5 ms·
I think it was well-understood from the start that "please don't track me" requests had no teeth, and would be generally ridiculed and ignored by the vast major
by excalibur 8y ago
I think it was well-understood from the start that "please don't track me" requests had no teeth, and would be generally ridiculed and ignored by the vast majority of sites with an incentive to do so.
- Analemma_ 8y agoI’m not so sure about that. When Microsoft decided to turn DNT on by default for IE11 (edit: IE10), which was basically just pointing out that the emperor had no clothes, there was a lot of real anger at that decision: both Hacker News and places like the Apache project railed against it.
- davidfischer 8y agoThis is because on by default is against the standard. The only real standard around DNT is the Tracking Preference Expression[1] which says how to declare you comply with DNT without saying what compliance means. It isn't exactly a preference to not be tracked if the decision was made by your browser for you. Roy Fielding committed a change to Apache to ignore DNT on IE[2] as a result. [1] https://www.w3.org/TR/tracking-dnt/ https://www.w3.org/TR/tracking-dnt/ [2] https://arstechnica.com/information-technology/2012/09/apache-webserver-updated-to-ignore-do-not-track-settings-in-ie-10/ https://arstechnica.com/information-technology/2012/09/apach...
- Analemma_ 8y agoI'm sorry, but this is crap. For two reasons: 1) Why should "off by default" be the standard and "on by default" a standard violation? Any sane person, especially after consulting with users, would conclude that it should be the other way around. There's no a priori reason to say that "no explicitly-expressed desire not to be tracked" is less valid than "no explicitly-expressed dire to be tracked", since we all know most people just stick with default settings. The reason is that no one ever intended to actually honor DNT unless it was only used by a tiny fraction of people (and probably not even then), so that's the way the standard was written. Complaining that IE "violated the standard" was a useful way to try and distract from this fact. 2) IE10 violated standards left and right, and most of the time web servers and developers just grumbled and dealt with it. In no other case did anyone commit code to Apache to ignore headers sent by IE. Why different for DNT? Because unlike most settings, DNT actually cost them money. So once again "it violates the spec!" was a figleaf for the real problem.
- davidfischer 8y ago> I'm sorry, but this is crap. I agree with your sentiment that on by default should be the standard. However, it isn't. The standard is specific and it says it should be off by default. The standard was designed to be completely toothless and the advertising industry still tried to water it down. There's no enforcement mechanism and nothing that says what it means to comply. If you want something with teeth, try the EFF's pseudo-standard for DNT: https://github.com/EFForg/dnt-guide https://github.com/EFForg/dnt-guide
- necubi 8y agoThe off-by-default behavior was the result of a compromise made between the advertising industry and privacy groups. Since DNT was voluntary, adtech firms were not going to voluntarily destroy a huge chunk of their businesses. The only way to get buy-in was to ensure that it reflected an individual user desire for those who cared enough about privacy to enable it. The subtext was that this had to remain a fairly small set of users.
- danShumway 8y ago> The subtext was that this had to remain a fairly small set of users. You're completely right, and I think this gets to the root of what DNT proves -- that it was self-regulation under the assumption that it would not hurt advertisers or force them to change their processes for most people. One can imagine an (admittedly unrealistic) alternate universe where DNT was off by default, but some kind of significant event caused a huge percentage of users to voluntarily turn it on. In that world, advertisers would probably still stop honoring the header. Because what they were implicitly agreeing to was, "we will stop tracking a tiny minority of users who might otherwise just block us anyway." And to be fair, you can't really blame the advertising industry for not being on board with self-regulation that would force it to radically change its approach to business. I think that's why DNT still matters for illustrative purposes. It shows why consumer adblocking and anti-tracking tools need to exist outside of the control of the advertising industry. It can't be a partnership, because it's unrealistic and, frankly, unreasonable for users to ask advertisers to voluntarily kill their own businesses. No tool that has an actual real impact on privacy to anyone other than a tiny percentage of already irrelevant users is ever going to come out of the advertising industry being "responsible". Any kind of voluntary standard that advertisers are respecting (using easily blocked cookies, creating well-labeled ads, etc...) only exists because most consumers aren't using it to protect their privacy or because advertisers don't have the legal power to get rid of it.
- necubi 8y agoMicrosoft killed DNT by enabling it by default in IE. I was working for one of the largest web analytics companies at the time, and we were fully prepared to support it (the code had been written!). But after Microsoft's move it was immediately dead across the industry. Basically, Microsoft sacrificed consumer privacy as part of its petty feud with Google (and after their own attempts in ad tech went up in flames—taking a $6B write-down on their acquisition of AQuantive).
