5 ms·

Would this include browsers which have the DNT header enabled by default? I remember early edge/late internet explorer defaulting to sending the header, and cla

Would this include browsers which have the DNT header enabled by default? I remember early edge/late internet explorer defaulting to sending the header, and claimed as much in advertising. The spec itself (at the time, at least) said that it could be ignored if the header was always sent/not user-enabled.

jacquesm 3y ago
Courts are not necessarily bound by such a spec, but it doesn't look as if that question was addressed here and in my view it would have to be established by another case because for sure the companies that ignore do not track right now will be more than happy to pretend that they have an excuse to continue to do so. This is a long drawn out rearguard fight.
amelius 3y ago
> The spec itself (at the time, at least) said that it could be ignored if the header was always sent/not user-enabled. Why?
- noirscape 3y ago
  IIRC the people who wrote the spec did it in co-operation with the larger ad networks and this was the only way they could get the ad networks to comply with it. Then Microsoft enabled it by default in Explorer 10 and the ad networks took it as carte blanche to ignore the DNT header forever, claiming Microsoft had violated the agreement. Nowadays it's usually not set even by the overly privacy conscious out of fingerprinting concerns, since its another unique way to identify your traffic.
  - wkat4242 3y ago
    What didn't help was that the EFF was actively campaigning against it instead of lobbying to elevate the flag to legal status so it would become useful. The same way they campaigned against adblockers but had their own petty little voluntary pledge thing. That's what you get when your NGO gets so big your leaders end up playing on the same golf courses and waiting in the same netjets lounges as the enemy.
  - plagiarist 3y ago
    I have absolutely never set it because of how many bits of information it is in terms of fingerprinting me. Might as well send a header with half my SSN up along with it.
- fweimer 3y ago
  I suspect it was just the conservative choice, mirroring the behavior of the predecessor browser extension (which also required deliberate user action to activate): http://paranoia.dubfire.net/2011/01/history-of-do-not-track-header.html http://paranoia.dubfire.net/2011/01/history-of-do-not-track-... I couldn't find any explicit discussion of that aspect of the spec (https://datatracker.ietf.org/doc/html/draft-mayer-do-not-track-00 https://datatracker.ietf.org/doc/html/draft-mayer-do-not-tra... is an early version), but I suspect that as noirscape wrote, it made consensus-building easier. Not that it mattered in the end, of course.
fweimer 3y ago
If the user installs a privacy-focused browser (NB: not sure if such things exist, marketing aside), one could argue that there is still user choice involved even though the browser sets DNT by default. The original Internet Explorer situation was different because it came pre-installed with the operating system, and whether there is choice in operating systems for any given piece of consumer hardware is often rather dubious today (and was probably “no” in more cases back then).
- wirrbel 3y ago
  > If the user installs a privacy-focused browser (NB: not sure if such things exist, marketing aside), one could argue that there is still user choice involved even though the browser sets DNT by default. it doesn't need to be argued as the fact that the user did not disable the DNT option in such a browser is the action that matters.
noirscape 3y ago
Spec largely doesn't matter for what the courts think; DNT is considered by them to be a valid signal for not wanting to be tracked in the eyes of the court according to the ruling. (note: I am not a lawyer.) You could argue that by using a browser where the DNT header is set by default, they are making that decision on their privacy by y'know, using those browsers over the ones where they're not set by default. Ad companies don't want that argument, they want you to opt out in every browser (and ideally they'd just ignore the header entirely, which they do after Microsoft enabled it by default in Explorer).
- HelloNurse 3y ago
  Discussing defaults is only a distraction. Browsers are, in their own words, a "user agent" and their requests are the user's requests.
  - Aerroon 3y ago
    If this were true, then wouldn't your browser sending out personal data constitute consent to have that data tracked? After all, the website asks you to give them the data and the browser complies.
    - layer8 3y ago
      The browser sending data doesn’t authorize the server to store it for tracking purposes.
    - troupo 3y ago
      https://news.ycombinator.com/item?id=38081860 https://news.ycombinator.com/item?id=38081860
  - noirscape 3y ago
