4 ms·

There's a large effective difference between "do not track" as it is outlined in the bug, and how many people see it (see, for example, comment 16 in the report

There's a large effective difference between "do not track" as it is outlined in the bug, and how many people see it (see, for example, comment 16 in the report, and then comment 25) Specifically, it's to do with third party cookies, not any particular site. If I visit someone's website, I'm usually perfectly happy for them to record my visit and my actions. If, on the other hand, I visit their website and some invisible actor (say, an advertiser) also tracks me, then it becomes insidious, especially if that other invisible actor is active on multiple sites. This gets a bit blurred when you've got large vendors with multiple presences. For example, years ago when you logged into Hotmail, you'd be briefly redirected via passport.com (then live.com), and then directed back to Hotmail. Similarly, going to Microsoft's web page, or MSN's, or Technet, or any other site in the Microsoft stable, would redirect via the same site. This gave them single-sign-on, but also allowed them to "track" your activity across the entire network. That behaviour is used by many other large organisations such as Google. However, it's also made its way into other large sites like Facebook and Twitter, because sites like that have "social media buttons" appearning on sites that aren't served by those sites but are served by Facebook and Twitter, so becoming third-party objects, and doing the same sort of pervasive insidious tracking across multiple domains and web properties. The thing is, Google Analytics (as mentioned in the article) is such a pervasive ubiquitous invisible actor, but it's damn useful, so lots of people want to use it. The problem is that it's a third party object, and it's of massive benefit to Google too, not just the site owner. So, where "do not track" fails is in distinguishing between "tracking" that's acceptable to many people, and "tracking" that's somewhat more invisible and pervasive. Switching it all off is harmful to the internet, but until it's sold correctly, it won't be acceptable otherwise.

Silhouette 13y ago
The thing is, Google Analytics (as mentioned in the article) is such a pervasive ubiquitous invisible actor, but it's damn useful, so lots of people want to use it. The problem is that it's a third party object, and it's of massive benefit to Google too, not just the site owner. Several web font services now fall into that category as well. The problem from a user's point of view is that you can block Google Analytics or Facebook Like buttons without any loss of functionality you probably wanted, but blocking Typekit or Google Web Fonts will often mess up the rendering of a page. This changes the rules fundamentally. Before, with free services where you weren't the customer but the product, you could opt out by simply not using the service. Now, even with services where you really are the customer and maybe you really are paying for it, you can't opt out of the potentially intrusive third party service without opting out of or significantly degrading the main service you wanted to use as well. This is a tricky area. Those third party services are pervasive precisely because they are useful to people who build the web sites that users enjoy, and if they're being given away for free, they have to fund themselves somehow. I also don't have much sympathy for people who don't load up someone's web site as it was presented to them but then complain that it doesn't look right or work properly (see also: not running JS, complaining that you can't want Flash content on your iPad, etc). In some respects, these third party services are almost certainly beneficial to users, too, because they act as CDNs that probably improve performance and lower bandwidth requirements compared to having every site self-host the same common material. On the other hand, privacy matters. We have drifted into a situation where this kind of ubiquitous monitoring is widely used by site owners, but many of them probably don't even realise the implications for their users' privacy, or just don't care. We have rules about data protection and spamming and the like to deal with similar situations in slightly different contexts, and maybe it's time we had some rules about tracking by services that are incorporated indirectly on other people's web sites and possibly without a visitor's knowledge.
- 3825 13y ago
  Would it satisfy the bug reporter if we show a HTTP 401 unauthorized for anyone who has DNT turned on?
  - username223 13y ago
    I'm not the reporter, but I'd be fine with that.
belorn 13y ago
> Switching it all off is harmful to the internet. See comment 28 in the report. No one has argued to turn of all analytics on website. That is a straw man argument. The bug report simply ask that users who explicitly do not want to be tracked, can have their request granted. Turn off analytics for them and the problem is solved. Alternatively, they can use analytics that do not track each individual user. We used to live in a world where statistics did not include 100% tallied votes. It was simply too expensive to do survey on all customers, all citizens, all users. Trends and data was extracted out of a limited sized sample, commonly from a opt-in basis. With websites however, it as cheaply and easy to track all users as it is to track a limited set of users, so data tend to be 100% rather then a subset. Thus, total tracking has always been about the price, rather than need.
hsuresh 13y ago
I usually use an analogy to explain this. Tracking via first party cookies is like walking into a store that uses security cameras. I have even seen boards that inform the visitors that the store is under surveillance. Generally, the security camera is only monitored/used by the folks running the store. Third party cookies are like as if the security camera is monitored and used by a random third party company who you are not even aware of. This is why it is bad. Perhaps we should have a standard badge/button to indicate first party and third party tracking - something like https://www.safetysignsupplies.co.uk/images/product_imgs/full/969_2_3.gif https://www.safetysignsupplies.co.uk/images/product_imgs/ful... for first party cookies and a more "evil" version for third party cookies.

