8 ms·

"Do Not Track" HTTP header supported by IE, Opera, FF, Safari but not Chrome

146 points by TomAnthony 14y ago

4ad 14y ago
The "Do Not Track" HTTP header is useless, equivalent to a "Do not Steal from Me" T-shirt. It is also harmful because it gives users a false feeling of protection and security. The question should not be why Chrome didn't implement it, but why Opera and Firefox did.
- jiggy2011 14y ago
  From a technical point of view it has little merit, granted. I think from a legal point of view though , you are expressing your desire to not be tracked. This would be preferable to legislation dictating that the user must manually approve all cookies etc.
  - throwaway55-33 14y ago
    "you are expressing your desire to not be tracked." Yes. And I think this is important. For example, for cases brought by the FTC, class actions, and other litigation it might be useful. If a company ignores the Header sent by the user and tracks her anyway, then one could argue the company too has expressed an intent. The Header is machine readable like any other. A server can parse it and take a specific action based on its presence or absence. Arguably it does have technical merit.
- rjd 14y ago
  It will make all the difference in a court case when you have specifically denied consent and someone has continued to do something. If you want to get pedantic about it just being text, all law is just text, books upon books, but its the enforcement that counts. This opens the door for enforcement of other laws.
  - paulgb 14y ago
    You're not denying consent, you're sending some non-standard bytes to their server which will be lost as soon as the request is processed. Without legislation, do not track is just an honor system.
    - deleted 14y ago
      [deleted]
    - rjd 14y ago
      I understand your point, but 'evil do-ers' break existing laws then this could be considered evidence. I'm fairy sure a mix privacy & contract laws in my country would hold companies subject to this as its stands if you didn't agree to allow them to do it in a EULA. Because if I'm not mistaken by accepting the request you are agreeing to contractual obligations... so the server has to accept your contract to engage in transactions... the server can choose to accept or deny this transaction... by default accepting the contract. Of course you would have a good defence against this a well, so agreed you'd need it standardised to make it a real threat against a company in court. Would be interesting to see played out in court TBH. Also if stances are made like this then changes will never manifest, because its close to useless now doesn't mean it won't become a foundation for something later.
    - wpietri 14y ago
      You're mixing levels of analysis here. You might as well say, "He didn't vote; he just used some sort of chemical-containing stick to make marks on a thin slice of a tree." Your point about legislation being needed would be stronger without that.
      - paulgb 14y ago
        My point isn't about levels of abstraction, it's about standardized communication protocols. Making marks on a thin slice of a tree conveys a vote exactly because that's what the government decided the way to make a vote would be. If I write my vote in hieroglyphic etchings on an old shoe and post it to the first lady, I can't expect my vote to be counted.
- zobzu 14y ago
  Well Twitter won't track you if you have "do not track" enabled. Unless you have Chrome. It should be pretty obvious why Chrome doesn't implement it. It's against the core business of Google (tracking). They will only implement if it causes a PR issue (and this very post is a PR issue btw, even thus a small one)
  - jabr 14y ago
    Google has already committed to supporting it in Chrome. It's just not in it yet. I don't know if they've made any promises to honor DNT requests, but their browser will be able to send them.
  - vog 14y ago
    Google has an "Incognito" mode which provides an even better tool against tracking than DNT, because it doesn't depend on the merci of the websites you are visiting. Also note that almost no other browser are supporting such a feature out-of-box, at least not when this feature was added to Chrome. So while I'm not a big fan of Google, either, I find it hard to argue that Google doesn't care about privacy features in Chrome.
    - andreasvc 14y ago
      IIRC, Firefox's private browsing mode is older than Incognito.
- lolcraft 14y ago
  It reminds me a lot of RFC 3514's evil bit[1]. [1] http://www.ietf.org/rfc/rfc3514.txt http://www.ietf.org/rfc/rfc3514.txt
  - TazeTSchnitzel 14y ago
