Yes. We honour both signals at the cookie-banner layer — if your browser sends DNT or GPC, we treat it as a non-consent and don't load the optional analytics cookie.

The strictly necessary cookies (login session, CSRF, locale) still load because the site needs them. We don't use any tracking that could be classified as "sale of data" under CCPA, so the analytics opt-out is the most material control either signal could trigger here.