    To be fair, Chrome is basically doing everything it can to stop being the users agent and is instead Googles fun magic box you use to see what goes on on the internet (with the explicit long-term goal for Chrome to just be Googles freely downloadable OS overlaid onto your Windows/Mac/Linux, given how many system APIs Google keeps dumping into the browser). I don't blame people for forgetting that part sometimes, given how 90% of the population uses a browser that doesn't serve their interests.
ahofmann 3y ago
> The spec itself (at the time, at least) said that it could be ignored if the header was always sent/not user-enabled. How would that work? Has the server a mechanism to check if DNT was set by default on the client/browser?
- tsimionescu 3y ago
  No, the idea was exactly do prevent browsers from enabling DNT as the default. The spec would expect the server to check the User Agent and ignore the DNT header entirely if it comes from a user agent which is known to default it to true. Obviously, this was a ploy to gut the standard while still pretending to self-regulate.
xxs 3y ago
>Would this include browsers which have the DNT header enabled by default It's EU - the default is to require consent for using personal data (which in at least few of the jurisdictions IPs are included). The the 'default' should be out.
- joking 3y ago
  and what you do if the user gives consent and still send the DNT header?
  - xxs 3y ago
    the latest date consent given (or taken away) takes precedence, consent requires an clear&affirmative action, so if that part can be recorded - do as you please.
    - esperent 3y ago
      I guess the person above you means what if someone clicks "accept" on the cookie banner but also has DNT turned on. To which I'd say: they shouldn't even see the cookie banner in that case. DNT alone is enough.
      - IggleSniggle 3y ago
        Yup. If I'm going around my daily business wearing a shirt that says, "no sex for me, please!" Then please do not come up to me and say, "but, would you like to have sex with me?" And if I say "yes, actually, even though it was very rude of you to ask, given the shirt that I am wearing...in fact, I would like to have sex with you," then you should at least have the decency to wait for me to take my shirt off before having sex with me. If I decide it's really not worth the effort to take the shirt off, then it turns out, actually, no, I really did not want the sex after all.
        esperent 3y ago
        This is the best analogy I've heard in a while, thank you.
preciousoo 3y ago
Quoting the (Google Translated) article: > According to the General Data Protection Regulation, the right to object to the processing of personal data can also be exercised using automated procedures. A DNT signal represents an effective contradiction. I assume automated procedures include default settings. Not a lawyer and not from the EU though
wirrbel 3y ago
Not a lawyer, but basically the website cannot distinguish whether a DNT setting was enabled by default or whether the user intended to set it so it really does not matter. It must be assumed that the user enabled the DNT setting. Let's assume Aunt Agatha reads about the DNT setting in one of her magazines, goes to the browser settings, sees that it's enabled, takes no further action. That is no different from Uncle Ulysses who has a different browser with a DNT-disabled default who goes to the settings and enables its. My letterbox has a sticker on it that I don't want to receive unsolicited ads. I don't need anyone to try to presume that it wasn't me who put that sticker onto my letterbox.
- theGeatZhopa 3y ago
  It gets better than that. Once, I've seen / caught in the act / one ads-distributee who damaged the sticker on my box' lid. He was scratching it with a key. Then, suddenly vanished after seeing me. After that, I got ads put into my box again. Once I asked one distributee if he can't see the sticker.. "it's damaged. So I thought you wanted to remove that, but it made problems so yo left it striken through"
  - medstrom 3y ago
    I have trouble believing that's real. Why would these workers bother?
    - rhighhtfjhg 3y ago
      If you are paid by ad distributed wouldn’t you want to try to maximize the number of ads delivered in to the same apartment building?
      - Libcat99 3y ago
        Not through vandalism and scammyness, but maybe that's why I don't work in advertising.
    - darkwater 3y ago
Ekaros 3y ago
Why cannot we expect people wanting to tracking to be smart enough and go disable it? Sounds even more reasonable way to think about it.
c4mpute 3y ago
GDPR specifies tracking to be necessarily default-off and opt-in anyways. Therefore the browser sending DNT:1 by default would just repeat the legal status quo. A tracker could not successfully argue that this is to be ignored, because the technical default that the browser sends is the legal default anyways.
yellowsir 3y ago
letzt assume i install TailsOS. just because it's privacy by default it does not mean it was not my choice! The choice just happens on a other level.
wkat4242 3y ago
Of course it should. In europe tracking is supposed to be Opt-In so enabling by default is exactly how it should work.