    We can finally rest assured our computers are safe, since all evil packets get filtered. Right?
- waterlesscloud 14y ago
  It enables social pressure on sites to honor it. Once it exists, sites can be forced to explain why they don't obey the users' express wishes.
  - throwaway55-33 14y ago
    Not only social pressure, but perhaps legal pressure too.
revelation 14y ago
Why would Chrome not support a meaningless header sent by the client? You are asking Schneier to implement security by obscurity with emphasis on the obscurity part. Hell, you are asking the same people that sent a "This is not a P3P policy" P3P policy. Now I don't know if they think, as do I, that all of this is just meaningless extra traffic on the wire, or that they are evil and don't want to commit to privacy guarantees. No way to tell.
- hmottestad 14y ago
  Anyone sent in a RFC for using code 666 for "Server is evil and does not support Do Not Track headers".
  - __ted__ 14y ago
    The IETF does have a network-layer solution to that. http://www.ietf.org/rfc/rfc3514.txt http://www.ietf.org/rfc/rfc3514.txt
kevinsd 14y ago
Given that Google is perhaps the only company whose main business is online ads and ads relevance is crucial, it is natural that they cannot give up the opportunity of tracking profile of ads viewers as easily as other companies.
lampe 14y ago
the thing is why should it be supported if the website is tracking you any way? its just a request to not track me but i don't can see if its really not tracking me.
SoftwareMaven 14y ago
The real question isn't whether Google's browser supports this, it's whether Google's servers support this. It may be that Google isn't adding it to the browser until it can commit to it on the server.
- joejohnson 14y ago
  Allowing people to opt out of tracking would decrease the load on Google's servers.
  - jrochkind1 14y ago
    Well, sure, and if everybody installed effective ad blocking software so they never saw a google ad, that would decrease the load on google's servers too.
  - jrockway 14y ago
    You can already opt out of ad targeting: https://www.google.com/settings/u/0/ads/preferences/?hl=en#optout https://www.google.com/settings/u/0/ads/preferences/?hl=en#o...
- cooldeal 14y ago
  That makes no sense whatsoever. There are a few websites which do request it, and the header will do no harm to the ones that don't. So Chrome users will be unable to use that feature (going to be?) supported by Twitter, for example. Did Google web properties use WebGL, NaCl etc. before Chrome supported them?
Jimmie 14y ago
I can hear it now "Of course not, why would an ad company sabotage itself?". Wikipedia says Chrome is set to support the header by the end of this year (2012). Wikipedia's source: http://online.wsj.com/article/SB10001424052970203960804577239774264364692.html http://online.wsj.com/article/SB1000142405297020396080457723...
- cooldeal 14y ago
  Even if what you said is true, it's definitely interesting that the browser that is on the forefront of implementation of almost every new web feature is about a year behind on only this one while all the other major browsers have already implemented it.
  - Jimmie 14y ago
    It is a little suspicious that Chrome is dragging it's feet, isn't it? I guess we'll see if they honour their promise by the end of the year.
  - chc 14y ago
    It might have to do with the fact that most Web technologies do something useful while this just sends an extra header that pretty much every site they visit will ignore. I wouldn't prioritize it either at this point in time. This is a movement that needs support from site maintainers, not browser implementors.
- cpeterso 14y ago
  Google also said they would drop H.264 support from Chrome, but we're still waiting.
willscott 14y ago
I still haven't heard a cogent explanation of what this is supposed to do. "Do Not Track" sounds nice, but seems no easier to scope than the initial problem of excessive information collection. I think it's safe to say that I want companies to 'track' me in order to keep me logged in for a session. Likewise, I hope that my bank keeps logs of visitors, so that it can respond to abuse / hacking attempts. Is this aimed only at behavioral advertising, or is it meant to have a broader scope? It seems like the technical execution is almost misguided without having the policy discussion first and figuring out what it is we disagree with. Without that, I don't feel like this is going to draw a strong enough line to separate people abusing tracking from the legitimate uses.
- zobzu 14y ago
  Do not track me for advertisement, statistics, etc. is the intent.
