I’ve never heard about this Sec-GPC header, so I looked it up: https://globalprivacycontrol.github.io/gpc-spec/ https://globalprivacycontrol.github.io/gpc-spec/

I’ve never heard about this Sec-GPC header, so I looked it up: https://globalprivacycontrol.github.io/gpc-spec/ https://globalprivacycontrol.github.io/gpc-spec/ My impressions: - Basically DNT, except it instead “conveys a user's request to websites and services to not sell or share their personal information with third parties”. - The only differences from DNT that I can tell: 1. Added DOM API: Navigator.globalPrivacyControl. Okay… 2. A server MAY indicate it supports GPC with /.well-known/gpc.json. Seems useless considering the next point about legal obligations. 3. “This standard is intended to work with existing and upcoming legal frameworks that render such requests enforceable.” But here’s thing, if you can legally enforce websites not selling personal info when a header that any client can set is present, why not just legally enforce websites not selling personal info, period, header or not? This is so baffling.