Introduction
*Updated for 2026 compliance practices.*
When you operate a website that serves visitors from the European Economic Area, every tracking mechanism you deploy must be disclosed transparently. The phrase “include do not track info privacy policy” captures a practical compliance topic for website owners validating consent, tags, and disclosures. This guide explains what it means, why it matters under the General Data Protection Regulation (GDPR), and how you can implement it correctly—without relying on generic templates. We focus on technical verification steps you can perform today, and we show how GDPRChecker’s scanning tools help you close disclosure gaps before they become compliance risks.
This guide provides technical implementation guidance, not legal advice. Always consult a qualified privacy professional for your specific situation. Official sources referenced include the European Data Protection Board and GDPR.eu.
What Is “Include Do Not Track Info Privacy Policy”?
“Include do not track info privacy policy” refers to the practice of clearly stating in your privacy policy how your website responds to the Do Not Track (DNT) browser signal, and more broadly, how you handle user tracking preferences. While DNT is a voluntary HTTP header that browsers can send, the GDPR requires you to be transparent about all tracking activities, regardless of whether you honor that specific signal. This means your privacy policy must explain what trackers you use, what data they collect, the legal basis for processing, and how users can exercise their rights.
From a practical standpoint, website owners often overlook this because DNT is not a legally binding mechanism under the GDPR. However, regulators expect transparency about tracking technologies. If your site uses analytics, advertising pixels, social media embeds, or any other tags that set cookies or access device storage, your privacy policy must disclose them. The ePrivacy Directive (the “cookie law”) works alongside the GDPR to require prior consent for non-essential trackers. Therefore, including Do Not Track information is part of a broader obligation to inform users about tracking and to respect their choices.
GDPR Requirements for Disclosing Tracking Information
Under the GDPR, transparency is a core principle (Article 5). You must provide information about the processing of personal data in a concise, transparent, intelligible, and easily accessible form (Articles 12–14). When it comes to tracking, this means your privacy policy should:
- List all cookies, pixels, and similar technologies you use.
- Explain the purpose of each tracker (e.g., analytics, advertising, functional).
- State the legal basis for processing (consent, legitimate interest, or contractual necessity).
- Describe how users can manage their preferences, including how to withdraw consent.
- Clarify whether you respond to browser Do Not Track signals and, if not, what alternative mechanisms you provide.
The EDPB guidelines emphasize that consent must be informed, specific, and freely given. If your privacy policy is silent about tracking, consent obtained through a cookie banner may be invalid because users were not adequately informed. This is a common gap we see in scans: a banner that asks for consent, but a privacy policy that fails to mention half the trackers actually deployed.
How to Implement Do Not Track Disclosures Step by Step
Implementing proper Do Not Track disclosures involves both documentation and technical configuration. Follow these steps to align your privacy policy with your actual tracking landscape.
1. Audit Your Trackers
Before you can disclose anything, you need a complete inventory. Use a scanner like GDPRChecker to crawl your site and identify all cookies, pixels, and network requests. Pay special attention to:
- Third-party scripts (Google Analytics, Meta Pixel, LinkedIn Insight Tag, etc.)
- Tag manager containers (Google Tag Manager, Adobe Launch)
- Social media plugins and embedded content
- A/B testing tools and heatmaps
Document each tracker’s name, provider, purpose, duration, and whether it sets first-party or third-party cookies.
2. Draft Clear Policy Language
Your privacy policy should include a dedicated section on tracking technologies. Avoid legal jargon. Use plain language to explain:
- What tracking technologies you use and why.
- How users can control them (browser settings, opt-out links, consent banner).
- Your stance on Do Not Track: “Our website does not respond to Do Not Track signals at this time. However, you can manage your tracking preferences through our cookie consent banner and browser settings.”
If you honor DNT, describe exactly what happens when the signal is detected (e.g., “When we receive a DNT:1 header, we automatically disable all non-essential cookies and trackers.”).
3. Link Your Policy to Your Consent Banner
Your cookie consent banner must include a clearly visible link to your privacy policy (or cookie policy). This link should be present before the user makes any choice. GDPRChecker scans verify that the policy link is accessible and not hidden behind interactions. The banner text might say: “We use cookies to improve your experience. By clicking ‘Accept All’, you consent to our use of cookies. Learn more in our Privacy Policy.”
4. Configure Your Consent Management Platform (CMP)
If you use a consent management platform, ensure it accurately reflects the trackers listed in your policy. Many CMPs allow you to categorize trackers (necessary, analytics, marketing). The categories in your CMP should match the descriptions in your privacy policy. Any discrepancy can confuse users and regulators.