jacquesm 3y ago

Courts are not necessarily bound by such a spec, but it doesn't look as if that question was addressed here and in my view it would have to be established by another case because for sure the companies that ignore do not track right now will be more than happy to pretend that they have an excuse to continue to do so. This is a long drawn out rearguard fight.

amelius 3y ago

> The spec itself (at the time, at least) said that it could be ignored if the header was always sent/not user-enabled. Why?

noirscape 3y ago
IIRC the people who wrote the spec did it in co-operation with the larger ad networks and this was the only way they could get the ad networks to comply with it. Then Microsoft enabled it by default in Explorer 10 and the ad networks took it as carte blanche to ignore the DNT header forever, claiming Microsoft had violated the agreement. Nowadays it's usually not set even by the overly privacy conscious out of fingerprinting concerns, since its another unique way to identify your traffic.
- wkat4242 3y ago
  What didn't help was that the EFF was actively campaigning against it instead of lobbying to elevate the flag to legal status so it would become useful. The same way they campaigned against adblockers but had their own petty little voluntary pledge thing. That's what you get when your NGO gets so big your leaders end up playing on the same golf courses and waiting in the same netjets lounges as the enemy.
- plagiarist 3y ago
  I have absolutely never set it because of how many bits of information it is in terms of fingerprinting me. Might as well send a header with half my SSN up along with it.
fweimer 3y ago
I suspect it was just the conservative choice, mirroring the behavior of the predecessor browser extension (which also required deliberate user action to activate): http://paranoia.dubfire.net/2011/01/history-of-do-not-track-header.html http://paranoia.dubfire.net/2011/01/history-of-do-not-track-... I couldn't find any explicit discussion of that aspect of the spec (https://datatracker.ietf.org/doc/html/draft-mayer-do-not-track-00 https://datatracker.ietf.org/doc/html/draft-mayer-do-not-tra... is an early version), but I suspect that as noirscape wrote, it made consensus-building easier. Not that it mattered in the end, of course.

fweimer 3y ago

If the user installs a privacy-focused browser (NB: not sure if such things exist, marketing aside), one could argue that there is still user choice involved even though the browser sets DNT by default. The original Internet Explorer situation was different because it came pre-installed with the operating system, and whether there is choice in operating systems for any given piece of consumer hardware is often rather dubious today (and was probably “no” in more cases back then).

wirrbel 3y ago
> If the user installs a privacy-focused browser (NB: not sure if such things exist, marketing aside), one could argue that there is still user choice involved even though the browser sets DNT by default. it doesn't need to be argued as the fact that the user did not disable the DNT option in such a browser is the action that matters.

noirscape 3y ago

Spec largely doesn't matter for what the courts think; DNT is considered by them to be a valid signal for not wanting to be tracked in the eyes of the court according to the ruling. (note: I am not a lawyer.) You could argue that by using a browser where the DNT header is set by default, they are making that decision on their privacy by y'know, using those browsers over the ones where they're not set by default. Ad companies don't want that argument, they want you to opt out in every browser (and ideally they'd just ignore the header entirely, which they do after Microsoft enabled it by default in Explorer).

HelloNurse 3y ago
Discussing defaults is only a distraction. Browsers are, in their own words, a "user agent" and their requests are the user's requests.
- Aerroon 3y ago
  If this were true, then wouldn't your browser sending out personal data constitute consent to have that data tracked? After all, the website asks you to give them the data and the browser complies.
  - layer8 3y ago
    The browser sending data doesn’t authorize the server to store it for tracking purposes.
  - troupo 3y ago
    https://news.ycombinator.com/item?id=38081860 https://news.ycombinator.com/item?id=38081860
- noirscape 3y ago
  To be fair, Chrome is basically doing everything it can to stop being the users agent and is instead Googles fun magic box you use to see what goes on on the internet (with the explicit long-term goal for Chrome to just be Googles freely downloadable OS overlaid onto your Windows/Mac/Linux, given how many system APIs Google keeps dumping into the browser). I don't blame people for forgetting that part sometimes, given how 90% of the population uses a browser that doesn't serve their interests.

