8 ms·

An Update on Microsoft’s Approach to Do Not Track

63 points by thisisblurry 12y ago

forgottenpass 12y ago
but we will provide customers with clear information on how to turn this feature on in the browser settings should they wish to do so A smart reaction to the given reason companies were ignoring DNT. But as long as more than X% of people enable it, websites that want to track will keep coming up with lame excuses to ignore it.
- kodablah 12y ago
  Hopefully those who are privacy-conscious will be able to use some kind of browser extension that checks for the "Tk" header response and also has a list of known offenders. Defining whether a site is an offender or not and what institution is going to keep track of that is the hard part though.
- hackuser 12y ago
  > websites that want to track will keep coming up with lame excuses to ignore it. DNT is a political solution, IMHO. Many websites and industries claim that consumers accept tracking. If the consumer sends a contrary message every time they connect, tracking them anyway is a practice that is difficult to defend in front of the FTC and Congress, and in the court of public opinion. On another level, it's simply rude.
- ams6110 12y ago
  Would hold a lot more water if it weren't a NEGATIVE affirmation, with an unreasonable default (assuming most people WANT to be tracked unless they take the trouble to tell you otherwise?) Option should have been "Track Me", unselected by default. If a person wants to be tracked, let them say so.
  - remarkEon 12y ago
    I think this is definitely true. If my parents were prompted when they installed IE with an explicit message that said "Do you want to be tracked by websites you visit in Internet Explorer?" my dad's response would probably be "wtf they can do that?" and then promptly select "NO".
    - derefr 12y ago
      You have to assume they at least wouldn't allow the question to be presented in a straw-man manner like that; nobody would agree to being tracked if they didn't see what the point of the tracking was. The actual positive form of the question, ignoring the politics and just thinking about user intent, would be something like "Do you want this computer to serve a unique fingerprint to websites, allowing companies to both reconstruct your identity between sites on their network, or to persist your identity after you have purged cookies and other session data? Companies tend to use this tracking ability to enhance your advertising experience, to collect statistics on the usage of their sites, and to ensure they don't double-count you. Malicious uses of this data are also possible, though currently rare." The important bit of the question, when phrased this way, is that it doesn't just ask about a mechanism (the DNT header), but about the user's intent—and because of that, it's activation state could be made to control all sorts of things besides the DNT header. For example, saying "no" to the question should cause the browser to try to add some per-domain jitter to its answers to questions about what links are visited, what fonts are installed, what the User-Agent string is, etc., so that the browser can't be fingerprinted.
      - implicitAgendas 12y ago
        I don't understand your opinion regarding any kind of straw man fallacy. Can you elaborate on where the fallacy emerges? The idea that advertising needs "enhancement" sounds suspicious. Couching the premise of the question in 77 words of pseudo-legalese-style terms and conditions would muddy the waters, and sow confusion, and probably innure users to do anything to make the checkbox go away, so they can simply get to the internet. Politics aside, that kind of twisting and turning smells like a dark pattern, in my opinion.
  - bobajeff 12y ago
    Yeah this. Exactly. This is what DNT attempt 2.0 should be. "Do you want Ad agencies to gather and possibly share with or sell to their partners about your browsing activity?"
    - rsuelzer 12y ago
      Unfortunately, at least two of the major browsers are also run by major advertising and tracking firms. There is an inherit conflict of interest here.
      - realityking 12y ago
        I may just be very slow right now (it's late, a holiday, and I had too much to eat), but who, besides Google, are you referring to?
        rsuelzer 11y ago
        Microsoft & Google. Not Apple, but certainly not for a lack of trying.
        freehunter 12y ago
        Bing Ads.
        dragonwriter 12y ago
        Well, Apple tried to be a major advertising firm (and still tries) with iAd. Though I don't know that I'd say that they are such a firm.
jgrowl 12y ago