5. Test Pre-Consent Behavior
A critical compliance point is that non-essential trackers must not fire before the user gives consent. Use GDPRChecker’s pre-consent request check to see if any tags load prematurely. If they do, adjust your tag manager triggers or CMP configuration. This is especially important for Google tags if you use Google Consent Mode.
Common Mistakes and How to Avoid Them
Many website owners make the same errors when trying to include Do Not Track info in their privacy policy. Here are the most frequent ones and how to prevent them.
Mistake 1: Copy-Pasting a Generic Policy
A generic privacy policy that doesn’t reflect your actual trackers is worse than no policy at all—it creates a false sense of compliance. Always customize your policy based on a real scan of your site.
Mistake 2: Ignoring Pre-Consent Network Requests
Even if your banner works correctly, some tags may fire on page load before the CMP script executes. This is a common issue with hard-coded tags or misconfigured Google Tag Manager triggers. Use a scanner to detect these early requests.
Mistake 3: Not Updating the Policy After Changes
Every time you add a new marketing pixel or analytics tool, update your privacy policy. An outdated policy is a compliance liability. Schedule regular scans (monthly or after any site update) to catch new trackers.
Mistake 4: Overlooking the Reject Flow
Many sites test the “Accept All” path but neglect the “Reject All” or granular settings path. Verify that when a user rejects non-essential cookies, those trackers are indeed blocked. GDPRChecker can simulate both flows and report discrepancies.
Mistake 5: Failing to Disclose Data Sharing
If your trackers send data to third parties (e.g., Google, Facebook), your privacy policy must name those parties and explain the purpose. The Google Analytics consent mode documentation requires you to disclose data sharing settings.
How to Validate Your Setup with GDPRChecker
GDPRChecker provides a suite of scans that help you verify your Do Not Track disclosures and overall tracking compliance. Here’s how to use it effectively:
- **Run a full website scan**: Enter your URL and let GDPRChecker crawl your pages. The scan identifies all cookies, trackers, and network requests, and checks for a consent banner and privacy policy link.
- **Review the tracker inventory**: Compare the scan results with the list in your privacy policy. Any tracker found by the scanner but missing from your policy is a disclosure gap.
- **Check pre-consent requests**: The scanner flags any requests that occur before user interaction with the consent banner. This is a critical GDPR requirement.
- **Test consent flows**: Use the scanner to simulate “Accept All” and “Reject All” scenarios. Verify that marketing and analytics tags only fire after consent.
- **Monitor ongoing compliance**: On paid plans, GDPRChecker offers runtime protection and monitoring, consent records, and page-coverage checks to ensure continuous compliance as your site evolves.
After making changes, always rescan to confirm the fixes. This evidence trail is invaluable if you ever need to demonstrate compliance to a regulator.
Comparison: Do Not Track Header vs. GDPR Consent Requirements
Many website owners confuse the browser Do Not Track signal with GDPR consent obligations. The table below clarifies the differences.
| Aspect | Do Not Track (DNT) | GDPR Consent | |--------|-------------------|--------------| | **Legal basis** | Voluntary HTTP header; no legal obligation to honor it under GDPR. | Legal requirement under GDPR and ePrivacy Directive for non-essential processing. | | **Scope** | A binary signal (DNT:1 or DNT:0) sent by the browser. | Granular consent for specific purposes (analytics, marketing, etc.). | | **User control** | Set once in browser settings; often hidden. | Managed through a consent banner with clear options. | | **Enforcement** | No regulatory enforcement for ignoring DNT. | Regulators can fine for lack of valid consent. | | **Transparency requirement** | If you claim to honor DNT, you must explain how. | You must always disclose tracking in your privacy policy, regardless of DNT. |
In practice, relying solely on DNT is insufficient for GDPR compliance. You need a robust consent mechanism and a transparent privacy policy that includes Do Not Track information as part of your overall tracking disclosure.
Real-World Examples
Example 1: E-commerce Site with Google Analytics and Facebook Pixel
An online store uses Google Analytics 4 and Meta Pixel for conversion tracking. Their privacy policy lists both under “Marketing and Analytics Cookies,” explains the data collected, and states: “We do not respond to Do Not Track signals. You can manage your preferences through our cookie banner or by adjusting your browser settings.” The consent banner blocks both tags until the user clicks “Accept.” A GDPRChecker scan confirms no pre-consent requests and that the policy link is visible.
Example 2: SaaS Blog with Hotjar and LinkedIn Insight Tag
A B2B SaaS company runs a blog with Hotjar session recordings and LinkedIn Insight Tag for retargeting. Their privacy policy includes a table of cookies with names, providers, purposes, and expiration. They honor DNT by configuring their CMP to automatically reject all non-essential cookies when the DNT:1 header is present. The policy explicitly describes this behavior. Scanning reveals that Hotjar and LinkedIn tags are correctly blocked in the Reject flow.