ahofmann 3y ago

> The spec itself (at the time, at least) said that it could be ignored if the header was always sent/not user-enabled. How would that work? Has the server a mechanism to check if DNT was set by default on the client/browser?

tsimionescu 3y ago
No, the idea was exactly do prevent browsers from enabling DNT as the default. The spec would expect the server to check the User Agent and ignore the DNT header entirely if it comes from a user agent which is known to default it to true. Obviously, this was a ploy to gut the standard while still pretending to self-regulate.

xxs 3y ago

>Would this include browsers which have the DNT header enabled by default It's EU - the default is to require consent for using personal data (which in at least few of the jurisdictions IPs are included). The the 'default' should be out.

joking 3y ago
and what you do if the user gives consent and still send the DNT header?
- xxs 3y ago
  the latest date consent given (or taken away) takes precedence, consent requires an clear&affirmative action, so if that part can be recorded - do as you please.
  - esperent 3y ago
    I guess the person above you means what if someone clicks "accept" on the cookie banner but also has DNT turned on. To which I'd say: they shouldn't even see the cookie banner in that case. DNT alone is enough.
    - IggleSniggle 3y ago
      Yup. If I'm going around my daily business wearing a shirt that says, "no sex for me, please!" Then please do not come up to me and say, "but, would you like to have sex with me?" And if I say "yes, actually, even though it was very rude of you to ask, given the shirt that I am wearing...in fact, I would like to have sex with you," then you should at least have the decency to wait for me to take my shirt off before having sex with me. If I decide it's really not worth the effort to take the shirt off, then it turns out, actually, no, I really did not want the sex after all.
      - esperent 3y ago
        This is the best analogy I've heard in a while, thank you.

preciousoo 3y ago

Quoting the (Google Translated) article: > According to the General Data Protection Regulation, the right to object to the processing of personal data can also be exercised using automated procedures. A DNT signal represents an effective contradiction. I assume automated procedures include default settings. Not a lawyer and not from the EU though

wirrbel 3y ago

Not a lawyer, but basically the website cannot distinguish whether a DNT setting was enabled by default or whether the user intended to set it so it really does not matter. It must be assumed that the user enabled the DNT setting. Let's assume Aunt Agatha reads about the DNT setting in one of her magazines, goes to the browser settings, sees that it's enabled, takes no further action. That is no different from Uncle Ulysses who has a different browser with a DNT-disabled default who goes to the settings and enables its. My letterbox has a sticker on it that I don't want to receive unsolicited ads. I don't need anyone to try to presume that it wasn't me who put that sticker onto my letterbox.

theGeatZhopa 3y ago
It gets better than that. Once, I've seen / caught in the act / one ads-distributee who damaged the sticker on my box' lid. He was scratching it with a key. Then, suddenly vanished after seeing me. After that, I got ads put into my box again. Once I asked one distributee if he can't see the sticker.. "it's damaged. So I thought you wanted to remove that, but it made problems so yo left it striken through"
- medstrom 3y ago
  I have trouble believing that's real. Why would these workers bother?
  - rhighhtfjhg 3y ago
    If you are paid by ad distributed wouldn’t you want to try to maximize the number of ads delivered in to the same apartment building?
    - Libcat99 3y ago
      Not through vandalism and scammyness, but maybe that's why I don't work in advertising.
  - darkwater 3y ago

Ekaros 3y ago

Why cannot we expect people wanting to tracking to be smart enough and go disable it? Sounds even more reasonable way to think about it.

c4mpute 3y ago

GDPR specifies tracking to be necessarily default-off and opt-in anyways. Therefore the browser sending DNT:1 by default would just repeat the legal status quo. A tracker could not successfully argue that this is to be ignored, because the technical default that the browser sends is the legal default anyways.

yellowsir 3y ago

letzt assume i install TailsOS. just because it's privacy by default it does not mean it was not my choice! The choice just happens on a other level.

wkat4242 3y ago

Of course it should. In europe tracking is supposed to be Opt-In so enabling by default is exactly how it should work.