The rule
NEC 406.4(D)(2): where a two-prong (non-grounding) receptacle is replaced and no grounding means exists in the box, you may install (a) another two-prong receptacle, (b) a GFCI receptacle marked "No Equipment Ground", or (c) a three-prong receptacle supplied through a GFCI and marked "GFCI Protected" and "No Equipment Ground". The stickers come in the box.
What you get
Class A shock protection at that outlet and everything wired from its LOAD terminals. A person who becomes the path to ground trips the device at 5 mA exactly as in a grounded house.
What you do not get
- A working ground. Equipment that needs an earth reference for its own reasons — a surge protector, some audio and medical gear — has none. A surge strip on an ungrounded GFCI outlet has nowhere to send the surge; the label warning is real.
- A plug-in tester that works. The common three-light tester creates its fault from hot to the ground pin; with no ground it cannot trip the GFCI and reads "open ground". Test with the device's own button (testing).
Metal boxes and conduit
Some older houses have armored cable or conduit that is in fact a grounding path; an electrician can verify it and, if so, install grounded receptacles the ordinary way (406.4(D)(1)).
The bigger picture
GFCI protection is the right first step in an old house; AFCI protection (the difference) and eventually rewiring are the next ones. None of it replaces a look at the panel.