  - __ted__ 14y ago
    Ending your list with etc. undermines your point. With this header set, can my site track what pages a user views to recommend pages to him later? Can compliant sites keep stats for engineering purposes? Grandparent is dead-on - it's bad enough that this does not affect the behavior of bad actors, but if it isn't even clear what effect it will have on good ones, the false sense of security may be worse than nothing.
    - zobzu 14y ago
      Key word is "intent". Privacy != security. Close, but not quite.
  - nl 14y ago
    statistics WTF? So analytics packages will somehow have to exclude these browsers from all reports? Some reports? Can you count impressions from these users?
    - 14y ago
rmc 14y ago
This is misleading. The important actors in the "who supports Do Not Track" is not browsers but websites. "Browser support" just means "we'll tell the website that you'd rather not be tracked". If every browser sent this header, and every website ignored it, it would be a complete failure. So what, if any, websites support the "Do Not Track" header?
- hej 14y ago
  Chicken, egg. Someone has to start.
- leocassarani 14y ago
  Twitter, for one: http://www.theregister.co.uk/2012/05/18/twitter_signs_do_not_track/ http://www.theregister.co.uk/2012/05/18/twitter_signs_do_not...
- recoiledsnake 14y ago
  Well, websites are the ones to lose with this, not browsers(except ones with conflict of interest like Google and Microsoft). So websites can say "Hey, a popular browser like Chrome doesn't support it, so why should we?". That's why it's important for all browsers to support it so that there will be more pressure on websites to support it.
- bzbarsky 14y ago
  The key part is not the websites but the services (ads, analytics, etc) that sites use. For those, quoting from http://donottrack.us/implementations http://donottrack.us/implementations : 3PMobile, AdInsight, AdOcean, AdTruth, AP News Registry, Blue Cava, BlueKai, BrightTag, Chitika, Effective Measure, eXelate, Jumptap, m6d, Mochi Media, TagMan, Tealium, TruEffect, Ensighten, Twitter. Note absence of Google with their advertiser hat on, as well as Facebook.
btian 14y ago
but will be incorporated by the end of 2012
nigma 14y ago
On the other hand Google provides browser extensions that lets you opt-out from advertising cookies and Google Analytics tracking. These are not vastly popular though, each at around 100k installs for the Chrome version. https://www.google.com/ads/preferences/html/opt-out.html https://www.google.com/ads/preferences/html/opt-out.html https://tools.google.com/dlpage/gaoptout https://tools.google.com/dlpage/gaoptout
nzmsv 14y ago
As far as I can tell, this official extension for Chrome has been available since January of last year and supports the header: http://googlepublicpolicy.blogspot.ca/2011/01/keep-your-opt-outs.html http://googlepublicpolicy.blogspot.ca/2011/01/keep-your-opt-...
jnorthrop 14y ago
This will only be useful if governments enforce it. The US has included it for consideration in the US Privacy Bill of Rights[1] and the EU may enforce it as well[2]. But until there is some form of punishment for not complying with DNT it is essentially window dressing. [1]http://www.whitehouse.gov/sites/default/files/privacy-final.pdf http://www.whitehouse.gov/sites/default/files/privacy-final.... [2]http://ec.europa.eu/justice/data-protection/article-29/documentation/other-document/files/2012/20120301_reply_to_iab_easa_en.pdf http://ec.europa.eu/justice/data-protection/article-29/docum...
deleted 14y ago
[deleted]
commonersense 14y ago
If you disable Cookies and Javascript you will stop probably 90% or more of tracking. How much tracking is done without using Cookies and without Javascript? KISSMetrics? What else?
- othermaciej 14y ago
  There's lots of ways to track you. Here's a sampling: <http://samy.pl/evercookie/&#62 http://samy.pl/evercookie/> Turning off cookies and JavaScript will stop many, but not all. It also makes many popular websites nearly unusable. Browsing with JS and cookies off, and selectively turning them on, is an option that is only really practical for experts.
- Teapot 14y ago
  Without JS and Cookies the web is too crippled. It's not an option for most people. DNT tries to fix this on a more legal level than technical.
  - commonersense 14y ago
