13 ms·
Why Doesn't Google Comply with Do Not Track?
- jaytaylor 8y agoTruly respecting DNT would undermine Google's core business and the cash cow that is AdWords, by reducing the amount and / or quality of user activity data fed into the platform. Such a change goes too much against the Alphabet Corporation's own self-interest and well-being for it to be voluntarily offered. As with many things in Western Civilization, it traces back to capitalism and the unfortunate incentives it can encourage.
- seanhunter 8y ago100% right. They don't respect do not track because they don't believe they have to, it's in their interests not to, and they don't behave according to an ethical framework that would lead them to do things that contradict their direct short-term interests.
- anticensor 8y agoIn this case, respecting DNT also contradict user's short term desires as it leads to longer manual search on retrieved results.
- justtopost 8y agoIf the user desires to be tracked, they dont set the flag. You can't reframe a 'no' into 'but they clearly were asking for it'. Thats pretty messed up.
- excalibur 8y agoI think it was well-understood from the start that "please don't track me" requests had no teeth, and would be generally ridiculed and ignored by the vast majority of sites with an incentive to do so.
- Analemma_ 8y agoI’m not so sure about that. When Microsoft decided to turn DNT on by default for IE11 (edit: IE10), which was basically just pointing out that the emperor had no clothes, there was a lot of real anger at that decision: both Hacker News and places like the Apache project railed against it.
- davidfischer 8y agoThis is because on by default is against the standard. The only real standard around DNT is the Tracking Preference Expression[1] which says how to declare you comply with DNT without saying what compliance means. It isn't exactly a preference to not be tracked if the decision was made by your browser for you. Roy Fielding committed a change to Apache to ignore DNT on IE[2] as a result. [1] https://www.w3.org/TR/tracking-dnt/ https://www.w3.org/TR/tracking-dnt/ [2] https://arstechnica.com/information-technology/2012/09/apache-webserver-updated-to-ignore-do-not-track-settings-in-ie-10/ https://arstechnica.com/information-technology/2012/09/apach...
- Analemma_ 8y agoI'm sorry, but this is crap. For two reasons: 1) Why should "off by default" be the standard and "on by default" a standard violation? Any sane person, especially after consulting with users, would conclude that it should be the other way around. There's no a priori reason to say that "no explicitly-expressed desire not to be tracked" is less valid than "no explicitly-expressed dire to be tracked", since we all know most people just stick with default settings. The reason is that no one ever intended to actually honor DNT unless it was only used by a tiny fraction of people (and probably not even then), so that's the way the standard was written. Complaining that IE "violated the standard" was a useful way to try and distract from this fact. 2) IE10 violated standards left and right, and most of the time web servers and developers just grumbled and dealt with it. In no other case did anyone commit code to Apache to ignore headers sent by IE. Why different for DNT? Because unlike most settings, DNT actually cost them money. So once again "it violates the spec!" was a figleaf for the real problem.
- freen 8y agoI wonder if I can append to every web request a header that has my personal terms of service and if companies don't want to comply to MY terms, they can simply refuse service. Seems reasonable, right?
- jakobdabo 8y agoNo, your personal terms of service would be just another identifier to track your browsing.
- freen 8y agoPerhaps that might be a violation of my copyright and intellectual property. My terms supersede theirs. Says so in the first paragraph.
- bduerst 8y agoBroadcasting your terms isn't the same as the listener agreeing to it. You aren't guaranteed copyright just because you say so - i.e. you don't have a copyright on films made of you in public.
- elicash 8y ago> Broadcasting your terms isn't the same as the listener agreeing to it. This is the point OP seems to be making about online publishers.
- izzydata 8y agoBut that is exactly what websites are doing.
- stordoff 8y agoHow is this different to including terms and conditions on a web page? If they can ignore the terms, why can't I?
- eslaught 8y ago
- arcticwombat 8y agoSimple, money. DNT is optional, you're "asking" to not be tracked. Google makes money off of tracking you, so it's not going to just up and not do that because you asked nicely.
- dabitude 8y agoAs far as I remember, one of the main problems with DNT is that most its users actually didn't enable it intentionally (because there are browsers that enable it by default). Edit: internet explorer used to do that (https://en.wikipedia.org/wiki/Do_Not_Track#Internet_Explorer_10_default_setting_controversy https://en.wikipedia.org/wiki/Do_Not_Track#Internet_Explorer...)
- 21 8y agoYeah, because we all know that your average user default position is "sure, track me however you want". Just like their default is "sure, scam me however you want", because they didn't explicitly check a "Do Not Scam Me" checkbox.
- AnaniasAnanas 8y ago> because there are browsers that enable it by default Can't speak for others but I do not enable it because doing so could lead to me being tracked as the majority has it disabled. This is also the reason that the tor browser also has it disabled. I am not aware of any popular browsers that enable it by default in this day and age.
