8 ms·
I was at Mozilla when this was implemented. It was completely optional for websites to support this. A few did at first. A lot of people internally wanted it
by gkoberger 2y ago
I was at Mozilla when this was implemented.
It was completely optional for websites to support this. A few did at first.
A lot of people internally wanted it to be on-by-default, but the argument was that if it was, nobody would respect it – after all, what tracking platform would willingly only track the 0.1% of people who went into the settings to enable it? (Internet Explorer did eventually enable it by default, which got them good press but ultimately killed the feature since everyone stopped respecting it.)
Overall, I'm happy to see this sunsetted. I don't think it actually did anything – in fact, I think it implies that it did way more than it did, so it was just a faux feeling of security.
(All that being said, I would love if the cookie modals on each site became browser-level, but I'm sure there's many reasons that hasn't happened yet. And I suspect a bit reason starts with a G and ends with an Oogle.)
- ganzuul 2y agoThere are lots of entities out there that assume consent.
- PittleyDunkin 2y agoIsn't this the entire point of browsewrapped TOS "agreements"? There's a reason why specifically tracking via cookies had to be singled out by regulation to work at all (putting aside how well or not well this actually works).
- bluGill 2y agoSince you don't have a realistic alternative should those hold up?
- ganzuul 2y agoI doubt it? Stuff only works because we can't punch each other over the internet.
- PittleyDunkin 2y agoThat's a grim view of humanity, I think. The internet is arguably the most collaborative project in the history of mankind especially outside of extractive and invasive motives. Hopefully not all of us will die before seeing serious legislation protecting that kind of social investment.
- ganzuul 2y agoIt's not a very human medium, so it is not man who is implicated.
- eastbound 2y ago> why specifically tracking via cookies had to be singled out by regulation Well, it is not singled out by regulation. The GDPR doesn’t even mention cookies at all. They mention any way to track users. Fingerprinting is also banned, for example.
- dathinab 2y agoyes, GDPR is technology agnostic many of it's predecessor sadly are not and are still around leading to absurdities of there being _both_ a GDPR dialog for tracking and a "cookie dialog" (which depending of the law might also apply to local storage and co) to get permission to "store" something on you computer. Like a hint to not track you :facepalm: (And yes legally from GDPR storing a same origin cookie only accessible to the browser and you to remember the user doesn't want to be tracked is legal _iff_ you don't use it for tracking users which don't want to be tracked server side. It's one of the many examples where "what legally is good enough" and "what security wise is good enough" can diverge quite a bit.)
- nonrandomstring 2y agoIn the words of Jonah Aragon [0] "Mozilla constantly fails to understand the basic concept of consent" [1]. [0] https://blog.privacyguides.org/2024/07/14/mozilla-disappoints-us-yet-again-2/ https://blog.privacyguides.org/2024/07/14/mozilla-disappoint... [1] https://cybershow.uk/blog/posts/you-are-too-dumb-for-tech https://cybershow.uk/blog/posts/you-are-too-dumb-for-tech
- dudus 2y agoI fully agree and have said it for years. Microsoft is the main culprit of DNT failures.
- rkharsan64 2y agoAdvertisers are the cause of DNT's failure, not Microsoft.
- gkoberger 2y agoI mean I agree, I'm against advertisers. But advertisers exist and will continue to exist, and have no incentive to follow this. I don't think either are at fault necessarily; I think it was a weak attempt all around. The only thing that will get companies to comply are a/ laws (and so far all laws have done is annoy end users) b/ browsers doing more to block tracking (which is almost impossible; this will forever be a game of cat-and-mouse).
- mrmetanoia 2y agoIt's always both, the people willing to pay someone to make things worse, and the people willing to take the money to do it.
- ASalazarMX 2y agoDNT is a failure since it relies on advertiser self-regulation. We shouldn't ask them not to track us, we should make it very hard for them to do it.
- mindslight 2y agoWe should make it both technically hard and illegal for the surveillance industry to track us. Corporations continue to reinvent de facto government from the bottom up, and if most Americans weren't too distracted freebasing the fallacy that corporations and government are opposing forces we might be able to preserve individual liberty.
- dathinab 2y ago
- firefax 2y ago>I think it implies that it did way more than it did, so it was just a faux feeling of security. Flipping that bit increased your browser fingerprint a smidge, ironically :-)
- cpeterso 2y agoApple removed Safari's DNT support in 2019 (macOS 10.14 and iOS 12.2) for that very reason: https://www.macworld.com/article/232426/apple-safari-removing-do-not-track.html https://www.macworld.com/article/232426/apple-safari-removin...
- coldpie 2y ago> I would love if the cookie modals on each site became browser-level They are, in a roundabout way. Hop into your uBlock Origin settings and enable the Cookie Banners and Annoyances filters. The modal gets silently nuked in the background and you can carry on with your browsing. Since you never consented, this ought to be functionally the same as Declining the banner. The Kill Sticky bookmark works similarly, for crappy browsers that don't support uBlock Origin (eg iOS, Chrome for Android): https://www.smokingonabike.com/2024/01/20/take-back-your-web-browser-screen-space-with-kill-sticky/ https://www.smokingonabike.com/2024/01/20/take-back-your-web... (Remember when web browsers used to treat their users first and implemented things like Popup Blocking, enabled by default? I miss those days.)
