3 ms·

Do not track me for advertisement, statistics, etc. is the intent.

• __ted__ 14y ago
  Ending your list with etc. undermines your point. With this header set, can my site track what pages a user views to recommend pages to him later? Can compliant sites keep stats for engineering purposes? Grandparent is dead-on - it's bad enough that this does not affect the behavior of bad actors, but if it isn't even clear what effect it will have on good ones, the false sense of security may be worse than nothing.
  • zobzu 14y ago
    Key word is "intent". Privacy != security. Close, but not quite.
• nl 14y ago
  statistics WTF? So analytics packages will somehow have to exclude these browsers from all reports? Some reports? Can you count impressions from these users?
  • zobzu 14y ago
    How that's "wtf"? If I don't want companies to make statistics using what I do that sounds perfectly legitimate to me. Now then again DNT is an intent, the vendor does whatever he likes, and can support DNT for other features and still have statistics. There's no list of things you can do or not do. There's no agreement either. It's just the user indicating that they don't want to be tracked in any way.
    • einhverfr 14y ago
      It's a wtf because you can't draw any good lines on statistics. Web server admins have legitimate reasons to track (i.e. log) all requests to some extent against their web sites. We have good tools to help analyse a lot of this. Consider a real world equivalent. Suppose you walk into a bookstore and buy a book with cash. The store might not be able to track you individually but they can track how many people visited, how many books they sold, etc. You can't say that's not legitimate. So I could see an argument that the line that should be drawn is one that involved tracking cookies, but that is quite a narrow exclusion regarding statistics of individual users. You can still get pretty good stuff from the access log and there's no case to be made that DNT means Do Not Log.
      • zobzu 14y ago
        Statistics != "logging" Then again anyone is free to track/not track, stat/not stat (so far at least) and only "not track" subset of their data (as long as they don't lie) Then again there's a few privacy-aware websites who do logging and some stats but on pseudonymized IPs which is also a pretty decent compromise.
        • einhverfr 14y ago
          But what about mining statistics from logs?
  • gpvos 14y ago
    The intent is to enable users to "opt out of tracking by websites they do not visit, including analytics services, advertising networks, and social platforms". So you can have an analytics package on your site and do everything you mention, but you cannot offload your statistics gathering to yoursitename.statistics.net, which can track the user across websites, because the users are visiting your site, not statistics.net. A hypothetical and largely incorrect real-life analogy: you can use cameras to recognize regular clients and keep statistics on them, but you cannot send the camera images to another company to have them processed, because your clients are visiting your store, and not that other company. (This analogy is largely incorrect because camera images are more privacy-sensitive than cookies, and different legal and moral issues are involved, but there's still a similarity.)
• einhverfr 14y ago
  Does that mean the access_log should omit visitors who set this header? Does this mean log analysis tools should omit such records in the logs? I am confused as to how this works for statistics purposes.