt-out preference signal to businesses with which the consumer interacts through the browser." The bill also states: "This section shall become operative on January 1, 2027."

The post-v1.0 design is intended to honour the signal from its first release. Nothing on this page is a statement about any particular organisation's obligations; it describes what the cited texts say and a planned product posture.

In the post-v1.0 design, not reading DNT would cost a visitor nothing because the default state is already the state DNT asks for. Consent-conditional telemetry would run only after an affirmative, versioned, hashed consent event.

What Sec-GPC: 1 additionally buys is the removal of the question. The interstitial is an interruption in front of a document someone was sent to read, and a standing opt-out expressed in a specification with a defined rule for the receiving server is a reason not to interrupt at all.

This is why the signal gates the interstitial rather than gating a downstream write. Gating the write would still record that the question was asked. Gating the interstitial means the browser answered before the first page byte, and the record says so.

Nobody wants to read the contract. OctoDoc is being built so you do not have to: write a document from a prompt, ask plain-language questions about the one you were sent, and keep every one of them in a single place instead of four accounts and an inbox.

Anyone can check a sealed file with no account.

Unlimited human sends on the paid tier.