Do not track, as defined, was pretty meaningless. See the section of the RFC listing the exceptions: 9.3. Exceptions As a general guideline, exceptio

Do not track, as defined, was pretty meaningless. See the section of the RFC listing the exceptions: 9.3. Exceptions As a general guideline, exceptions to Do Not Track are warranted when commercial interests substantially outweigh privacy and verification interests. The following activities are excepted: 1. Tracking of users who have explicitly consented to tracking, such as by enabling a checkbox in a preferences menu on the first- party website of the tracking service. 2. Data obtained by a third party exclusively on behalf of and for the use of a first party. 3. Data that is, with high confidence, not linkable to a specific user or user agent. This exception includes statistical aggregates of protocol logs, such as pageview statistics, so long as the aggregator takes reasonable steps to ensure the data does not reveal information about individual users, user agents, devices, or log records. It also includes highly non-unique data stored in the user agent, such as cookies used for advertising frequency capping or sequencing. This exception does not include anonymized data, which recent work has shown to be often re- identifiable (see [Narayanan09] and [Narayanan08]). 4. Protocol logs, not aggregated across first parties, and subject to a two week retention period. 5. Protocol logs used solely for advertising fraud detection, and subject to a one month retention period. 6. Protocol logs used solely for security purposes such as intrusion detection and forensics, and subject to a six month retention period. 7. Protocol logs used solely for financial fraud detection, and subject to a six month retention period. To ensure data allowed for only specific uses is adequately protected, functional entities SHOULD implement strong internal controls. Basically every advertising network would fall under 2 or 3.