11 ms·

Coalition Announces New ‘Do Not Track’ Standard for Web Browsing (2015)

107 points by cpeterso 9y ago

noncoml 9y ago
It is one of these things that it is too little too late. Ad blockers filled in the gap and there is no need for a solution anymore. Not to mention that AdBlock has lost all the good faith from the users, so including it in the coalition only does damage to the public image.
kevinoid 9y ago
Could someone clarify: What's the standard? Is it adopting EFF's DNT policy https://www.eff.org/dnt-policy https://www.eff.org/dnt-policy? Is it hosting any privacy policy at /.well-known/dnt-policy.txt? Do any tools or browsers use that URL or display it to users? Has anyone else adopted this standard?
TheAceOfHearts 9y ago
IMO, tracking should be strictly opt-in, making it opt-out is abusive and ubethical. I recently learned of GDPR. Although I'm uncertain of the exact law's implementation details, I think it's a step in the right direction. It's strictly opt-in and requires providing a clear explanation of what data gets collected.
xg15 9y ago
I don't really understand how this is supposed to help. If I'm an advertiser/tracker/etc, what keeps me from adding the policy file to my website - so adblock, duckduckgo etc. are happy - and then blatantly violating it? The "policy" doesn't seem to be legally binding in any way, there is no way to even detect violations and the EFF itself writes that it can't enforce it: > Posting the dnt-policy.txt file makes a promise to the users who interact with their domain. We believe it would be a false and misleading trade practice to post the policy without the intent to comply in good faith. However, EFF is not in a position to enforce this promise or monitor compliance. [1] So what's the point? [1] https://www.eff.org/dnt-policy#faq-What-does-the-dnt-policy.txt-promise-mean https://www.eff.org/dnt-policy#faq-What-does-the-dnt-policy....?
- greglindahl 9y ago
  If you're a US company and you lie to your customers about what your policies are, the FTC may well sue you. They do it all of the time over privacy policies.
- lotu 9y ago
  This is trying to create a way for publisher to say, "I don't want to track users" and have it be understood by software. Right now no such system exists. You could see organizations doing testing to see if tracking happens but they need to know what the publisher say they will or won't do. It still might not get adoption but it isn't nothing.
- eli 9y ago
  This is basically what happened to P3P, an earlier attempt to regulate privacy rules with a machine-readable policy. Microsoft set IE to reject cookies by default if a site didn't have 1) a P3P header that 2) met certain requirements. It wasn't very well thought out and, in practice, required a bunch of sites to create a bogus P3P header or core functionality like "logging in" was broken for many IE users.
NelsonMinar 9y ago
The decision of the Internet advertising industry to ignore the original Do Not Track setting is a landmark in the cynicism of the industry. I mean users made an explicit request to not be tracked and companies like Google and Facebook were all "lol, no, we'll track you anyway". It's one of the reasons I feel no remorse running an ad blocker.
- ocdtrekkie 9y ago
  In fairness, a leading cause of DNT's failure is that Microsoft, for marketing purposes, chose to set DNT by default for a while. While I applaud the goal of assuming people don't want tracking, it gave ad companies an excuse to dismiss DNT: Because many users showing DNT settings had not explicitly meant to do so.
  - lostmsu 9y ago
    Right, blame Facebook and Google's tracking on Microsoft's attempt to do what's better for their users privacy.
    - ocdtrekkie 9y ago
      It's funny because most of my comments are negative on Google (to the extent that it's been suggested before I am only here to take shots at Google), and largely pro-Microsoft (I carry a Windows phone for heaven's sake), but a shocking amount of people were upset at this comment. :/
      - lostmsu 9y ago
        Well, the comment is really bad. PR or no PR Microsoft did what users would have really wanted if it worked. You can blame Microsoft for it, but they were not the ones, who ignored users best interests here.
  - ABCLAW 9y ago
    I don't believe this is fair - user consent is clearly marked by the standard as an alleviating requirement. Without any user input, one must believe consent is imputed upon all users absent a statement to the contrary to justify a 'please track me' default. It was the refusal of ad networks to justify why people should consent to their surveillance which torpedoed the initiative. They could have. They didn't. If they believed users wouldn't like their argument, all they had to do was sweeten the pot until people jumped on board. It remains to be seen whether or not avoiding the discussion was ultimately in their best interest - the political power-play has already started to bear poisonous fruit for the industry.
hermitdev 9y ago
