5 ms·

Tracking by default is not an acceptable solution, so I would say respecting the Do-Not-Track header must be mandatory and enforced by laws and percentage of gl

Tracking by default is not an acceptable solution, so I would say respecting the Do-Not-Track header must be mandatory and enforced by laws and percentage of global revenue fines.

bradleyy 1y ago
GPC (Global Privacy Control) is the header that's actually being enforced in (parts of) the US. DNT is considered deprecated by many, due to the nonconsensual way that Microsoft rolled it out.
- Nextgrid 1y ago
  Why is Microsoft's implementation a problem? Having the setting default to a safe value is the rational choice. It's like saying having a secure OS/browser would deprive malware authors of revenue, and thus vulnerabilities should be preserved unless the user explicitly opts into patching them.
  - TheCoelacanth 1y ago
    Yeah, and according to most privacy laws, not tracking should be the default.
  - bradleyy 1y ago
    https://en.wikipedia.org/wiki/Do_Not_Track#Internet_Explorer_10_default_setting_controversy https://en.wikipedia.org/wiki/Do_Not_Track#Internet_Explorer... This combined with governments ignoring it, and actively enforcing GPC... it's questionable whether compliance is necessary (I still suggest treating it the same as a GPC signal). But future work and effort should be put towards the GPC signal.
- velcrovan 1y ago
  For a new corporate website we just completed, we used GPC signals as the opt out mechanism. If your browser sends GPC, the site just opts you out of everything and loads zero tracking scripts. If it doesn't, you see a popup that explains how to turn it on if you want, or an "I understand" button. An approach like this seems ideal to me, the problem is that it's only natively supported in Firefox. Our instructions for Chrome and Edge are basically "install Privacy Badger." And Safari is the WORST, which as an Apple customer it pains me to say. Not only does the browser not support it, there are ZERO Safari browser extensions, NONE, on ANY platform (mac/iphone/ipad), that you can install that will send a simple GPC signal with the HTTP headers. There is a paid Safari extension on iOS called ChangeTheHeaders that you can configure to send a GPC signal, but come on, you can't ask normal people to buy an app and manually enter a specific HTTP header. (ChangeTheHeaders is made by Jeff Johnson, the same dev as StopTheMadness. I asked him whether he'd consider adding user-friendly GPC signals to that (or any other) plugin and he said it would just be "duplicating functionality" :-/ )
  - bradleyy 1y ago
    It's sounding like California is going to require browser manufacturers to support the GPC signal. The privacy movement in California has a lot of political power and backing; it's pretty likely this will change in the next couple years.
    - velcrovan 1y ago
      From what I understand, their AG has said the GPC signal must be honored if sent and that it is an acceptable opt-out mechanism under the CCPA. I haven't heard anything concrete about requiring browsers to support it, but that would be a welcome development. https://oag.ca.gov/privacy/ccpa/gpc https://oag.ca.gov/privacy/ccpa/gpc
      - bradleyy 1y ago
        California's "Opt Me Out Act" (AB 566) requires that by January 1, 2027, internet browsers must provide a built-in, easy-to-use setting that allows users to send an opt-out preference signal, such as Global Privacy Control. (copied from a search, but wanted to let you know)
layer8 1y ago
That wouldn’t help much in terms of annoyance, because you need the option of per-site or per-service opting-in to tracking cookies (like “remember me” checkboxes and similar functionality), and then you can’t really prevent web pages showing a banner offering that opt-in option. It wouldn’t be exactly the same as today’s cookie banners, but websites would made it similarly annoying.
- wtetzner 1y ago
  Unless it was a browser level permission, like asking to access the user's location.
  - layer8 1y ago
    The website has to be able to inform you about what exactly you are opting in to (like saving your shopping cart, and/or who they will be sharing the respective information with). This can’t be covered by a predefined set of options. Browser-level permissions are about what the browser is sharing with the website, which is a different thing. For one, the browser sharing information with the website isn’t a blanket permission legally for the website to do anything with that information it likes.
    - itopaloglu83 1y ago
      I’m sorry but no. Don’t track me means don’t track me, period. Asking if you could track me etc. regardless is against the spirit of it and simply user hostile.
      - layer8 1y ago
        So you want to make it illegal for websites to inform you about the services they offer that work with tracking cookies? Users often want some level of tracking, like not having to log in to services they use across sites each time.
        xcf_seetan 1y ago

Tracking by default is not an acceptable solution, so I would say respecting the Do-Not-Track header must be mandatory and enforced by laws and percentage of global revenue fines.

bradleyy 1y ago

GPC (Global Privacy Control) is the header that's actually being enforced in (parts of) the US. DNT is considered deprecated by many, due to the nonconsensual way that Microsoft rolled it out.