People that aren't tech savvy and won't understand how to configure their browser are exactly the reason why DNT should be default. Sites that ignore DNT should be blacklisted.
- abetaha 12y ago
  Agree, however if the user sets the DNT explicitly, sites will have no excuse to ignore it anymore.
- chc 12y ago
  What does Do Not Track even mean if it does not signify the user's wishes? Why would people be expected to respect a request not to be recognized that somebody doesn't even know they're making? In its current state, Do Not Track is literally meaningless. Any company that respects Do Not Track is probably just not tracking anyone at all, because as long as Do Not Track is the default, it does not actually represent a user's preference.
  - teacup50 12y ago
    Why would a user want to be tracked?
    - chc 12y ago
      Well, for example, I've heard more than one person say things along the lines of, "If I'm going to see ads, I would rather see relevant ones than irrelevant ones." But more importantly, this isn't a binary flag. People might want to be tracked, they might want not to be tracked, or — most likely in my opinion — they might not give two hoots. Similarly, when people walk into an physical place, they might want to be looked at, they might not want to be looked at, or they might not be particularly concerned with whether anyone in particular is looking at them.
      - teacup50 12y ago
        That's nonsense used to justify invasive and immoral tracking, nothing less.
deleted 12y ago
[deleted]
dudus 12y ago
It was always the intention of DNT to represent the user choice. It was just not explicit that it should be OFF by default. Reviewers fault. Microsoft, made a Marketing stunt of enabling it by default 2 years ago, in practice killing the point of DNT and setting back the industry several years. With a default option DNT would have no reason to be honored by any site owner. We could be enjoying native DNT tracking right now if Microsoft hadn't done that stupid dick move 2 years ago. How many years we'll need before the number of users that already have DNT set to ON by default are negligent is hard to measure. This should be a post apologizing for the trouble they caused and for destroyed the point of a W3C proposal that set back the industry for several years. Instead it looks like another Marketing stunt.
- jszymborski 12y ago
  While I'm all for having DNT's default set to ON, how much does it really change? Is there really any impetus for companies to not track you when you send a DNT header? Is there really any governing body that enforces it in any meaningful way?
  - rspeer 12y ago
    I can imagine a release of a plugin similar to Privacy Badger or Ghostery that whitelists sites that honor DNT and follow a reasonable privacy policy. I'd use it. This may seem paradoxical, in that this plugin would only work correctly by not sending DNT to those sites. But I've found that some tracking cookies are useful (the one for editing Wikimedia projects, for example), and sites should be able to earn their way onto a whitelist, as long as they honor the requests of people who say "No. Don't track me. Not even you."
- outside1234 12y ago
  Really? Its Microsoft's fault? I totally agree that "Don't Track" should be the default. I get the new proposal as well - but to say that they somehow set it back is BS. What is holding it back is that there are no teeth to it - no laws that you must respect it - and lots of rewards for ignoring it. That's what needs to change.
sgift 12y ago
Probably a good approach to deprive companies tracking users of some of their excuses ("it's not really the will of the people if you pre-activate it" ... yeah, sure), but I feel a working DNT implementation will need law support and very harsh punishments. That would be at least far more useful than the EU cookie law in helping people.
yuhong 12y ago
I wonder if anyone used IE11's interface for getting user permission before tracking.
higherpurpose 12y ago
> As a result, DNT will not be the default state in Windows Express Settings moving forward I always disable all of Microsoft's "on" settings when installing Windows, as they usually try to pass some sneaky stuff by me, and even if I don't fully understand what something does, I feel safer having disabled it. As for the DNT option, I've never really cared for it, as I never use IE for anything. But my point is that Microsoft tries to hide these "user choices" in its Express Settings when installing Windows, so of course this doesn't reflect people's true choices. Now if only Microsoft approached their "default settings" there in the same way, and didn't assume stuff like "you want to use a Microsoft account, rather than a local account, don't you?" (This is actually represents two of the top 3 request in Windows 10 user feedback in the Security section - not requiring a Microsoft account by default). https://windows.uservoice.com/forums/265757-windows-feature-suggestions/category/87210-security-privacy-and-accounts https://windows.uservoice.com/forums/265757-windows-feature-...