- dabitude 8y agoThis is what I had in mind: https://en.wikipedia.org/wiki/Do_Not_Track#Internet_Explorer_10_default_setting_controversy https://en.wikipedia.org/wiki/Do_Not_Track#Internet_Explorer...
- danShumway 8y agoOkay, but: > On April 3, 2015, Microsoft announced that as of Windows 10, it would comply with the specification and no longer enable Do Not Track as part of the operating system's "Express" default settings, but that the company will "provide customers with clear information on how to turn this feature on in the browser settings should they wish to do so". So for the specific browsers that do follow the standard, like Edge, Chrome, and Firefox, why doesn't Google respect the flag for those browsers now? I know that Google has the ability to detect which browser I'm using, because they tell me to install Chrome every time I visit their homepage. I'm seeing IE mentioned all over the place here, but it what it looks like is that one bad actor was just the excuse the advertising industry needed to mass-ignore the setting on every browser, everywhere, regardless of whether or not they violated the standard.
- threatofrain 8y agoIn my view "DNT" just increases the ability to track you.
- olliej 8y agoYou would be correct.
- 51lver 8y agoIt's not about blocking trackers. It's about sending a message...
- cpburns2009 8y agoExcept this message is largely ignored by everyone, Joker. I like the idea of not being tracked. Realistically without any legal weight behind it it was bound to be a no-op. It's comparable to fragile markings on packages to shippers.
- mirimir 8y agoYes, and messages make one more unique, no?
- oehpr 8y agoSo... I feel like this point doesn't get made enough. And I've always been confused about that. Maybe I'm just reading the wrong articles, but the only place I can ever find someone pointing out that this only serves to increase user fingerprints is in communal discussions like HN, and rarely, and somewhere down the list. I can't ever seem to find it in articles. Here's an article actively criticizing the DNT flag: https://gizmodo.com/do-not-track-the-privacy-tool-used-by-millions-of-peop-1828868324 https://gizmodo.com/do-not-track-the-privacy-tool-used-by-mi... and it doesn't mention the fact that DNT enhances your fingerprint. But look: https://panopticlick.eff.org/ https://panopticlick.eff.org/ even the EFF's own fingerprinting analysis tool recognizes that the DNT enhances your fingerprint. And yet they themselves proposed another DNT standard! https://www.eff.org/dnt-policy https://www.eff.org/dnt-policy
- 21 8y agoJust try to enable Do Not Track in Chrome. See the scary long warning you need to accept. It makes you think you are going to get hacked or something if you accept it. You also need to click the "Confirm" button, which typically is reserved for serious stuff that has real effects. > Enabling "Do Not Track" means that a request will be included with your browsing traffic. Any effect depends on whether a website responds to the request, and how the request is interpreted. For example, some websites may respond to this request by showing you ads that aren't based on other websites you've visited. Many websites will still collect and use your browsing data - for example to improve security, to provide content, services, ads and recommendations on their websites, and to generate reporting statistics. No other privacy setting has such a scary warning.
- ridiculous_fish 8y agoIf Google doesn't honor DNT, why would they bother trying to scare off users from setting it?
- berbec 8y ago“It is difficult to get a man to understand something, when his salary depends on his not understanding it.” ― Upton Sinclair
- kanon 8y agoJust to add to this, in Matomo (Formerly Piwik. I always have to lookup their new name. It's one of the worst name changes I've ever witnessed. I'm sorry but I had to say it.) you have the ability to comply with DNT requests and even anonymize them in a specific way.
- mtmail 8y agoSame for https://usefathom.com/ https://usefathom.com/ (listed in their privacy policy).
- danielrm26 8y agoBecause their entire business model is based on tracking you.
- anticensor 8y agoIt would break personalised search results.
- justtopost 8y agoGood? I can turn off DNT of that is a problem for me.
- jokoon 8y agoI wonder if the there could be a section in the GDPR that would forbid websites to track their users if they have such option turned on, and if it's legally feasible.
- soared 8y ago> use your browsing data to improve security, provide content, services, ads and recommendations on their websites, and generate reporting statistics.
- pfortuny 8y ago“Most websites (...) do not change their behavior”. That is: fuck off. In plain English. But is is for your benefit. Really.
- stordoff 8y agoAre there any major websites that _do_ support DNT? I note for instance Hacker News does not: > Our Site currently does not respond to “Do Not Track” (DNT) signals and operates as described in this Privacy Policy whether or not a DNT signal is received.
- MrMorden 8y agoadafruit.com doesn't load resources from external sites that don't obey DNT (e.g. YouTube) without an explicit user action.