    Cookies and JS were workarounds introduced by Netscape. They helped us jump start e-commerce. There are certain essential tasks one just cannot do on the web without enabling JS and Cookies. Namely, e-commerce and banking (stateful transactions). This makes a compelling case for turning on Javascript and Cookies. Unfortunately, users are frequently advised to turn on JS and Cookies for other, non-essential purposes that could be accomplished without them. And we cannot say with a straight face that every use of JS and Cookies today is "essential". These Netscape workarounds have, alas, been greatly abused to the detriment of users. It's unfortunate we have to have something like DNT. It is the cost of the abusive use of JS and Cookies.
shaggyfrog 14y ago
Since no one's mentioned Ghostery yet, I highly recommend it as a way to opt-out of all sorts of stupid tracking mechanisms on the Web. http://www.ghostery.com/ http://www.ghostery.com/
lsiebert 14y ago
Hmm... Somebody could presumably bake it into chromium
idleworx 14y ago
The Do Not Track movement and its whole premise is useless. I've blogged about why this is so a while ago: http://blog.idleworx.com/2012/02/do-not-track-movement-is-useless.html http://blog.idleworx.com/2012/02/do-not-track-movement-is-us...
TazeTSchnitzel 14y ago
Jesus' words (or Lincoln's, if you wish) apply here: "If a house be divided against itself, that house cannot stand."
armini 14y ago
If that's not evil then I don't know what is.
plaes 14y ago
Will be also supported by Epiphany (default GNOME browser): http://git.gnome.org/browse/epiphany/commit/?id=f7a3fca8a8e03a5362d14e55613ac6d4103978fb http://git.gnome.org/browse/epiphany/commit/?id=f7a3fca8a8e0...
rickmb 14y ago
Opting out of a privacy violation that should not take place to begin with is insane. Also, way too little way too late. Ten years ago this might have been seen as constructive contribution towards industry self-regulation. Now it's just a sick joke that won't do anything to change the fact that tracking without explicit permission will be illegal in many parts of the world.
nikcub 14y ago
DNT does not work based on trust and if somebody is going to track you they are going to track you regardless of if you send them a HTTP header asking not to, or not (the tl;dr of the spec is that it adds this HTTP header to all requests: DNT: 1 it can be set to 1 or 0). There is also a large risk here of creating a false sense of security amongst less knowledgable users. We should be teaching users cookie control, plugin and request blocking as part of using the web, not an 'install once, forget forever' solution that doesn't work. DNT is also adding more entropy to HTTP requests, making you easier to identify or profile. You get less privacy. Think about how much an advertiser would love to know that you are privacy conscious, that puts you in a certain socio-economic group. I am a huge privacy nut and advocate but DNT will not work. The only way to fix this is better third party blocking and controls in browsers. I have been meaning to flesh out a blog post against DNT for a while, since I keep getting emails asking to comment on media stories about it being adopted.
- mike-cardwell 14y ago
  "We should be teaching users cookie control, plugin and request blocking as part of using the web, not an 'install once, forget forever' solution that doesn't work." Doomed to failure. Users shouldn't need to know this stuff, and the vast majority never will. Even if it is taught and tested at school. There are plenty of things we could do to improve privacy, but much of it will cause the major browser vendors to make less money, so is unlikely to happen. 1.) Tie all cookies to the domain in the address bar. No more third party cookie tracking. 2.) Tie all cache entries to the domain in the address bar. Gets rid of numerous tracking tricks at the cost of increasing bandwidth usage a little. 3.) Get rid of HTTP referrers. Completely. It's none of your business which site I was on before yours. These three things alone would make a huge difference. It's the low hanging fruit that we need to get before we tackle the more difficult problems. I think there's too much money involved though. The above improvements would definitely hit Microsofts and Googles bottom lines. But hey, there's no problem with insanely rich advertisers controlling the major browsers right. No conflict of interests there. EDIT: I agree with all of your other points regarding DNT. Just not the user education one. EDIT2: Another one: 4.) Make all cookies, session cookies. I configured my browser to delete all cookies on exit ages ago, and the web still works fine. I might have to type in my username each time I go to login to sites instead of having it auto-filled, but that's a good trade off. Besides, browser plugins like LastPass solve that problem better.