- darkhorse222 2y agoAs long as someone who does this is prepared to pay for every site they do it on (or forgo the site in the future), since targeted advertising often pays for the site they're visiting. Personally I would like to see ads improved, not removed, as I am unwilling to have 40 different subscriptions to 40 different websites all because every user disabled targeting.
- coldpie 2y ago> Personally I would like to see ads improved Sure, sounds good. When you win that fight, let me know and I'll reconsider the ad blocker.
- darkhorse222 2y agoI doubt it. In my experience those that block ads feel entitled to the content without payment of any kind. They see ads as an intrusion rather than a fair exchange. No, I don't see you turning it back on regardless of how things go. The average user doesn't even recognize that running a website literally cost electricity that must be paid for. Who pays for it? Who will carry the boats?
- 2y ago
- wlesieutre 2y ago> IE did enable it by default, which got them good press but ultimately killed the feature since everyone stopped respecting it. That's why RFC 35140 "Do-Not-Stab" specifies that the user agent MUST NOT enable it by default. https://www.5snb.club/posts/2023/do-not-stab/ https://www.5snb.club/posts/2023/do-not-stab/
- araes 2y ago> most stabbings are not done by malicious actors, they are simply law-abiding companies which will gladly stop stabbing you if you ask. > The header has only one form, Do-Not-Stab: 1. This is because the lack of a header indicates a clear preference that the user wants to be stabbed. > Exceptions to the Do-Not-Stab header are accepted when commercial interests outweigh safety concerns. These include: Stabbings requested by a government. Websites SHOULD NOT try to challenge the legality of any stabbings requested, the user probably deserved it.
- jmward01 2y agoI had been on the fence about turning this on or not since I wasn't sure if turning it on would block legitimate reasons for stabbing me. I mean, I probably have deserved it many times. Good to know those reasons won't be blockers! I'll definitely turn this on if it becomes a ratified standard!
- hedora 2y agoThe government turned it on by default for everyone, so now it’s just universally ignored. Happily, our local police department is sunsetting it, since it gives people a false impression of whether or not they’re currently being stabbed.
- deleted 2y ago[deleted]
- danaris 2y ago> but ultimately killed the feature since everyone stopped respecting it I genuinely doubt that anything could have caused them to respect it. Tracking without consent is the source of their money; they're not going to give that up just because you give a positive signal that you do not consent, rather than simply never asking you in the first place.
- bobbruno 2y agoHow about a hefty fine and the risk of some jail time?
- mathfailure 2y ago[flagged]
- gkoberger 2y agoI had nothing to do with any of this, but go off I guess.
- mathfailure 2y agoOh, I didn't mean you personally, I hoped you acted as a team and you were part of the team making this decision.
- onli 2y agoThe legal situation has completely changed since then. By now, we have court cases punishing companies for ignoring the dnt signal. And with the gdpr there is a legal framework that makes this signal powerful anyway. Removing this feature now is completely the wrong move. Instead Mozilla should have invested money to use the courts to make the signal be respected, where it isn't already. For me, this signals that finally, Mozilla has completely crossed the line. I will look into forks now that retain the signal.
- necubi 2y agoI worked at one of the big adtech companies at the time. DNT was a carefully negotiated compromise between the ad industry (and by proxy, the sites that depended on it for their income), the browser vendors, and privacy advocates. We implemented DNT it in our edge infrastructure and were ready to deploy it. But then Microsoft broke the agreement by enabling it by default, as part of their war with Google (and after their own adtech ambitions ended in a 6 billion dollar write down on their acquisition of aQuantive). This killed it for everyone. The ad industry was never going to go for an opt-out version of DNT. It worked while only a minority that cared about it opted-in, but not when the (then) dominant web browser made that choice for all of its users. I fully understand why people hate tracking and targeted advertising (which has if anything gotten more invasive in the past decade), but at least at the time it was essential to the commercial web.
- cpeterso 2y agoIn response, Apache added code to ignore the DNT header from Internet Explorer 10 browsers: https://www.theverge.com/2012/9/11/3314211/ie10-dnt-header-microsoft-apache-server-roy-fielding https://www.theverge.com/2012/9/11/3314211/ie10-dnt-header-m...
- throwaway48476 2y ago>at the time it was essential to the commercial web. The same could be said about slavery.
- hedora 2y agoThe same can and is said about slavery and the financial viability of for-profit prisons: https://calmatters.org/politics/elections/2024/11/california-election-result-proposition-6-fails/ https://calmatters.org/politics/elections/2024/11/california... It doesn’t mean either statement is true though.
- wkat4242 2y agoThese days an opt out solution is illegal in the EU and probably more jurisdictions will follow. So enabling by default is normal. What also would be legal is to offer the user a choice at the first startup.