- mynameisvlad 12y ago
  What? That was in Win8: http://www.theeldergeek.com/windows_8/win8_install_setup_personalization_screens.htm http://www.theeldergeek.com/windows_8/win8_install_setup_per... (Sign in without a Microsoft Account) And Win8.1: http://www.theeldergeek.com/windows_8/win_8_1_install_setup_personalization_screens.htm http://www.theeldergeek.com/windows_8/win_8_1_install_setup_... (Create Account > Sign in without a Microsoft account) At no point were you required to use a MSA, it was always the preferred option (since you get the sync, OneDrive, as well as automatically signing into the store and any other Microsoft services) but you always had the ability to turn it off in the setup screens, and the option was always clearly labeled. If you didn't want an MSA, local accounts worked perfectly fine as the default account on the box, and you can always convert to and from within the PC settings.
npizzolato 12y ago
> Without this change, websites that receive a DNT signal from the new browsers could argue that it doesn’t reflect the users’ preference, and therefore, choose not to honor it. With this change, websites could argue that they don't care and choose not to honor it. Is there any actual enforcement of Do Not Track? If not, the whole idea seems broken at its core.
danbruc 12y ago
This whole thing is pretty silly. If you are not sending a DNT signal then almost surly only because you don't know about it or you don't care enough, almost surly not because you really prefer being tracked. Or is there really a relevant group of users preferring to be tracked? If yes, why?
- smileysteve 12y ago
  I have slightly positive feelings towards retargeting.
- kllrnohj 12y ago
  Because I rather like that my search results are improved, my ads are less random, and recommendations are useful. Sure if you ask the question "do you want to be tracked?" you'll get an obvious no. If you ask the question "do you want better search results?" you'll get an obvious yes. Biased questions lead to biased answers.
  - danbruc 12y ago
    I did not want to imply any bias in the formulation of the question. I personally don't want to see any ads at all, I don't want to live in a search bubble and I don't care about recommendations. I can not see any way in which tracking and creating a profile about me could provide me enough additional value that I would be willing to compromise on privacy. But this is of course only me, I hear rumors that there are actually people valuing ads. But I am still not convinced, the right question is neither »Do you want to be tracked?« nor »Do you want better search results?« but »Do you want better search results at the price of being tracked?«. My personal answer is a definitive no but I can't really tell in case of the general population.
cm2187 12y ago
The debate on DNT is completely sterile as this thing is absolutely toothless. It's like advertising a flag "do not infect me" as an anti-virus technology.
- azakai 12y ago
  A fence might also be easy to climb over, but can still clearly indicate where private property begins, and that trespassing there is wrong.
  - rascul 12y ago
    It's more equivalent to painting a line on the ground than a fence. Climbing a fence takes more effort than ignoring DNT.
    - azakai 12y ago
      Good point. But painted lines on the ground still have social power, for example in parking lots, where most people obey them. Hopefully the same is true for DNT as well.
ShannonSofield 12y ago
The fact that I still get snail mail spam catalogs in my mailbox each day, with no mandated option to opt-out, I see no way that marketers will respect DNT. The gov't seems to believe that the economy relies on its ability to market to consumers, even if they don't want to be targeted.
- mynameisvlad 12y ago
  http://www.consumer.ftc.gov/articles/0262-stopping-unsolicited-mail-phone-calls-and-email http://www.consumer.ftc.gov/articles/0262-stopping-unsolicit... may help with unsubscribing.
Panino 12y ago
Consider the possibility that DNT does more harm than good: 1) Since it's not default, it makes browsers more unique and thus more trackable. 2) It gives many (perhaps even most?) non-technical users a false sense of security, making them less likely to take more effective measures. Weighed against what miniscule good DNT might do (I think it does next to none), these two reasons alone make DNT harmful.

