Remember Do Not Track? Neither do publishers. The little HTTP header that could—DNT for short—promised users a way to wave off trackers with a polite “no thanks.” It flopped hard. Websites ignored it, ad tech laughed it off, and by 2019, it was a digital relic. Enter Global Privacy Control (GPC), the shiny new signal touted as DNT’s successor. Backed by California’s privacy law, it’s supposed to force publishers to respect your opt-out. Sounds great, right? Here’s the catch: GPC has no more bite than DNT ever did. Publishers can sidestep it by simply doing business outside California’s reach—and they will. History says so - Google did it.
DNT’s Ghost Haunts GPC
Do Not Track was a noble experiment. Flip a browser setting, send a “DNT: 1” header, and presto— trackers were supposed to back off. Except they didn’t. Studies pegged compliance at under 25% among major sites; the rest kept harvesting data like nothing changed. Why? It was voluntary. No fines, no jail time—just a gentle nudge publishers could ignore. Google’s Chrome didn’t even bother supporting it fully. DNT died because it lacked teeth.
GPC struts in with a California swagger, tied to the California Consumer Privacy Act (CCPA). In the Golden State, businesses collecting data from residents must honor GPC as a legit opt-out for data sales. Legal muscle! Problem is, that muscle only flexes within California’s borders. Step outside—or shrink your California footprint—and GPC’s power fades fast. It’s DNT with a regional twist, not a global fix. Publishers know this. They’ve seen this movie before.
Jurisdiction’s Limits: The Escape Hatch
The CCPA sounds tough. If you collect Californians’ data and hit certain thresholds—$25 million in revenue, 100,000 residents’ data, or half your cash from selling it—you’re on the hook. GPC becomes your leash. But what if you don’t play in California’s sandbox? A Texas-based blog with a Southern readership might barely brush those thresholds. An overseas ad network might not care at all. Suddenly, GPC’s a suggestion, not a command.
Enforcement? Good luck. California’s Attorney General can chase big fish—think Facebook or Google—but a mid-tier publisher in Ohio or Estonia? That’s a jurisdictional slog. Legal action across state lines is slow; across borders, it’s a pipe dream. Look at environmental laws: states struggle to nail out-of-state polluters without federal help. Privacy’s no different. Publishers can dodge GPC by staying out of reach, betting Sacramento won’t bother knocking. DNT taught them ignoring signals is low-risk, high-reward.
Profit Over Privacy: Why Comply?
Data’s the lifeblood of digital publishing. Tracking users—where they click, what they buy—fuels targeted ads and fat profits. DNT asked publishers to ditch that for user goodwill. They didn’t. GPC ups the ante with CCPA fines, but only in California. Elsewhere, the math’s the same: comply and lose revenue, or ignore and keep cashing in. Why pick the former?
Take Google. As of July 1, 2023, it stopped playing “service provider” under CCPA for some ad tools like Customer Match. No more restricted data processing—just a shift to call it “sharing,” dumping opt-out duties on advertisers. Smart, not illegal. If Google can tweak its game to skirt the spirit of GPC, smaller publishers won’t hesitate to ignore it outright. Data’s too juicy, and the risk’s too low.
Defanging the Counterarguments
Sure, GPC’s cheerleaders have their pitch. Let’s knock it down.
- “It Could Go Global!” They dream of Colorado, Virginia, even GDPR lands adopting GPC, spreading its reach. Maybe. But DNT aimed global too—and crashed. Without universal enforcement (good luck with that), publishers in lax spots will keep collecting data, laws be damned.
- “California’s Clout Matters!” The state’s economic heft forces compliance, they say. Big brands bow to avoid legal heat. True—for giants. Smaller fry with slim California ties can slip by. CCPA’s nabbed high-profile scalps, but the long tail of publishers? Untouched.
- “Users Will Demand It!” Privacy nerds might push GPC, shaming non-compliers. Cute thought. DNT had its fans too; 20% of U.S. users turned it on. Publishers didn’t flinch. Profit trumps pressure when wallets are on the line.
The Verdict
GPC’s a California dream sold as a global savior. It’s DNT in fancier clothes—same weak core, just a shinier badge. Publishers ignored one toothless signal; they’ll ignore this one too, especially where California’s arm can’t stretch. Enforcement’s spotty, incentives favor tracking, and jurisdiction’s a sieve. Until privacy gets federal fangs—or a global sheriff with real guns—GPC’s bite won’t match its bark. History doesn’t lie: publishers play by their rules, not ours.
A Requiem for Privacy Signals
I mourn DNT’s demise—and GPC’s coming fall. These signals should work. I’ve even built software to make DNT compliance dead simple for publishers running Joomla (System - Do Not Track), stripping away excuses. Yet they ignore it, chasing dollars over decency. Users want control, but publishers see data as theirs to hoard. This greed’s a ticking bomb. GPC’s failure will spark more laws like CCPA—blunt, mandatory rules that choke us all. Freedom fades when regulators step in because publishers won’t. We lose not just privacy, but choice. DNT deserved better; GPC does too. Too bad profit wrote their obituaries.