I seriously doubt this will gain much traction. I would love it to, but I doubt the motives behind advertisers. I mean, just look at the current state of advertising on mobile. One constantly gets ads hijacking the browser to show ads ostensibly from Amazon or Walmart (I doubt either Amazon or Walmart would actually prevent you from getting to the content you're looking at). The "well-done" ads prevent you from even hitting the back-button on your browser to return to the content. Being an Android user, I've effectively taken to using MS Edge on Android, because at least in Edge, I can disable javascript, which has gone a long way to crippling such ads. (Before anyone asks: I'm normally a Chrome user + UBlock, etc etc, but Chrome doesn't support extensions on Android, and I've never had good luck with FireFox for anything other than draining battery). When Ad companies learn to play nice and not hijack my browser and occasionally serve up out right malware, maybe, just MAYBE, will I reconsider playing nice with them.
- anowlcalledjosh 9y ago
  > at least in Edge, I can disable javascript Note that you can also do this in Chrome: Settings/Site settings/JavaScript. If you're looking for another way to block ads on mobile, DNS66 works pretty well for me, and it's FOSS IIRC (obviously it doesn't get everything, there's only so much a DNS-based blocker can do, but it catches most ads except YouTube's in my experience).
  - hermitdev 9y ago
    I did look fairly hard about how to disable JS in Chrome on Android, but didn't see it. I'll give it another look. I do use DNS blocking on my home PC, and yes, it works great, but obviously that is a moving target, especially if you don't actively maintain it. I'm not familiar with DNS66 - I'll give it a closer look later tonight.
    - warent 9y ago
      A search for "android chrome disable JavaScript" gave me this as the instructions on how to do so. The top result: http://ccm.net/faq/39964-google-chrome-for-android-turn-off-javascript http://ccm.net/faq/39964-google-chrome-for-android-turn-off-...
javery 9y ago
This is from 2015.
- jasonkostempski 9y ago
  That needs to be added to the title. I would've stopped my Amazon Smile donations to EFF if they were still wasting money pursuing this obviously pointless idea.
- Ajedi32 9y ago
  Yeah, my first thought when I read the headline was "Again?". DNT was actually pretty widely implemented in browsers for a while, but it ultimately failed because there wasn't anything actually enforcing the standard. It was essentially just a way to politely ask servers not to track you.
  - Sylos 9y ago
    If Microsoft had't made it the default in IE, then DNT would have been an explicit action to show that you do not consent to tracking, which would have had legal bearing.
    - user5994461 9y ago
      It had zero legal bearing either way.
mmagin 9y ago
My issue with DNT is that it is generally another bit of uniqueness that makes my browser slightly EASIER to track for anyone who doesn't care about obeying it, which are likely the greatest threats.
jackhack 9y ago
If a security or privacy model depends on the cooperation of those on the other end of the wire, it will fail.
- nykolasz 9y ago
  This is the reason why DNT failed. If it can't be forced, the bad players won't follow it.
Feniks 9y ago
Please don't kill anyone vs. killing is against the law and you'll go to jail if you do it. I know which one works best.
Cyberdog 9y ago
> Disconnect’s partners in this launch are the innovative publishing site Medium I know this is off-topic, but what is so innovative about Medium? Does it break any significant ground beyond what LiveJournal was doing almost two decades ago?
- whatusername 9y ago
  Not tracking users when they ask not to be tracked?
- jasonkostempski 9y ago
  Nothing. I'm a bit surprised an EFF article is using all those meaningless fluffy words to describe the partners.
TravelTechGuy 9y ago
As others have mentioned here, this is akin to a sheep carrying a sign saying "please don't eat me", hoping wolves would respect it. Furthermore, this sheep just highlighted the fact that it's a troublesome sheep, that requires special attention (i.e. if the DNT flag is in the header of the first request to my site, I know I can bust out my adblock-bypassing scripts, and start serving ads differently). When I worked for [name of major ad-supported company redacted], I specifically asked a senior PM one day why are we ignoring the DNT flag in our products. He said "because that's how we make our money", thought for another second and added "also, everyone else ignores it".
- user5994461 9y ago
  The wolf comparison is on point in that advertisers are evil creatures who rely on hurting internet users to survive and thrive.
- wmeredith 9y ago
  And this analogy is exactly why I am remorseless in cutting out all forms of advertising my and my families lives.
tzahola 9y ago
Coalition Announces New “Please Don’t Listen” Standard against Man-in-the-middle Attacks
- Endy 9y ago
  Or even better a new, "Please Don't Listen" standard against cell-phone conversations on busy streets!
paulogubio 9y ago
AUGUST 3, 2015
zimbatm 9y ago
Now all we need if for websites to automatically hide the cookie warning header when DNT is set.
- Endy 9y ago
  Oh, I'm sure that someone out there already does. The question is whether they're making enough money off it to do it en masse.
yuhong 9y ago
The ad bubble and how it affects Google/Mozilla is now one of my favorite topics. It is not just Google, but it is the most interesting.
labster 9y ago
Cool, a new way our browsers can be fingerprinted! Thanks EFF for one more bit of entropy! Yes I know this was in good faith, but when you are trying to get good faith agreement against the business model of an industry, it's no surprise it was a failure.