63 points by thisisblurry 12y ago

but we will provide customers with clear information on how to turn this feature on in the browser settings should they wish to do so A smart reaction to the given reason companies were ignoring DNT. But as long as more than X% of people enable it, websites that want to track will keep coming up with lame excuses to ignore it.

kodablah 12y ago
Hopefully those who are privacy-conscious will be able to use some kind of browser extension that checks for the "Tk" header response and also has a list of known offenders. Defining whether a site is an offender or not and what institution is going to keep track of that is the hard part though.
hackuser 12y ago
> websites that want to track will keep coming up with lame excuses to ignore it. DNT is a political solution, IMHO. Many websites and industries claim that consumers accept tracking. If the consumer sends a contrary message every time they connect, tracking them anyway is a practice that is difficult to defend in front of the FTC and Congress, and in the court of public opinion. On another level, it's simply rude.
ams6110 12y ago
Would hold a lot more water if it weren't a NEGATIVE affirmation, with an unreasonable default (assuming most people WANT to be tracked unless they take the trouble to tell you otherwise?) Option should have been "Track Me", unselected by default. If a person wants to be tracked, let them say so.
- remarkEon 12y ago
  I think this is definitely true. If my parents were prompted when they installed IE with an explicit message that said "Do you want to be tracked by websites you visit in Internet Explorer?" my dad's response would probably be "wtf they can do that?" and then promptly select "NO".
  - derefr 12y ago
    You have to assume they at least wouldn't allow the question to be presented in a straw-man manner like that; nobody would agree to being tracked if they didn't see what the point of the tracking was. The actual positive form of the question, ignoring the politics and just thinking about user intent, would be something like "Do you want this computer to serve a unique fingerprint to websites, allowing companies to both reconstruct your identity between sites on their network, or to persist your identity after you have purged cookies and other session data? Companies tend to use this tracking ability to enhance your advertising experience, to collect statistics on the usage of their sites, and to ensure they don't double-count you. Malicious uses of this data are also possible, though currently rare." The important bit of the question, when phrased this way, is that it doesn't just ask about a mechanism (the DNT header), but about the user's intent—and because of that, it's activation state could be made to control all sorts of things besides the DNT header. For example, saying "no" to the question should cause the browser to try to add some per-domain jitter to its answers to questions about what links are visited, what fonts are installed, what the User-Agent string is, etc., so that the browser can't be fingerprinted.
    - implicitAgendas 12y ago
      I don't understand your opinion regarding any kind of straw man fallacy. Can you elaborate on where the fallacy emerges? The idea that advertising needs "enhancement" sounds suspicious. Couching the premise of the question in 77 words of pseudo-legalese-style terms and conditions would muddy the waters, and sow confusion, and probably innure users to do anything to make the checkbox go away, so they can simply get to the internet. Politics aside, that kind of twisting and turning smells like a dark pattern, in my opinion.
- bobajeff 12y ago
  Yeah this. Exactly. This is what DNT attempt 2.0 should be. "Do you want Ad agencies to gather and possibly share with or sell to their partners about your browsing activity?"
  - rsuelzer 12y ago
    Unfortunately, at least two of the major browsers are also run by major advertising and tracking firms. There is an inherit conflict of interest here.
    - realityking 12y ago
      I may just be very slow right now (it's late, a holiday, and I had too much to eat), but who, besides Google, are you referring to?
      - rsuelzer 11y ago
        Microsoft & Google. Not Apple, but certainly not for a lack of trying.
      - freehunter 12y ago
        Bing Ads.
      - dragonwriter 12y ago
        Well, Apple tried to be a major advertising firm (and still tries) with iAd. Though I don't know that I'd say that they are such a firm.

jgrowl 12y ago

People that aren't tech savvy and won't understand how to configure their browser are exactly the reason why DNT should be default. Sites that ignore DNT should be blacklisted.