- miki123211 2y agoI think a new browser could genuinely gain massive popularity if it was really good at this, and advertised the feature heavily, particularly in the EU. Google will never touch it with a hundred-foot pole due to antitrust concerns, they're effectively banned from making any significant, user-experience-affecting changes to Chrome at this point. Many people would immediately switch to a browser with 1) reliable Youtube ad blocking, 2) no cookie modals, and possibly 3) no other "distractors", like subscription pop-ups or "related articles" widgets. Yes, ad blockers and reader mode can sort-of do all three, mostly, ish, but they're not easy to set up for non-techies, particularly on smartphones, even more particularly on iPhones, so a simple marketing pitch of "get this app, have these features" would probably work. One would have to default to accepting cookies, though. Most users don't care either way, while website owners do. If you defaulted to refusing, they'd try to fight you and make their popups harder to auto dismiss, while auto-accepting would do the opposite.
- binarymax 2y agoDDG privacy browser and Brave browser are both trying to make this work. Personally I use FF with lots of blockers and settings on my laptop/desktop, and DDG browser on my mobile.
- gkoberger 2y agoI somewhat agree... but browsers aren't a profitable business. In 30 years of browsers being mainstream, nobody has built one that's sustainable –– only works if it's subsidized by a larger company. There's been a few attempts (Brave wants to monetize via crypto, Arc is pivoting away), but it's really hard. People don't want to pray for a browser – 99% of people are apathetic, and the 1% that cares aren't known for paying for things.
- throwaway48476 2y agoNo one has built a sustainable one because it it subsidized.
- photonthug 2y agoAfter 30 years, isn’t it weird that the conversation is still about whether building a browser is profitable or if users are willing to pay for one? One would think that the technology would be so mature and ubiquitous that this is not a major issue 30 years later. If the core technology is still changing so fast that browsers need to be in constant development for the entire duration of their useful lifespan, maybe that is the problem, and the web is just doomed to be a shit show until corporations are distracted by enshittification of alternative platforms like VR. It’s just weird that a few hobbyists can generally throw together a database in a weekend, fork kubernetes and probably run with it forever if they really wanted to, create a free operating system that takes over the world, etc. And yet for browsers, we’re shaking our heads and saying the situation is impossible, we kind of always have done this, and it looks like we always will.
- kuschku 2y ago> Overall, I'm happy to see this sunsetted. I don't think it actually did anything – in fact, I think it implies that it did way more than it did, so it was just a faux feeling of security. I'm sad to see this, as many sites actually used it. Geizhals.de, a major european price comparison site, uses DNT as cookie opt out. My personal sites, but also the official websites from a few companies I worked at used umami or plausible metrics, configured to obey the DNT header for opt out handling. And only recently German courts have ruled that the DNT header is legally considered rejection of tracking (Az.: 16 O 420/19) It's actively used across the web, and Mozilla just decides to kill it? What the heck?
- cogman10 2y agoI have a friend that works in advertisement programming. Quiet ironically, "do not track" had the opposite of the intended effect. They didn't store any information about a user, except in the case of the do not track signifier in which case they had special tracking logic to make sure they didn't include that user in their datasets and future user models.
- secondcoming 2y agoAll adtech companies (should) do this. The 'special tracking logic' is just a flag that says whether anything considered PII is logged or not.
- mmooss 2y agoI thought DNT was a creative solution: The only way to stop tracking is via laws or regulations. Technical solutions are, arguably, a never-ending arms race - probably a losing one for end users. DNT was a way to demonstrate consumer interest in not being tracked, and it put businesses in the position of ignoring explicit requests from consumers for privacy. Unfortunately, nobody effectively capitalized on that.
- HWR_14 2y agoTechnical solutions seem to work very well. Ad-blockers remain effective.
- deleted 2y ago[deleted]
- notatoad 2y ago>I would love if the cookie modals on each site became browser-level, if the EU regulators who wrote the cookie law had any competence, this is how it would have been implemented. browsers should have a cookie prompt in the UI, not websites.
- xorcist 2y agoIt should be straight up illegal to share my data with third parties. That's not something I as an end user should be forced to opt in to. A browser level opt-in would be even more useless than a website prompt. Demonstrably almost no end users understand what they opt in to, and that type of contract should therefore carry close to zero weight.
- daveoc64 2y agoThe law is not about cookies - it's about processing data. A browser feature to control cookies wouldn't cover everything the law does.
- salawat 2y agoHere's the thing. Do-Not-Track was an active signal of intent from the user to the backend. Violation therefore, could be proven by merely showing the signal was sent, and the provider ultimately ignored it. Getting rid of it for being "ignored" is ignoring that it is a means for the User to signal to the rest of us they do not wish to take part in tracking. Which in our world, is the important bit. A provider not being challenged with this bit can argue that the user doesn't mind being tracked because they didn't explicitly say so. Mozilla is being a complete moron.
- ErigmolCt 2y agoI agree that sunsetting it is the right move, especially if it prevents the illusion of security