Example 3: News Publisher with Multiple Ad Networks
A news site uses Google Ad Manager and several programmatic ad partners. Their privacy policy links to a separate cookie policy that details each ad network and provides opt-out instructions. They do not honor DNT because of technical limitations with header bidding, but they offer a prominent “Do Not Sell My Personal Information” link (for CCPA compliance) and a granular consent banner. A scan shows that some ad tags fire asynchronously; the site owner uses GDPRChecker’s pre-consent report to adjust tag firing rules and achieve compliance.
Implementation Checklist
Use this checklist to ensure you’ve properly included Do Not Track info in your privacy policy and aligned your technical setup.
- Run a full website scan with GDPRChecker to inventory all trackers.
- Document every tracker’s name, provider, purpose, and cookie duration.
- Draft a privacy policy section that lists all trackers and explains your DNT stance.
- Ensure your consent banner includes a visible link to the privacy policy before user interaction.
- Configure your CMP categories to match the tracker list in your policy.
- Test pre-consent behavior: no non-essential tags should fire before consent.
- Test the “Reject All” flow and verify that marketing/analytics tags are blocked.
- If using Google Consent Mode, verify that consent states are passed correctly to Google tags.
- Update your privacy policy immediately whenever you add or remove trackers.
- Schedule monthly scans to catch unauthorized tags or configuration drift.
- Keep scan reports as evidence of your compliance efforts.
- Review your policy language for clarity and completeness at least quarterly.
FAQ
What is include do not track info privacy policy? It means disclosing in your privacy policy how your website handles tracking technologies and whether it responds to the Do Not Track browser signal. This transparency is required under GDPR to inform users about data collection and their choices.
Do I need include do not track info privacy policy for GDPR? Yes. While honoring DNT is voluntary, the GDPR mandates that you clearly describe all tracking activities in your privacy policy. Including DNT information is part of that transparency obligation.
How do I implement include do not track info privacy policy? Start by auditing your trackers with a scanner, then draft policy language that lists each tracker and explains your DNT stance. Link the policy from your consent banner and configure your CMP to match.
How can I verify include do not track info privacy policy with a scanner? Use GDPRChecker to scan your site for trackers, pre-consent requests, and policy links. Compare the scan results with your policy disclosures and test consent flows to ensure tags behave as described.
What are common include do not track info privacy policy mistakes? Common errors include using a generic policy, ignoring pre-consent tags, not updating the policy after changes, neglecting the reject flow, and failing to disclose third-party data sharing.
Which cookies and trackers should I check for include do not track info privacy policy? Check all cookies and trackers that set cookies or access device storage, including analytics, advertising, social media, and functional tools. Even session cookies must be disclosed if they are not strictly necessary.
How often should I review include do not track info privacy policy? Review your policy at least quarterly and after any site update that adds or removes trackers. Regular scans help catch unauthorized changes that require policy updates.
What evidence should I keep for include do not track info privacy policy? Keep dated scan reports, consent records, and changelogs of policy updates. This documentation demonstrates your ongoing compliance efforts to regulators if needed.
Next Steps for Compliance
Including Do Not Track information in your privacy policy is not a one-time task—it’s an ongoing process of alignment between your disclosures and your technical reality. Start by scanning your site with GDPRChecker to uncover hidden trackers and pre-consent gaps. Then, update your privacy policy to reflect exactly what you found. For deeper guidance on related topics, explore our guides on cookie banner requirements, privacy policy requirements, and GDPR requirements for websites. If you operate a SaaS platform, our GDPR compliance for SaaS companies guide offers tailored advice. To understand the broader legal framework, read what is GDPR and what is ePrivacy.
Ready to close your disclosure gaps? Run a free scan with GDPRChecker now and get a detailed report of your tracking landscape.
Next step
Run a GDPRChecker scan to validate consent behavior, trackers, and disclosures after you implement the checklist above.
Article schema
```json { "@context": "https://schema.org", "@type": "Article", "headline": "Include Do Not Track Info Privacy Policy: A Practical Compliance Guide for Website Owners", "description": "Learn how to include Do Not Track info in your privacy policy for GDPR compliance. Step-by-step implementation, common mistakes, and how to validate with GDPRChecker.", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://www.gdprchecker.online/guides/include-do-not-track-info-privacy-policy" }, "publisher": { "@type": "Organization", "name": "GDPRChecker", "url": "https://www.gdprchecker.online" } } ```
Copyright and editorial notice
© GDPRChecker
This original AI-assisted editorial draft was selected, reviewed, and published by GDPRChecker. All rights are reserved where protected by applicable law. Do not reproduce the article without permission.