abetaha 12y ago
Agree, however if the user sets the DNT explicitly, sites will have no excuse to ignore it anymore.
chc 12y ago
What does Do Not Track even mean if it does not signify the user's wishes? Why would people be expected to respect a request not to be recognized that somebody doesn't even know they're making? In its current state, Do Not Track is literally meaningless. Any company that respects Do Not Track is probably just not tracking anyone at all, because as long as Do Not Track is the default, it does not actually represent a user's preference.
- teacup50 12y ago
  Why would a user want to be tracked?
  - chc 12y ago
    Well, for example, I've heard more than one person say things along the lines of, "If I'm going to see ads, I would rather see relevant ones than irrelevant ones." But more importantly, this isn't a binary flag. People might want to be tracked, they might want not to be tracked, or — most likely in my opinion — they might not give two hoots. Similarly, when people walk into an physical place, they might want to be looked at, they might not want to be looked at, or they might not be particularly concerned with whether anyone in particular is looking at them.
    - teacup50 12y ago
      That's nonsense used to justify invasive and immoral tracking, nothing less.

deleted 12y ago

[deleted]

dudus 12y ago

It was always the intention of DNT to represent the user choice. It was just not explicit that it should be OFF by default. Reviewers fault. Microsoft, made a Marketing stunt of enabling it by default 2 years ago, in practice killing the point of DNT and setting back the industry several years. With a default option DNT would have no reason to be honored by any site owner. We could be enjoying native DNT tracking right now if Microsoft hadn't done that stupid dick move 2 years ago. How many years we'll need before the number of users that already have DNT set to ON by default are negligent is hard to measure. This should be a post apologizing for the trouble they caused and for destroyed the point of a W3C proposal that set back the industry for several years. Instead it looks like another Marketing stunt.

jszymborski 12y ago
While I'm all for having DNT's default set to ON, how much does it really change? Is there really any impetus for companies to not track you when you send a DNT header? Is there really any governing body that enforces it in any meaningful way?
- rspeer 12y ago
  I can imagine a release of a plugin similar to Privacy Badger or Ghostery that whitelists sites that honor DNT and follow a reasonable privacy policy. I'd use it. This may seem paradoxical, in that this plugin would only work correctly by not sending DNT to those sites. But I've found that some tracking cookies are useful (the one for editing Wikimedia projects, for example), and sites should be able to earn their way onto a whitelist, as long as they honor the requests of people who say "No. Don't track me. Not even you."
outside1234 12y ago
Really? Its Microsoft's fault? I totally agree that "Don't Track" should be the default. I get the new proposal as well - but to say that they somehow set it back is BS. What is holding it back is that there are no teeth to it - no laws that you must respect it - and lots of rewards for ignoring it. That's what needs to change.

sgift 12y ago

Probably a good approach to deprive companies tracking users of some of their excuses ("it's not really the will of the people if you pre-activate it" ... yeah, sure), but I feel a working DNT implementation will need law support and very harsh punishments. That would be at least far more useful than the EU cookie law in helping people.

yuhong 12y ago

I wonder if anyone used IE11's interface for getting user permission before tracking.

higherpurpose 12y ago

> As a result, DNT will not be the default state in Windows Express Settings moving forward I always disable all of Microsoft's "on" settings when installing Windows, as they usually try to pass some sneaky stuff by me, and even if I don't fully understand what something does, I feel safer having disabled it. As for the DNT option, I've never really cared for it, as I never use IE for anything. But my point is that Microsoft tries to hide these "user choices" in its Express Settings when installing Windows, so of course this doesn't reflect people's true choices. Now if only Microsoft approached their "default settings" there in the same way, and didn't assume stuff like "you want to use a Microsoft account, rather than a local account, don't you?" (This is actually represents two of the top 3 request in Windows 10 user feedback in the Security section - not requiring a Microsoft account by default). https://windows.uservoice.com/forums/265757-windows-feature-suggestions/category/87210-security-privacy-and-accounts https://windows.uservoice.com/forums/265757-windows-feature-...