146 points by TomAnthony 14y ago

4ad 14y ago

The "Do Not Track" HTTP header is useless, equivalent to a "Do not Steal from Me" T-shirt. It is also harmful because it gives users a false feeling of protection and security. The question should not be why Chrome didn't implement it, but why Opera and Firefox did.

jiggy2011 14y ago
From a technical point of view it has little merit, granted. I think from a legal point of view though , you are expressing your desire to not be tracked. This would be preferable to legislation dictating that the user must manually approve all cookies etc.
- throwaway55-33 14y ago
  "you are expressing your desire to not be tracked." Yes. And I think this is important. For example, for cases brought by the FTC, class actions, and other litigation it might be useful. If a company ignores the Header sent by the user and tracks her anyway, then one could argue the company too has expressed an intent. The Header is machine readable like any other. A server can parse it and take a specific action based on its presence or absence. Arguably it does have technical merit.
rjd 14y ago
It will make all the difference in a court case when you have specifically denied consent and someone has continued to do something. If you want to get pedantic about it just being text, all law is just text, books upon books, but its the enforcement that counts. This opens the door for enforcement of other laws.
- paulgb 14y ago
  You're not denying consent, you're sending some non-standard bytes to their server which will be lost as soon as the request is processed. Without legislation, do not track is just an honor system.
  - deleted 14y ago
    [deleted]
  - rjd 14y ago
    I understand your point, but 'evil do-ers' break existing laws then this could be considered evidence. I'm fairy sure a mix privacy & contract laws in my country would hold companies subject to this as its stands if you didn't agree to allow them to do it in a EULA. Because if I'm not mistaken by accepting the request you are agreeing to contractual obligations... so the server has to accept your contract to engage in transactions... the server can choose to accept or deny this transaction... by default accepting the contract. Of course you would have a good defence against this a well, so agreed you'd need it standardised to make it a real threat against a company in court. Would be interesting to see played out in court TBH. Also if stances are made like this then changes will never manifest, because its close to useless now doesn't mean it won't become a foundation for something later.
  - wpietri 14y ago
    You're mixing levels of analysis here. You might as well say, "He didn't vote; he just used some sort of chemical-containing stick to make marks on a thin slice of a tree." Your point about legislation being needed would be stronger without that.
    - paulgb 14y ago
      My point isn't about levels of abstraction, it's about standardized communication protocols. Making marks on a thin slice of a tree conveys a vote exactly because that's what the government decided the way to make a vote would be. If I write my vote in hieroglyphic etchings on an old shoe and post it to the first lady, I can't expect my vote to be counted.
zobzu 14y ago
Well Twitter won't track you if you have "do not track" enabled. Unless you have Chrome. It should be pretty obvious why Chrome doesn't implement it. It's against the core business of Google (tracking). They will only implement if it causes a PR issue (and this very post is a PR issue btw, even thus a small one)
- jabr 14y ago
  Google has already committed to supporting it in Chrome. It's just not in it yet. I don't know if they've made any promises to honor DNT requests, but their browser will be able to send them.
- vog 14y ago
  Google has an "Incognito" mode which provides an even better tool against tracking than DNT, because it doesn't depend on the merci of the websites you are visiting. Also note that almost no other browser are supporting such a feature out-of-box, at least not when this feature was added to Chrome. So while I'm not a big fan of Google, either, I find it hard to argue that Google doesn't care about privacy features in Chrome.
  - andreasvc 14y ago
    IIRC, Firefox's private browsing mode is older than Incognito.
lolcraft 14y ago
It reminds me a lot of RFC 3514's evil bit[1]. [1] http://www.ietf.org/rfc/rfc3514.txt http://www.ietf.org/rfc/rfc3514.txt
- TazeTSchnitzel 14y ago
  We can finally rest assured our computers are safe, since all evil packets get filtered. Right?
waterlesscloud 14y ago
It enables social pressure on sites to honor it. Once it exists, sites can be forced to explain why they don't obey the users' express wishes.
- throwaway55-33 14y ago
  Not only social pressure, but perhaps legal pressure too.