107 points by cpeterso 9y ago

It is one of these things that it is too little too late. Ad blockers filled in the gap and there is no need for a solution anymore. Not to mention that AdBlock has lost all the good faith from the users, so including it in the coalition only does damage to the public image.

kevinoid 9y ago

Could someone clarify: What's the standard? Is it adopting EFF's DNT policy https://www.eff.org/dnt-policy https://www.eff.org/dnt-policy? Is it hosting any privacy policy at /.well-known/dnt-policy.txt? Do any tools or browsers use that URL or display it to users? Has anyone else adopted this standard?

TheAceOfHearts 9y ago

IMO, tracking should be strictly opt-in, making it opt-out is abusive and ubethical. I recently learned of GDPR. Although I'm uncertain of the exact law's implementation details, I think it's a step in the right direction. It's strictly opt-in and requires providing a clear explanation of what data gets collected.

xg15 9y ago

I don't really understand how this is supposed to help. If I'm an advertiser/tracker/etc, what keeps me from adding the policy file to my website - so adblock, duckduckgo etc. are happy - and then blatantly violating it? The "policy" doesn't seem to be legally binding in any way, there is no way to even detect violations and the EFF itself writes that it can't enforce it: > Posting the dnt-policy.txt file makes a promise to the users who interact with their domain. We believe it would be a false and misleading trade practice to post the policy without the intent to comply in good faith. However, EFF is not in a position to enforce this promise or monitor compliance. [1] So what's the point? [1] https://www.eff.org/dnt-policy#faq-What-does-the-dnt-policy.txt-promise-mean https://www.eff.org/dnt-policy#faq-What-does-the-dnt-policy....?

greglindahl 9y ago
If you're a US company and you lie to your customers about what your policies are, the FTC may well sue you. They do it all of the time over privacy policies.
lotu 9y ago
This is trying to create a way for publisher to say, "I don't want to track users" and have it be understood by software. Right now no such system exists. You could see organizations doing testing to see if tracking happens but they need to know what the publisher say they will or won't do. It still might not get adoption but it isn't nothing.
eli 9y ago
This is basically what happened to P3P, an earlier attempt to regulate privacy rules with a machine-readable policy. Microsoft set IE to reject cookies by default if a site didn't have 1) a P3P header that 2) met certain requirements. It wasn't very well thought out and, in practice, required a bunch of sites to create a bogus P3P header or core functionality like "logging in" was broken for many IE users.

NelsonMinar 9y ago

The decision of the Internet advertising industry to ignore the original Do Not Track setting is a landmark in the cynicism of the industry. I mean users made an explicit request to not be tracked and companies like Google and Facebook were all "lol, no, we'll track you anyway". It's one of the reasons I feel no remorse running an ad blocker.

ocdtrekkie 9y ago
In fairness, a leading cause of DNT's failure is that Microsoft, for marketing purposes, chose to set DNT by default for a while. While I applaud the goal of assuming people don't want tracking, it gave ad companies an excuse to dismiss DNT: Because many users showing DNT settings had not explicitly meant to do so.
- lostmsu 9y ago
  Right, blame Facebook and Google's tracking on Microsoft's attempt to do what's better for their users privacy.
  - ocdtrekkie 9y ago
    It's funny because most of my comments are negative on Google (to the extent that it's been suggested before I am only here to take shots at Google), and largely pro-Microsoft (I carry a Windows phone for heaven's sake), but a shocking amount of people were upset at this comment. :/
    - lostmsu 9y ago
      Well, the comment is really bad. PR or no PR Microsoft did what users would have really wanted if it worked. You can blame Microsoft for it, but they were not the ones, who ignored users best interests here.
- ABCLAW 9y ago
  I don't believe this is fair - user consent is clearly marked by the standard as an alleviating requirement. Without any user input, one must believe consent is imputed upon all users absent a statement to the contrary to justify a 'please track me' default. It was the refusal of ad networks to justify why people should consent to their surveillance which torpedoed the initiative. They could have. They didn't. If they believed users wouldn't like their argument, all they had to do was sweeten the pot until people jumped on board. It remains to be seen whether or not avoiding the discussion was ultimately in their best interest - the political power-play has already started to bear poisonous fruit for the industry.

hermitdev 9y ago

I seriously doubt this will gain much traction. I would love it to, but I doubt the motives behind advertisers. I mean, just look at the current state of advertising on mobile. One constantly gets ads hijacking the browser to show ads ostensibly from Amazon or Walmart (I doubt either Amazon or Walmart would actually prevent you from getting to the content you're looking at). The "well-done" ads prevent you from even hitting the back-button on your browser to return to the content. Being an Android user, I've effectively taken to using MS Edge on Android, because at least in Edge, I can disable javascript, which has gone a long way to crippling such ads. (Before anyone asks: I'm normally a Chrome user + UBlock, etc etc, but Chrome doesn't support extensions on Android, and I've never had good luck with FireFox for anything other than draining battery). When Ad companies learn to play nice and not hijack my browser and occasionally serve up out right malware, maybe, just MAYBE, will I reconsider playing nice with them.