mynameisvlad 12y ago
What? That was in Win8: http://www.theeldergeek.com/windows_8/win8_install_setup_personalization_screens.htm http://www.theeldergeek.com/windows_8/win8_install_setup_per... (Sign in without a Microsoft Account) And Win8.1: http://www.theeldergeek.com/windows_8/win_8_1_install_setup_personalization_screens.htm http://www.theeldergeek.com/windows_8/win_8_1_install_setup_... (Create Account > Sign in without a Microsoft account) At no point were you required to use a MSA, it was always the preferred option (since you get the sync, OneDrive, as well as automatically signing into the store and any other Microsoft services) but you always had the ability to turn it off in the setup screens, and the option was always clearly labeled. If you didn't want an MSA, local accounts worked perfectly fine as the default account on the box, and you can always convert to and from within the PC settings.

npizzolato 12y ago

> Without this change, websites that receive a DNT signal from the new browsers could argue that it doesn’t reflect the users’ preference, and therefore, choose not to honor it. With this change, websites could argue that they don't care and choose not to honor it. Is there any actual enforcement of Do Not Track? If not, the whole idea seems broken at its core.

danbruc 12y ago

This whole thing is pretty silly. If you are not sending a DNT signal then almost surly only because you don't know about it or you don't care enough, almost surly not because you really prefer being tracked. Or is there really a relevant group of users preferring to be tracked? If yes, why?

smileysteve 12y ago
I have slightly positive feelings towards retargeting.
kllrnohj 12y ago
Because I rather like that my search results are improved, my ads are less random, and recommendations are useful. Sure if you ask the question "do you want to be tracked?" you'll get an obvious no. If you ask the question "do you want better search results?" you'll get an obvious yes. Biased questions lead to biased answers.
- danbruc 12y ago
  I did not want to imply any bias in the formulation of the question. I personally don't want to see any ads at all, I don't want to live in a search bubble and I don't care about recommendations. I can not see any way in which tracking and creating a profile about me could provide me enough additional value that I would be willing to compromise on privacy. But this is of course only me, I hear rumors that there are actually people valuing ads. But I am still not convinced, the right question is neither »Do you want to be tracked?« nor »Do you want better search results?« but »Do you want better search results at the price of being tracked?«. My personal answer is a definitive no but I can't really tell in case of the general population.

cm2187 12y ago

The debate on DNT is completely sterile as this thing is absolutely toothless. It's like advertising a flag "do not infect me" as an anti-virus technology.

azakai 12y ago
A fence might also be easy to climb over, but can still clearly indicate where private property begins, and that trespassing there is wrong.
- rascul 12y ago
  It's more equivalent to painting a line on the ground than a fence. Climbing a fence takes more effort than ignoring DNT.
  - azakai 12y ago
    Good point. But painted lines on the ground still have social power, for example in parking lots, where most people obey them. Hopefully the same is true for DNT as well.

ShannonSofield 12y ago

The fact that I still get snail mail spam catalogs in my mailbox each day, with no mandated option to opt-out, I see no way that marketers will respect DNT. The gov't seems to believe that the economy relies on its ability to market to consumers, even if they don't want to be targeted.

mynameisvlad 12y ago
http://www.consumer.ftc.gov/articles/0262-stopping-unsolicited-mail-phone-calls-and-email http://www.consumer.ftc.gov/articles/0262-stopping-unsolicit... may help with unsubscribing.

Panino 12y ago

Consider the possibility that DNT does more harm than good: 1) Since it's not default, it makes browsers more unique and thus more trackable. 2) It gives many (perhaps even most?) non-technical users a false sense of security, making them less likely to take more effective measures. Weighed against what miniscule good DNT might do (I think it does next to none), these two reasons alone make DNT harmful.