revelation 14y ago

Why would Chrome not support a meaningless header sent by the client? You are asking Schneier to implement security by obscurity with emphasis on the obscurity part. Hell, you are asking the same people that sent a "This is not a P3P policy" P3P policy. Now I don't know if they think, as do I, that all of this is just meaningless extra traffic on the wire, or that they are evil and don't want to commit to privacy guarantees. No way to tell.

hmottestad 14y ago
Anyone sent in a RFC for using code 666 for "Server is evil and does not support Do Not Track headers".
- __ted__ 14y ago
  The IETF does have a network-layer solution to that. http://www.ietf.org/rfc/rfc3514.txt http://www.ietf.org/rfc/rfc3514.txt

kevinsd 14y ago

Given that Google is perhaps the only company whose main business is online ads and ads relevance is crucial, it is natural that they cannot give up the opportunity of tracking profile of ads viewers as easily as other companies.

lampe 14y ago

the thing is why should it be supported if the website is tracking you any way? its just a request to not track me but i don't can see if its really not tracking me.

SoftwareMaven 14y ago

The real question isn't whether Google's browser supports this, it's whether Google's servers support this. It may be that Google isn't adding it to the browser until it can commit to it on the server.

joejohnson 14y ago
Allowing people to opt out of tracking would decrease the load on Google's servers.
- jrochkind1 14y ago
  Well, sure, and if everybody installed effective ad blocking software so they never saw a google ad, that would decrease the load on google's servers too.
- jrockway 14y ago
  You can already opt out of ad targeting: https://www.google.com/settings/u/0/ads/preferences/?hl=en#optout https://www.google.com/settings/u/0/ads/preferences/?hl=en#o...
cooldeal 14y ago
That makes no sense whatsoever. There are a few websites which do request it, and the header will do no harm to the ones that don't. So Chrome users will be unable to use that feature (going to be?) supported by Twitter, for example. Did Google web properties use WebGL, NaCl etc. before Chrome supported them?

Jimmie 14y ago

I can hear it now "Of course not, why would an ad company sabotage itself?". Wikipedia says Chrome is set to support the header by the end of this year (2012). Wikipedia's source: http://online.wsj.com/article/SB10001424052970203960804577239774264364692.html http://online.wsj.com/article/SB1000142405297020396080457723...

cooldeal 14y ago
Even if what you said is true, it's definitely interesting that the browser that is on the forefront of implementation of almost every new web feature is about a year behind on only this one while all the other major browsers have already implemented it.
- Jimmie 14y ago
  It is a little suspicious that Chrome is dragging it's feet, isn't it? I guess we'll see if they honour their promise by the end of the year.
- chc 14y ago
  It might have to do with the fact that most Web technologies do something useful while this just sends an extra header that pretty much every site they visit will ignore. I wouldn't prioritize it either at this point in time. This is a movement that needs support from site maintainers, not browser implementors.
cpeterso 14y ago
Google also said they would drop H.264 support from Chrome, but we're still waiting.

willscott 14y ago

I still haven't heard a cogent explanation of what this is supposed to do. "Do Not Track" sounds nice, but seems no easier to scope than the initial problem of excessive information collection. I think it's safe to say that I want companies to 'track' me in order to keep me logged in for a session. Likewise, I hope that my bank keeps logs of visitors, so that it can respond to abuse / hacking attempts. Is this aimed only at behavioral advertising, or is it meant to have a broader scope? It seems like the technical execution is almost misguided without having the policy discussion first and figuring out what it is we disagree with. Without that, I don't feel like this is going to draw a strong enough line to separate people abusing tracking from the legitimate uses.