Nextgrid 1y ago
Why is Microsoft's implementation a problem? Having the setting default to a safe value is the rational choice. It's like saying having a secure OS/browser would deprive malware authors of revenue, and thus vulnerabilities should be preserved unless the user explicitly opts into patching them.
- TheCoelacanth 1y ago
  Yeah, and according to most privacy laws, not tracking should be the default.
- bradleyy 1y ago
  https://en.wikipedia.org/wiki/Do_Not_Track#Internet_Explorer_10_default_setting_controversy https://en.wikipedia.org/wiki/Do_Not_Track#Internet_Explorer... This combined with governments ignoring it, and actively enforcing GPC... it's questionable whether compliance is necessary (I still suggest treating it the same as a GPC signal). But future work and effort should be put towards the GPC signal.
velcrovan 1y ago
For a new corporate website we just completed, we used GPC signals as the opt out mechanism. If your browser sends GPC, the site just opts you out of everything and loads zero tracking scripts. If it doesn't, you see a popup that explains how to turn it on if you want, or an "I understand" button. An approach like this seems ideal to me, the problem is that it's only natively supported in Firefox. Our instructions for Chrome and Edge are basically "install Privacy Badger." And Safari is the WORST, which as an Apple customer it pains me to say. Not only does the browser not support it, there are ZERO Safari browser extensions, NONE, on ANY platform (mac/iphone/ipad), that you can install that will send a simple GPC signal with the HTTP headers. There is a paid Safari extension on iOS called ChangeTheHeaders that you can configure to send a GPC signal, but come on, you can't ask normal people to buy an app and manually enter a specific HTTP header. (ChangeTheHeaders is made by Jeff Johnson, the same dev as StopTheMadness. I asked him whether he'd consider adding user-friendly GPC signals to that (or any other) plugin and he said it would just be "duplicating functionality" :-/ )
- bradleyy 1y ago
  It's sounding like California is going to require browser manufacturers to support the GPC signal. The privacy movement in California has a lot of political power and backing; it's pretty likely this will change in the next couple years.
  - velcrovan 1y ago
    From what I understand, their AG has said the GPC signal must be honored if sent and that it is an acceptable opt-out mechanism under the CCPA. I haven't heard anything concrete about requiring browsers to support it, but that would be a welcome development. https://oag.ca.gov/privacy/ccpa/gpc https://oag.ca.gov/privacy/ccpa/gpc
    - bradleyy 1y ago
      California's "Opt Me Out Act" (AB 566) requires that by January 1, 2027, internet browsers must provide a built-in, easy-to-use setting that allows users to send an opt-out preference signal, such as Global Privacy Control. (copied from a search, but wanted to let you know)

layer8 1y ago

That wouldn’t help much in terms of annoyance, because you need the option of per-site or per-service opting-in to tracking cookies (like “remember me” checkboxes and similar functionality), and then you can’t really prevent web pages showing a banner offering that opt-in option. It wouldn’t be exactly the same as today’s cookie banners, but websites would made it similarly annoying.

wtetzner 1y ago
Unless it was a browser level permission, like asking to access the user's location.
- layer8 1y ago
  The website has to be able to inform you about what exactly you are opting in to (like saving your shopping cart, and/or who they will be sharing the respective information with). This can’t be covered by a predefined set of options. Browser-level permissions are about what the browser is sharing with the website, which is a different thing. For one, the browser sharing information with the website isn’t a blanket permission legally for the website to do anything with that information it likes.
  - itopaloglu83 1y ago
    I’m sorry but no. Don’t track me means don’t track me, period. Asking if you could track me etc. regardless is against the spirit of it and simply user hostile.
    - layer8 1y ago
      So you want to make it illegal for websites to inform you about the services they offer that work with tracking cookies? Users often want some level of tracking, like not having to log in to services they use across sites each time.
      - xcf_seetan 1y ago