4 ms·
But has there ever been a precise specification of what it means to "track" a user? Does "track" have any finite meaning, or is it just an open-ended plea from
by qwerty_asdf 12y ago
But has there ever been a precise specification of what it means to "track" a user? Does "track" have any finite meaning, or is it just an open-ended plea from the user for everyone to pretend that certain events never happened?
To speak of "tracking" one might mean:
A. Thou shalt not cookie a user.
B. Thou shalt not record plain text log files on a
server-side file system, regarding the nature of these
requests. Thou shalt not persist discrete information
to a relational database, with respect to these
particular HTTP requests.
C. Thou shalt not inspect which IP address HTTP POST
requests originate from, and treat them differently, if
a user proclaims "no tracksies". GET requests will be
treated as read-only requests for static resources. If
the static resources change, I wish to play no part in
such events.
D. Thou shalt neither inspect ANY HTTP requests (PUT,
DELETE, POST or GET), nor serve individualized
resources, regardless of any particular attributes
present in the request. Thou shalt only keep the
specific data I tell you to keep, and destroy
everything else related to my requests. At a later
point in time, I reserve the right to become
irrationally angry about your having kept the *some* of
the data I told you to keep, because, technically
speaking, the DO-NOT-TRACK header is all encompassing,
and supercedes all other instructions. I also reserve
the right to get angry if *your* system does not
perform according to *my* expectations, whatever those
expectations may be, at any particular time.
E. Thou shalt not provide me with any uniquely
identifiable information. I do not wish to receive
information which has not already been provided to
anyone else. Please do not transmit unique information
to me over the wire or over the air. Doing so will
change the state of my system in a unique way, which
I'll eventually have to answer to. If I receive non-
standard resources and information from you, my service
provider and local authorities, may use this against
me, and derive other information from these details. I
may be penalized for knowing or having things other
people do not.
F. This never happened. I don't exist. You don't exist. We
don't know each other. There was never any /index.html
or /default.htm available here. I never asked for it,
and if anyone did ask for it, you just said "404". You
don't know how many people were looking for that file,
or whether it was 5KB or 17MB at any particular time.
One can easily understand how a user might urgently want for one or all of those, or even more stringent restrictions to be adhered to, under certain circumstances, but in some cases, the very nature of the beast is for a given server or cluster to maintain a certain degree of situational awareness, regarding the current state of user activity requested.
Beyond even that, in most cases, for a user to simply request the common courtesy of being forgotten might be unrealistic and completely ineffective from the outset.
"Please don't track me, but here's my ID and password, now log me into my account."
I can think of several ways to interpret that. Worse yet, the fact that a user may have cookies turned on, and has sent the request in plain text, across ten other systems beyond my own control (all of which should also respect the user's wishes) completely defeats any realistic expectations of non-disclosure.
An honor system is certainly an admirable aspiration, but sending "do not track" requests by default also creates a general atmosphere of noise from users who may or may not be cognizant of the true nature of their actions.
The knee-jerk idea that cookies are bad isn't good enough. The idea that you can simply ask people to "be nice" also isn't good enough.
Dumb people are always going to be their own worst enemies, by playing the role of low hanging fruit to be preyed upon.
I've always felt that "do-not-track" requests were bullshit, just like the European cookie law was a silly white wash. (servers remember data, it's what they do. businesses exploit their customers for a profit, it's what they do.)
Just like having to opt into a "do-not-call" registry is bullshit. (no one wants to be cold-called by telemarketers, so why is this an opt-in thing?)
Just like anti-virus software is bullshit. (hey, how about you just don't execute code indiscriminately? doesn't that work too?)
The list goes on...