5 ms·

The "Do Not Track" HTTP header is useless, equivalent to a "Do not Steal from Me" T-shirt. It is also harmful because it gives users a false feeling of protecti

by 4ad 14y ago

The "Do Not Track" HTTP header is useless, equivalent to a "Do not Steal from Me" T-shirt. It is also harmful because it gives users a false feeling of protection and security. The question should not be why Chrome didn't implement it, but why Opera and Firefox did.

jiggy2011 14y ago
From a technical point of view it has little merit, granted. I think from a legal point of view though , you are expressing your desire to not be tracked. This would be preferable to legislation dictating that the user must manually approve all cookies etc.
- throwaway55-33 14y ago
  "you are expressing your desire to not be tracked." Yes. And I think this is important. For example, for cases brought by the FTC, class actions, and other litigation it might be useful. If a company ignores the Header sent by the user and tracks her anyway, then one could argue the company too has expressed an intent. The Header is machine readable like any other. A server can parse it and take a specific action based on its presence or absence. Arguably it does have technical merit.
rjd 14y ago
It will make all the difference in a court case when you have specifically denied consent and someone has continued to do something. If you want to get pedantic about it just being text, all law is just text, books upon books, but its the enforcement that counts. This opens the door for enforcement of other laws.
- paulgb 14y ago
  You're not denying consent, you're sending some non-standard bytes to their server which will be lost as soon as the request is processed. Without legislation, do not track is just an honor system.
  - deleted 14y ago
    [deleted]
  - rjd 14y ago
    I understand your point, but 'evil do-ers' break existing laws then this could be considered evidence. I'm fairy sure a mix privacy & contract laws in my country would hold companies subject to this as its stands if you didn't agree to allow them to do it in a EULA. Because if I'm not mistaken by accepting the request you are agreeing to contractual obligations... so the server has to accept your contract to engage in transactions... the server can choose to accept or deny this transaction... by default accepting the contract. Of course you would have a good defence against this a well, so agreed you'd need it standardised to make it a real threat against a company in court. Would be interesting to see played out in court TBH. Also if stances are made like this then changes will never manifest, because its close to useless now doesn't mean it won't become a foundation for something later.
  - wpietri 14y ago
    You're mixing levels of analysis here. You might as well say, "He didn't vote; he just used some sort of chemical-containing stick to make marks on a thin slice of a tree." Your point about legislation being needed would be stronger without that.
    - paulgb 14y ago
      My point isn't about levels of abstraction, it's about standardized communication protocols. Making marks on a thin slice of a tree conveys a vote exactly because that's what the government decided the way to make a vote would be. If I write my vote in hieroglyphic etchings on an old shoe and post it to the first lady, I can't expect my vote to be counted.
      - wpietri 14y ago
        Effective communication is about what people agree on. Government recognition is one avenue for that, but it often follows the populace rather than leading it.
- notatoad 14y ago
  Is there any law that actually prevents tracking? It doesn't really matter whether you consent or not if it's legal either way.
zobzu 14y ago
Well Twitter won't track you if you have "do not track" enabled. Unless you have Chrome. It should be pretty obvious why Chrome doesn't implement it. It's against the core business of Google (tracking). They will only implement if it causes a PR issue (and this very post is a PR issue btw, even thus a small one)
- jabr 14y ago
  Google has already committed to supporting it in Chrome. It's just not in it yet. I don't know if they've made any promises to honor DNT requests, but their browser will be able to send them.
- vog 14y ago
  Google has an "Incognito" mode which provides an even better tool against tracking than DNT, because it doesn't depend on the merci of the websites you are visiting. Also note that almost no other browser are supporting such a feature out-of-box, at least not when this feature was added to Chrome. So while I'm not a big fan of Google, either, I find it hard to argue that Google doesn't care about privacy features in Chrome.
  - andreasvc 14y ago
    IIRC, Firefox's private browsing mode is older than Incognito.
lolcraft 14y ago
It reminds me a lot of RFC 3514's evil bit[1]. [1] http://www.ietf.org/rfc/rfc3514.txt http://www.ietf.org/rfc/rfc3514.txt
- TazeTSchnitzel 14y ago
  We can finally rest assured our computers are safe, since all evil packets get filtered. Right?
waterlesscloud 14y ago
It enables social pressure on sites to honor it. Once it exists, sites can be forced to explain why they don't obey the users' express wishes.
- throwaway55-33 14y ago
  Not only social pressure, but perhaps legal pressure too.