- danShumway 8y agoAt the risk of being a little combative, I'm going to call this an excuse. Why didn't your company disable it for just IE? It wasn't hard at the time to detect which browser people were using based on headers. You could have checked to see which browsers turned it on by default and ignored them specifically. If IE went the route of trying to make IE's headers imitate Firefox's or something, fine, then disable it for IE and Firefox, but keep it on for Chrome. But the idea that one browser misbehaving meant that suddenly no browsers could be trusted sounds to me like an excuse. Across the industry we build browser-specific behaviors for all kinds of things. What's so special about user tracking that nobody in the industry could do that?
- TeMPOraL 8y agoIt's a nice excuse. Every adtech firm can now say: "But we've been prepared to honor that! Look at us, we tried to play nice, we even wrote the code for it! But then that naughty Microsoft came and ruined it all!". Like if adtech companies weren't literally the best players at figuring out which browser a visitor uses.
- Tsubasachan 8y agoNo offense but your company makes money from tracking people. It is safe to assume that you oppose anything that is threatening to your revenue. You will fight privacy on the internet at every step.
- freen 8y agoI think it's well-understood from the start that website terms of service hidden away in a tiny, low contrast font link in the footer have no teeth, and would be generally ridiculed and ignored by the vast majority of users.
- excalibur 8y agoCorrect for the vast majority of users, but the lawyers have been known to disagree on the lack of teeth.
- mpweiher 8y agoDepends on the jurisdiction. In Germany, for example, such terms of service have little to no teeth. We have pretty strict laws about what can be in ToS and what cannot. For example, pretty much anything that's "surprising" is out. This used to be the AGB-Gesetz (ToS-Law), but it was transformed into a more general framework but largely identical rules: https://www.buzer.de/s1.htm?g=BGB&a=305-310 https://www.buzer.de/s1.htm?g=BGB&a=305-310
- mpweiher 8y agoI think this was a first step. After all, the industry always claims it doesn't need regulation, because it can self-regulate. So let's see if this is true. Shock, horror, surprise! It's not true! Mon dieu! Next up: some regulation.
- olliej 8y agoDNT was added to stop a congressional investigation (and so potentially actual regulation). It did enough at the time to prevent anything happening until it blew over. No browser ever expected it to do anything other than provide additional tracking metadata.
- ethbro 8y agoOr, as PR people phrase it, to adjust the optics of tracking. That said, I think the DNT flag being formalized is important to web development. Previously, one of the core arguments of advertisers was "people do not care about being tracked". Individuals choosing to turn on DNT demolishes that. Unfortunately, browsers turning it on by default muddles that indicator or intent, even if it's good for individuals.
- hobs 8y agoIt only muddles things if you think people want to be tracked by default. Otherwise it just implements the default everyone already know and advertisers bullshit about.
- dorgo 8y agoThe argument of advertisers is not that people want to be tracked by default. It is that they don't care. DNT had a chance to proof otherwise. But "enabled by default" means that the browsers care, not (necessarily) the users.
- SiVal 8y agoAnd Duck Duck Go's just-released study (https://spreadprivacy.com/google-filter-bubble-study/ https://spreadprivacy.com/google-filter-bubble-study/) shows that Google tracks you, not just DNT or not, but whether you are logged in or not, incognito or not, probably no matter what you do. When Google recently silently made Chrome log you in whether you logged yourself in or not, I switched to a different (previously unused, non-Chrome) browser on a new computer, and without logging in to anything Google (but from the same house), I went to YouTube. It asked me to log in, but I didn't. It proceeded to suggest mainly links to very niche-interest, low-view-count videos I had previously in the past few days, making it clear that it had at least a very good guess who I was anyway. Apparently, asking me to log in was mostly just asking for my permission for what they were going to do whether I agreed or not.
- Sylos 8y agoIt could have had legal bearing, if Microsoft had not turned it on by default. Before DNT, the way consent basically worked was that companies just assumed you consented, and only if you specifically denied consent, they would have no chance to defend that in court. With DNT, if the user turned that on themselves, they would have clearly signalled that they want this the other way around. Do Not Track me, unless I specifically give you my consent. This would have made it hard for companies to defend their behaviour in court. With Microsoft turning it on by default, there was no way for companies to know, if the user actually wanted privacy, or if they supposedly wanted to be tracked, for whatever reason. With the GDPR in place, you theoretically now need to get consent every time (including implicit consent, e.g. when the user asks for something to be shipped to their address, that means you can process their address). Most companies don't yet keep to it, though.
- wirrbel 8y agoSurely google can assume that browser settings represent the user'choice when it fits Google's interest, and they can assume that browser settings don't represent the user's choice when it fits their interest. But everyone knows that google won't tolerate a privacy measure that is used by a majority of users. Microsoft is not to blame for making privacy a default in their browser. It's google who is ignoring that setting. You cannot just assume the user did not actually want the default setting in their browser.