zobzu 14y ago
Do not track me for advertisement, statistics, etc. is the intent.
- __ted__ 14y ago
  Ending your list with etc. undermines your point. With this header set, can my site track what pages a user views to recommend pages to him later? Can compliant sites keep stats for engineering purposes? Grandparent is dead-on - it's bad enough that this does not affect the behavior of bad actors, but if it isn't even clear what effect it will have on good ones, the false sense of security may be worse than nothing.
  - zobzu 14y ago
    Key word is "intent". Privacy != security. Close, but not quite.
- nl 14y ago
  statistics WTF? So analytics packages will somehow have to exclude these browsers from all reports? Some reports? Can you count impressions from these users?
  - 14y ago

rmc 14y ago

This is misleading. The important actors in the "who supports Do Not Track" is not browsers but websites. "Browser support" just means "we'll tell the website that you'd rather not be tracked". If every browser sent this header, and every website ignored it, it would be a complete failure. So what, if any, websites support the "Do Not Track" header?

hej 14y ago
Chicken, egg. Someone has to start.
leocassarani 14y ago
Twitter, for one: http://www.theregister.co.uk/2012/05/18/twitter_signs_do_not_track/ http://www.theregister.co.uk/2012/05/18/twitter_signs_do_not...
recoiledsnake 14y ago
Well, websites are the ones to lose with this, not browsers(except ones with conflict of interest like Google and Microsoft). So websites can say "Hey, a popular browser like Chrome doesn't support it, so why should we?". That's why it's important for all browsers to support it so that there will be more pressure on websites to support it.
bzbarsky 14y ago
The key part is not the websites but the services (ads, analytics, etc) that sites use. For those, quoting from http://donottrack.us/implementations http://donottrack.us/implementations : 3PMobile, AdInsight, AdOcean, AdTruth, AP News Registry, Blue Cava, BlueKai, BrightTag, Chitika, Effective Measure, eXelate, Jumptap, m6d, Mochi Media, TagMan, Tealium, TruEffect, Ensighten, Twitter. Note absence of Google with their advertiser hat on, as well as Facebook.

btian 14y ago

but will be incorporated by the end of 2012

nigma 14y ago

On the other hand Google provides browser extensions that lets you opt-out from advertising cookies and Google Analytics tracking. These are not vastly popular though, each at around 100k installs for the Chrome version. https://www.google.com/ads/preferences/html/opt-out.html https://www.google.com/ads/preferences/html/opt-out.html https://tools.google.com/dlpage/gaoptout https://tools.google.com/dlpage/gaoptout

nzmsv 14y ago

As far as I can tell, this official extension for Chrome has been available since January of last year and supports the header: http://googlepublicpolicy.blogspot.ca/2011/01/keep-your-opt-outs.html http://googlepublicpolicy.blogspot.ca/2011/01/keep-your-opt-...

jnorthrop 14y ago

This will only be useful if governments enforce it. The US has included it for consideration in the US Privacy Bill of Rights[1] and the EU may enforce it as well[2]. But until there is some form of punishment for not complying with DNT it is essentially window dressing. [1]http://www.whitehouse.gov/sites/default/files/privacy-final.pdf http://www.whitehouse.gov/sites/default/files/privacy-final.... [2]http://ec.europa.eu/justice/data-protection/article-29/documentation/other-document/files/2012/20120301_reply_to_iab_easa_en.pdf http://ec.europa.eu/justice/data-protection/article-29/docum...

deleted 14y ago

[deleted]

commonersense 14y ago

If you disable Cookies and Javascript you will stop probably 90% or more of tracking. How much tracking is done without using Cookies and without Javascript? KISSMetrics? What else?

othermaciej 14y ago
There's lots of ways to track you. Here's a sampling: <http://samy.pl/evercookie/&#62 http://samy.pl/evercookie/> Turning off cookies and JavaScript will stop many, but not all. It also makes many popular websites nearly unusable. Browsing with JS and cookies off, and selectively turning them on, is an option that is only really practical for experts.
Teapot 14y ago
Without JS and Cookies the web is too crippled. It's not an option for most people. DNT tries to fix this on a more legal level than technical.
- commonersense 14y ago
  Cookies and JS were workarounds introduced by Netscape. They helped us jump start e-commerce. There are certain essential tasks one just cannot do on the web without enabling JS and Cookies. Namely, e-commerce and banking (stateful transactions). This makes a compelling case for turning on Javascript and Cookies. Unfortunately, users are frequently advised to turn on JS and Cookies for other, non-essential purposes that could be accomplished without them. And we cannot say with a straight face that every use of JS and Cookies today is "essential". These Netscape workarounds have, alas, been greatly abused to the detriment of users. It's unfortunate we have to have something like DNT. It is the cost of the abusive use of JS and Cookies.