by 4ad 14y ago

jiggy2011 14y ago

From a technical point of view it has little merit, granted. I think from a legal point of view though , you are expressing your desire to not be tracked. This would be preferable to legislation dictating that the user must manually approve all cookies etc.

throwaway55-33 14y ago
"you are expressing your desire to not be tracked." Yes. And I think this is important. For example, for cases brought by the FTC, class actions, and other litigation it might be useful. If a company ignores the Header sent by the user and tracks her anyway, then one could argue the company too has expressed an intent. The Header is machine readable like any other. A server can parse it and take a specific action based on its presence or absence. Arguably it does have technical merit.

rjd 14y ago

It will make all the difference in a court case when you have specifically denied consent and someone has continued to do something. If you want to get pedantic about it just being text, all law is just text, books upon books, but its the enforcement that counts. This opens the door for enforcement of other laws.

paulgb 14y ago
You're not denying consent, you're sending some non-standard bytes to their server which will be lost as soon as the request is processed. Without legislation, do not track is just an honor system.
- deleted 14y ago
  [deleted]
- rjd 14y ago
  I understand your point, but 'evil do-ers' break existing laws then this could be considered evidence. I'm fairy sure a mix privacy & contract laws in my country would hold companies subject to this as its stands if you didn't agree to allow them to do it in a EULA. Because if I'm not mistaken by accepting the request you are agreeing to contractual obligations... so the server has to accept your contract to engage in transactions... the server can choose to accept or deny this transaction... by default accepting the contract. Of course you would have a good defence against this a well, so agreed you'd need it standardised to make it a real threat against a company in court. Would be interesting to see played out in court TBH. Also if stances are made like this then changes will never manifest, because its close to useless now doesn't mean it won't become a foundation for something later.
- wpietri 14y ago
  You're mixing levels of analysis here. You might as well say, "He didn't vote; he just used some sort of chemical-containing stick to make marks on a thin slice of a tree." Your point about legislation being needed would be stronger without that.
  - paulgb 14y ago
    My point isn't about levels of abstraction, it's about standardized communication protocols. Making marks on a thin slice of a tree conveys a vote exactly because that's what the government decided the way to make a vote would be. If I write my vote in hieroglyphic etchings on an old shoe and post it to the first lady, I can't expect my vote to be counted.
    - wpietri 14y ago
      Effective communication is about what people agree on. Government recognition is one avenue for that, but it often follows the populace rather than leading it.
notatoad 14y ago
Is there any law that actually prevents tracking? It doesn't really matter whether you consent or not if it's legal either way.

zobzu 14y ago

Well Twitter won't track you if you have "do not track" enabled. Unless you have Chrome. It should be pretty obvious why Chrome doesn't implement it. It's against the core business of Google (tracking). They will only implement if it causes a PR issue (and this very post is a PR issue btw, even thus a small one)

jabr 14y ago
Google has already committed to supporting it in Chrome. It's just not in it yet. I don't know if they've made any promises to honor DNT requests, but their browser will be able to send them.
vog 14y ago
Google has an "Incognito" mode which provides an even better tool against tracking than DNT, because it doesn't depend on the merci of the websites you are visiting. Also note that almost no other browser are supporting such a feature out-of-box, at least not when this feature was added to Chrome. So while I'm not a big fan of Google, either, I find it hard to argue that Google doesn't care about privacy features in Chrome.
- andreasvc 14y ago
  IIRC, Firefox's private browsing mode is older than Incognito.

lolcraft 14y ago

It reminds me a lot of RFC 3514's evil bit[1]. [1] http://www.ietf.org/rfc/rfc3514.txt http://www.ietf.org/rfc/rfc3514.txt

TazeTSchnitzel 14y ago
We can finally rest assured our computers are safe, since all evil packets get filtered. Right?

waterlesscloud 14y ago

It enables social pressure on sites to honor it. Once it exists, sites can be forced to explain why they don't obey the users' express wishes.

throwaway55-33 14y ago
Not only social pressure, but perhaps legal pressure too.