Check GPC and DNT before storing attribution data

GPC and DNT are different signals

Global Privacy Control communicates a request not to sell or share a person's data. Supporting browsers expose the value through navigator.globalPrivacyControl and send the corresponding Sec-GPC: 1 request header. The JavaScript property still has limited browser availability, so a missing or false value is not proof that a person made an affirmative choice.

Do Not Track uses navigator.doNotTrack. MDN marks it deprecated and non-standard, and the underlying specification was discontinued. Attribution Tracker still treats the value "1" as a conservative reason not to store attribution automatically.

Neither signal replaces a consent manager or settles every legal question. They express different preferences, and their effect depends on the data use and applicable rules.

Put the decision in one callback

If your site already has a consent manager, combine its decision with the privacy signals in one function. This example assumes window.cookieConsent is kept current by that manager.

<script src="https://cdn.jsdelivr.net/gh/jasenf/attribution-tracker.js@v0.1.1/dist/attribution-tracker.js"></script>
<script>
  const hasAttributionConsent = () => {
    if (navigator.globalPrivacyControl === true) return false;
    if (navigator.doNotTrack === '1') return false;
    return window.cookieConsent === true;
  };

  let tracker;
  function syncAttributionConsent() {
    if (!hasAttributionConsent()) {
      tracker?.clear();
      tracker = undefined;
      return;
    }

    tracker = new AttributionTracker({
      consent: hasAttributionConsent
    });
  }

  syncAttributionConsent();
  // Call syncAttributionConsent() from the consent manager's change callback.
</script>

The callback is intentionally authoritative. Attribution Tracker checks an explicit consent boolean or callback before its automatic GPC, DNT, global variable, and consent-cookie detection. If your callback should honor GPC or DNT, include those checks in the callback as shown.

When consent is withdrawn, clear() removes this library's cookie or session-storage value. It cannot remove copies that your application already sent elsewhere, so apply the same decision before adding attribution to a form, analytics event, or backend request.

Test the decision paths

Run these cases in the browsers and consent-manager configuration your site supports:

• No consent decision: the tracker should store nothing.
• globalPrivacyControl === true: the callback should return false even if a consent cookie says allow.
• doNotTrack === "1": the callback should return false.
• No blocking signal and an affirmative consent decision: the tracker should store the first-touch values.
• Consent withdrawn after capture: the change callback should run clear().

If the visitor leaves before granting consent, browser-only code cannot recover the earlier landing URL on a later visit. That is the consequence of not storing data before the decision is known.

Keep the handoff narrow

Landing-page URLs, referrers, click IDs, and custom query parameters can contain identifying or sensitive values. Send only the fields the destination needs. The form attribution guide uses a four-field allowlist instead of posting the complete stored object.

Client-side checks cover this library's browser storage. A server that needs to respond to GPC must handle the Sec-GPC request header separately. Review the GPC specification, the MDN GPC reference, and the MDN DNT reference for the current platform behavior. This guide describes the library's behavior and is not legal advice.