Silhouette 13y ago

The thing is, Google Analytics (as mentioned in the article) is such a pervasive ubiquitous invisible actor, but it's damn useful, so lots of people want to use it. The problem is that it's a third party object, and it's of massive benefit to Google too, not just the site owner. Several web font services now fall into that category as well. The problem from a user's point of view is that you can block Google Analytics or Facebook Like buttons without any loss of functionality you probably wanted, but blocking Typekit or Google Web Fonts will often mess up the rendering of a page. This changes the rules fundamentally. Before, with free services where you weren't the customer but the product, you could opt out by simply not using the service. Now, even with services where you really are the customer and maybe you really are paying for it, you can't opt out of the potentially intrusive third party service without opting out of or significantly degrading the main service you wanted to use as well. This is a tricky area. Those third party services are pervasive precisely because they are useful to people who build the web sites that users enjoy, and if they're being given away for free, they have to fund themselves somehow. I also don't have much sympathy for people who don't load up someone's web site as it was presented to them but then complain that it doesn't look right or work properly (see also: not running JS, complaining that you can't want Flash content on your iPad, etc). In some respects, these third party services are almost certainly beneficial to users, too, because they act as CDNs that probably improve performance and lower bandwidth requirements compared to having every site self-host the same common material. On the other hand, privacy matters. We have drifted into a situation where this kind of ubiquitous monitoring is widely used by site owners, but many of them probably don't even realise the implications for their users' privacy, or just don't care. We have rules about data protection and spamming and the like to deal with similar situations in slightly different contexts, and maybe it's time we had some rules about tracking by services that are incorporated indirectly on other people's web sites and possibly without a visitor's knowledge.

3825 13y ago
Would it satisfy the bug reporter if we show a HTTP 401 unauthorized for anyone who has DNT turned on?
- username223 13y ago
  I'm not the reporter, but I'd be fine with that.

belorn 13y ago

> Switching it all off is harmful to the internet. See comment 28 in the report. No one has argued to turn of all analytics on website. That is a straw man argument. The bug report simply ask that users who explicitly do not want to be tracked, can have their request granted. Turn off analytics for them and the problem is solved. Alternatively, they can use analytics that do not track each individual user. We used to live in a world where statistics did not include 100% tallied votes. It was simply too expensive to do survey on all customers, all citizens, all users. Trends and data was extracted out of a limited sized sample, commonly from a opt-in basis. With websites however, it as cheaply and easy to track all users as it is to track a limited set of users, so data tend to be 100% rather then a subset. Thus, total tracking has always been about the price, rather than need.

hsuresh 13y ago

I usually use an analogy to explain this. Tracking via first party cookies is like walking into a store that uses security cameras. I have even seen boards that inform the visitors that the store is under surveillance. Generally, the security camera is only monitored/used by the folks running the store. Third party cookies are like as if the security camera is monitored and used by a random third party company who you are not even aware of. This is why it is bad. Perhaps we should have a standard badge/button to indicate first party and third party tracking - something like https://www.safetysignsupplies.co.uk/images/product_imgs/full/969_2_3.gif https://www.safetysignsupplies.co.uk/images/product_imgs/ful... for first party cookies and a more "evil" version for third party cookies.