DuckDuckGo for Android tricks users with global privacy control setting

This is an issue with no comments or response from DDG, and frankly not much of an explanation. Calling it "tricking" and insinuating that it's malicious seems totally unfair at this point.

I’ve never heard about this Sec-GPC header, so I looked it up: https://globalprivacycontrol.github.io/gpc-spec/

My impressions:

- Basically DNT, except it instead “conveys a user's request to websites and services to not sell or share their personal information with third parties”.

- The only differences from DNT that I can tell:

1. Added DOM API: Navigator.globalPrivacyControl. Okay…

2. A server MAY indicate it supports GPC with /.well-known/gpc.json. Seems useless considering the next point about legal obligations.

3. “This standard is intended to work with existing and upcoming legal frameworks that render such requests enforceable.” But here’s thing, if you can legally enforce websites not selling personal info when a header that any client can set is present, why not just legally enforce websites not selling personal info, period, header or not?

This is so baffling.

sounds like a bug, is there a reason to think it’s intentional?