- Avery3R 8y agomedium does the same thing
- davidfischer 8y ago- Medium (https://medium.com/.well-known/dnt-policy.txt https://medium.com/.well-known/dnt-policy.txt) - EFF (https://www.eff.org/.well-known/dnt-policy.txt https://www.eff.org/.well-known/dnt-policy.txt) - Read the Docs (https://readthedocs.org/.well-known/dnt-policy.txt https://readthedocs.org/.well-known/dnt-policy.txt) Sites that implement DNT should respond to either /.well-known/dnt-policy.txt or /.well-known/dnt/ or both. Responding to /.well-known/dnt/ means a site has implemented the W3's Tracking Preference Expression (https://www.w3.org/TR/tracking-dnt/ https://www.w3.org/TR/tracking-dnt/). This doesn't necessarily mean much as there's no agreed standard of what complying with DNT means. However, it typically implies that the site does something different for users with DNT enabled vs. disabled. Responding to /.well-known/dnt-policy.txt is typically stricter and means a site adhere's to the EFF's guidelines (https://github.com/EFForg/dnt-guide https://github.com/EFForg/dnt-guide) for DNT. This has rules for how long data is retained, which data can be retained, specifications around anonymizing data, and security precautions. Disclaimer: I worked on Read the Docs' DNT implementation.
- danShumway 8y agoProps to Medium, because not only does it respect DNT, it pretty rigorously follows the advice about blocking third-party embeds if they don't respect it.[0] Medium is not always on my good side, and I think the site has some problems, but at least somebody working there does really care about privacy, and I regularly notice and appreciate their work. DuckDuckGo as well, but I would have a problem if they didn't respect DNT. Medium is the site where they really didn't have to care, but they did anyway. [0]: https://github.com/EFForg/dnt-guide#a-embedly https://github.com/EFForg/dnt-guide#a-embedly
- it_can_be_done 8y agoFirst contact Google and let them know they violate your privacy and GDRP via this form: https://support.google.com/policies/contact/general_privacy_form https://support.google.com/policies/contact/general_privacy_.... When they refuse to change anything, make complaint to your national authorities: https://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=612080 https://ec.europa.eu/newsroom/article29/item-detail.cfm?item....
- deytempo 8y agoSide Note: Isn’t it just dandy that Google security researchers are the ones finding all the PhD level zero days now a days? Like I’m sure they never use them before reporting them...
- comex 8y ago> Like I’m sure they never use them before reporting them... That would be highly illegal. And while Google has been accused of various things over the years, like the Wi-Fi sniffing thing, actively exploiting someone else’s system would be on another level entirely. Of course, the same smarts that make complex exploits achievable can also make them harder to detect – but only to a point. It’s almost impossible to bring the risk to zero.
- 546456ergdfgd 8y agoIts only because they pay researchers so damn much. Like more than you would believe... Other tech vendors cannot compete, and the best follows the money. Of course, some of us have ethics.
- sys_64738 8y agoGoogle is an advertising company so it's in their money making interests to spy on you and follow you everywhere. Isn't that what a stalker does?
- nojvek 8y agoJust pass a goddamn law, any website that doesn’t respect “Do Not Track” headers will get fined like GDPR. That’s why we have regulation.
- it_can_be_done 8y agoGDPR already states you can't track without user consent so just make a complaint. https://news.ycombinator.com/item?id=18633090 https://news.ycombinator.com/item?id=18633090
- crunchyfrog 8y agoI think the main reason Google decided not to support DNT is that Microsoft turned it on by default in IE. Microsoft did this knowing full well that Google would be put between a rock and a hard place: either implement DNT and instantly start losing a ton of money or ignore DNT and look like the bad guy. Meanwhile Microsoft could sit on their high horse since it wouldn't cost them any money. I suspect Google would have respected DNT if Microsoft had made it opt-in as it was intended.
- dane-pgp 8y agoSurely the correct counter-move for Google would have been to say "We will respect the DNT flag in all browsers except IE".
- proactivesvcs 8y agoTheir eschewing of this obvious move paints a picture of their respect towards web users.
- ehnto 8y agoEnd users are worse off than had the chosen "the obvious move" so I don't know about that.
- lotu 8y agoMaybe depends on how they though it would play out in the media. Unfortunately the whole opt-in vs. opt-out is too complicated to be explained in most reporting. Google might have worried that not respecting Do Not Track for IE could be interpreted as an Anti-Mircrosft move that would run afoul of monopoly law.
- TeMPOraL 8y ago> Unfortunately the whole opt-in vs. opt-out is too complicated to be explained in most reporting. Is it really? Let me try: You're going down the street while eating some cookies, and suddenly you meet a friend. Opt-in: A friend sees your cookies, and asks, "Can I have one?" Opt-out: A friend starts taking and eating your cookies, and says, "Tell me if you want me to stop."
- stewbrew 8y agoDoes the GDPR change anything in this respect when users made their intentions explicit?
- prepend 8y agoThere’s a two part solution- 1) deprecate DNT, add Consent To Track (CTT). Allow users to set to Y. Default is blank or unset. 2) two year testing period to see how sites respect user intent. If sites continue to track when CTT != Y, then enact regulation
- andirk 8y agoHere I am on Brave browser and most of those tricky hacks are not possible. I don't know why everyone doesn't use it.