anowlcalledjosh 9y ago
> at least in Edge, I can disable javascript Note that you can also do this in Chrome: Settings/Site settings/JavaScript. If you're looking for another way to block ads on mobile, DNS66 works pretty well for me, and it's FOSS IIRC (obviously it doesn't get everything, there's only so much a DNS-based blocker can do, but it catches most ads except YouTube's in my experience).
- hermitdev 9y ago
  I did look fairly hard about how to disable JS in Chrome on Android, but didn't see it. I'll give it another look. I do use DNS blocking on my home PC, and yes, it works great, but obviously that is a moving target, especially if you don't actively maintain it. I'm not familiar with DNS66 - I'll give it a closer look later tonight.
  - warent 9y ago
    A search for "android chrome disable JavaScript" gave me this as the instructions on how to do so. The top result: http://ccm.net/faq/39964-google-chrome-for-android-turn-off-javascript http://ccm.net/faq/39964-google-chrome-for-android-turn-off-...

javery 9y ago

This is from 2015.

jasonkostempski 9y ago
That needs to be added to the title. I would've stopped my Amazon Smile donations to EFF if they were still wasting money pursuing this obviously pointless idea.
Ajedi32 9y ago
Yeah, my first thought when I read the headline was "Again?". DNT was actually pretty widely implemented in browsers for a while, but it ultimately failed because there wasn't anything actually enforcing the standard. It was essentially just a way to politely ask servers not to track you.
- Sylos 9y ago
  If Microsoft had't made it the default in IE, then DNT would have been an explicit action to show that you do not consent to tracking, which would have had legal bearing.
  - user5994461 9y ago
    It had zero legal bearing either way.

mmagin 9y ago

My issue with DNT is that it is generally another bit of uniqueness that makes my browser slightly EASIER to track for anyone who doesn't care about obeying it, which are likely the greatest threats.

jackhack 9y ago

If a security or privacy model depends on the cooperation of those on the other end of the wire, it will fail.

nykolasz 9y ago
This is the reason why DNT failed. If it can't be forced, the bad players won't follow it.

Feniks 9y ago

Please don't kill anyone vs. killing is against the law and you'll go to jail if you do it. I know which one works best.

Cyberdog 9y ago

> Disconnect’s partners in this launch are the innovative publishing site Medium I know this is off-topic, but what is so innovative about Medium? Does it break any significant ground beyond what LiveJournal was doing almost two decades ago?

whatusername 9y ago
Not tracking users when they ask not to be tracked?
jasonkostempski 9y ago
Nothing. I'm a bit surprised an EFF article is using all those meaningless fluffy words to describe the partners.

TravelTechGuy 9y ago

As others have mentioned here, this is akin to a sheep carrying a sign saying "please don't eat me", hoping wolves would respect it. Furthermore, this sheep just highlighted the fact that it's a troublesome sheep, that requires special attention (i.e. if the DNT flag is in the header of the first request to my site, I know I can bust out my adblock-bypassing scripts, and start serving ads differently). When I worked for [name of major ad-supported company redacted], I specifically asked a senior PM one day why are we ignoring the DNT flag in our products. He said "because that's how we make our money", thought for another second and added "also, everyone else ignores it".

user5994461 9y ago
The wolf comparison is on point in that advertisers are evil creatures who rely on hurting internet users to survive and thrive.
wmeredith 9y ago
And this analogy is exactly why I am remorseless in cutting out all forms of advertising my and my families lives.

tzahola 9y ago

Coalition Announces New “Please Don’t Listen” Standard against Man-in-the-middle Attacks

Endy 9y ago
Or even better a new, "Please Don't Listen" standard against cell-phone conversations on busy streets!

paulogubio 9y ago

AUGUST 3, 2015

zimbatm 9y ago

Now all we need if for websites to automatically hide the cookie warning header when DNT is set.

Endy 9y ago
Oh, I'm sure that someone out there already does. The question is whether they're making enough money off it to do it en masse.

yuhong 9y ago

The ad bubble and how it affects Google/Mozilla is now one of my favorite topics. It is not just Google, but it is the most interesting.

labster 9y ago

Cool, a new way our browsers can be fingerprinted! Thanks EFF for one more bit of entropy! Yes I know this was in good faith, but when you are trying to get good faith agreement against the business model of an industry, it's no surprise it was a failure.