On this page
Do Not Track and Global Privacy Control
When a visitor's browser sends Do Not Track (DNT) or Global Privacy Control (GPC, the Sec-GPC: 1 header), we respect it at two levels:
- In the browser — the website script detects either signal and by default doesn't run at all, sending nothing.
- On the collector — if a request still arrives (forwarded from a server, say), requests carrying either signal drop to level 1 and consent flags are cleared.
An attribute on the script can change the first behaviour; we advise against it. The share of visitors sending these signals is usually small, so the effect on totals is limited, and the signal is a clear statement of what the visitor wants.
Visitor opt-out
If your site offers visitors a "don't track me" option, collection stops once they opt out. By default the opt-out covers all of that person's devices (where we can recognise them as the same person); you can limit it to the current device instead.
Opt-out is a collection switch and affects future data only. To delete data already collected, use a data subject request.
Data subject requests
Where: Configuration › Privacy center. Owners and admins can create them, or you can create them through the API with a key that has privacy write permission — useful for connecting your own account centre or an external privacy platform.
| Type | Purpose |
|---|---|
| Access | Export the person's data, downloadable so you can send it to them |
| Erasure | Delete the person's data |
| Restriction | Stop processing the person's data; their later events are dropped |
| Portability | Export the person's data in a common format |
A request identifies the person by device, login ID, email or user.
Cooling-off period
Erasure and restriction don't run immediately. There is a cooling-off period (3 days by default for restriction) during which the request can be withdrawn, to guard against mistakes. After it ends the request runs, and it can't be undone. Only requests that haven't run yet can be cancelled.
Response deadlines
Laws set deadlines for answering — under EU rules, generally within one month. The privacy center shows the status of each request; create it as soon as you receive one, leaving room for the cooling-off period.
Your role and ours
For visitor data you collect with PathClue, you are the controller and we process it on your behalf. When a visitor asks you to exercise their rights, follow the steps above; if they contact us directly, we pass it on to you. For a signed data processing agreement, see our Data Processing Agreement.