- Sylos 8y agoOh yeah, as far as I remember, Google (and Facebook) said right away that they would not support DNT, before it became default in IE. With most webpages shipping code from Google/Facebook, that was also already pretty bad for DNT.
- zucan 8y ago>With the GDPR in place, you theoretically now need to get consent every time This is false. There are multiple ways to justify processing of personal data, and your example would fall under data processing necessary to perform a contract at the customer's request. Depending on your location, there might also be legal requirements to record and keep user data, which is also a valid reason that doesn't require consent of the user. https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/
- btilly 8y agoIf it had teeth, every spammer, scammer and bot would be using the system to make their actions harder to stop. Every site with an interest in tracking will happily use this argument as an excuse to broaden their right to keep the "not tracking" to whatever the legal minimum is.
- benologist 8y agoGoogle exploited Safari to track users who had opted-out of being tracked so relying on them to respect a cookie may have been futile even if they supported it. The current charges involve Google's use of special computer code to trick Apple's Safari Web-browsing software into letting it monitor users that had blocked such tracking. https://money.cnn.com/2012/02/17/technology/google_tracking_safari/index.htm https://money.cnn.com/2012/02/17/technology/google_tracking_...
- gonyea 8y agoSo did literally everybody else building a website that was embedded in an iframe. I was there in 2011, at a startup, copying the same StackOverflow answer as everyone else so we could store cookies in Safari. This is such a non-issue. It was widely regarded as a bug in Safari.
- RedComet 8y agoOh, well that’s perfectly okay then.
- sharcerer 8y agoSo, is Google guilty in this case? Because i think in UK, a group of iPhone users are suing them. More of a coding practices mistake than a specific company one?
- jlarocco 8y agoFYI, that's not making Google look good, it's making you look bad.
- wnevets 8y agoI much rather remember DNT as an opportunity for the industry to regulate itself before browsers vendors were forced into taking the matter into their hands. They of course blew that opportunity and will have to pay the price. We're already seeing apple and mozilla becoming very aggressive to prevent tracking and ads.
- WeAreGoingIn 8y agoOf course, you are totally right. The future is for those companies and app vendors that respect privacy AND take good care of the personal information they have been giving, keeping them accurate and secure, not selling them around for the highest bidder.
- jlarocco 8y agoTBH I wish Mozilla were taking a more agressive stance against ads and tracking. It's nice that they've recently taken a stand, but they're still not taking it very seriously (only blocking "abusive" trackers, IIRC) and it's 5-10 years later than they should have done it. Why aren't they sponsoring uBlock Origin or Privacy Badger?
- it_can_be_done 8y agoWhy don't you send a message and make a difference? https://news.ycombinator.com/item?id=18633090 https://news.ycombinator.com/item?id=18633090
- tinus_hn 8y agoDo you mean Google, the Industry? Or Google, the Browser Vendor?
- wnevets 8y agoI mean the internet tracking/ad industry in general.
- cityzen 8y agoSounds like google/apple/amazon's take on the United States tax law as well.
- mey 8y agohttps://en.m.wikipedia.org/wiki/Evil_bit https://en.m.wikipedia.org/wiki/Evil_bit
- mirimir 8y agoIt was certainly obvious to me, if I recall correctly. The idea of asking sites not to track is just so pathetic. If you don't want to be tracked, you do whatever it takes to not be tracked. For example, I'm fine with everything about Mirimir being tracked, correlated, etc. But Mirimir is thoroughly compartmentalized from my meatspace stuff, and from other personas. And it's not really that hard. For most people, it would just mean running multiple VMs that connect via different VPNs.
- TeMPOraL 8y ago> If you don't want to be tracked, you do whatever it takes to not be tracked. That includes asking and voting for regulations that help end this shitshow wholesale.
- mirimir 8y agoFair enough. But that doesn't seem to have worked in the US. Maybe in California, I admit. And maybe there's still hope.
- mthoms 8y agoI'll be sure to tell my 69 year old father to "keep his meatspace stuff compartmentalized" and just go ahead and subscribe to several "different VPNs" so that he'll be able to fire up "multiple VM's" when he doesn't want to be tracked. Easy right? Piece of cake. Give me a break.
- mirimir 8y agoWell, he's younger than I am ;) Seriously, running VirtualBox VMs is easier than editing Word documents.
- Tsubasachan 8y agoOn the internet: assume hostility.
- tinus_hn 8y agoI hope they continue to laugh just until they are hit with billion dollar fines for disrespecting people’s explicit orders.
- it_can_be_done 8y agoIf you want them to get billon dollar fines then send just two messages: https://news.ycombinator.com/item?id=18633090 https://news.ycombinator.com/item?id=18633090