shaggyfrog 14y ago

Since no one's mentioned Ghostery yet, I highly recommend it as a way to opt-out of all sorts of stupid tracking mechanisms on the Web. http://www.ghostery.com/ http://www.ghostery.com/

lsiebert 14y ago

Hmm... Somebody could presumably bake it into chromium

idleworx 14y ago

The Do Not Track movement and its whole premise is useless. I've blogged about why this is so a while ago: http://blog.idleworx.com/2012/02/do-not-track-movement-is-useless.html http://blog.idleworx.com/2012/02/do-not-track-movement-is-us...

TazeTSchnitzel 14y ago

Jesus' words (or Lincoln's, if you wish) apply here: "If a house be divided against itself, that house cannot stand."

armini 14y ago

If that's not evil then I don't know what is.

plaes 14y ago

Will be also supported by Epiphany (default GNOME browser): http://git.gnome.org/browse/epiphany/commit/?id=f7a3fca8a8e03a5362d14e55613ac6d4103978fb http://git.gnome.org/browse/epiphany/commit/?id=f7a3fca8a8e0...

rickmb 14y ago

Opting out of a privacy violation that should not take place to begin with is insane. Also, way too little way too late. Ten years ago this might have been seen as constructive contribution towards industry self-regulation. Now it's just a sick joke that won't do anything to change the fact that tracking without explicit permission will be illegal in many parts of the world.

nikcub 14y ago

DNT does not work based on trust and if somebody is going to track you they are going to track you regardless of if you send them a HTTP header asking not to, or not (the tl;dr of the spec is that it adds this HTTP header to all requests: DNT: 1 it can be set to 1 or 0). There is also a large risk here of creating a false sense of security amongst less knowledgable users. We should be teaching users cookie control, plugin and request blocking as part of using the web, not an 'install once, forget forever' solution that doesn't work. DNT is also adding more entropy to HTTP requests, making you easier to identify or profile. You get less privacy. Think about how much an advertiser would love to know that you are privacy conscious, that puts you in a certain socio-economic group. I am a huge privacy nut and advocate but DNT will not work. The only way to fix this is better third party blocking and controls in browsers. I have been meaning to flesh out a blog post against DNT for a while, since I keep getting emails asking to comment on media stories about it being adopted.

mike-cardwell 14y ago
"We should be teaching users cookie control, plugin and request blocking as part of using the web, not an 'install once, forget forever' solution that doesn't work." Doomed to failure. Users shouldn't need to know this stuff, and the vast majority never will. Even if it is taught and tested at school. There are plenty of things we could do to improve privacy, but much of it will cause the major browser vendors to make less money, so is unlikely to happen. 1.) Tie all cookies to the domain in the address bar. No more third party cookie tracking. 2.) Tie all cache entries to the domain in the address bar. Gets rid of numerous tracking tricks at the cost of increasing bandwidth usage a little. 3.) Get rid of HTTP referrers. Completely. It's none of your business which site I was on before yours. These three things alone would make a huge difference. It's the low hanging fruit that we need to get before we tackle the more difficult problems. I think there's too much money involved though. The above improvements would definitely hit Microsofts and Googles bottom lines. But hey, there's no problem with insanely rich advertisers controlling the major browsers right. No conflict of interests there. EDIT: I agree with all of your other points regarding DNT. Just not the user education one. EDIT2: Another one: 4.) Make all cookies, session cookies. I configured my browser to delete all cookies on exit ages ago, and the web still works fine. I might have to type in my username each time I go to login to sites instead of having it auto-filled, but that's a good trade off. Besides, browser plugins like LastPass solve that problem better.