A bigger question is: why didn't they go with the Platform for Privacy Preferences (P3P) header?

> P3P: CP="This is not a P3P policy! See http://www.google.com/support/accounts/bin/answer.py?hl=en&a... for more info."

Because the absence of a "DoNotTrack" header does not imply that a user has consented to being tracked, as a user may be using a browser that doesn't support "DoNotTrack". Nor does the setting of a "DoNotTrack" header necessarily correspond to a specific user, as it may have been set by a administrator policy. Nor would it be informed consent, as it is configured before the user has been informed as to the uses for which private data will be applied.

The GDPR requires that consent be informed, explicit, freely-given, and limited to a specific use case. Of these, the "DoNotTrack" header could be at most freely-given. Its design as a binary yes/no that can be configured across all sites prevents it from ever being used as a way to grant permission to track.

While the presence of "DoNotTrack=1" could be used to assume that no permission to track has been granted, this is already the default assumption that the GDPR requires companies to make.

> as a user may be using a browser that doesn't support "DoNotTrack"

There are at least two solutions for that:

1. Force browsers to support the header.

2. Always send the header "DoNotTrack=boolean", then force websites to take action (show a popup) when there is no header.