Do Not Track: privacy activists face off with the online ad industry

Starting today, anyone visiting Yahoo will be tracked by default, regardless of whether they've enabled the Do Not Track setting on their browser. It's a bold stance by the company, which described the shift as a personalized experience by default, and a serious blow for the Do Not Track standard, which has suffered major setbacks in recent years. Users can still manage their privacy settings through the Yahoo Privacy settings, but they'll have to do so individually, and Yahoo sites won't be responding to any automated anti-ad-tracking signals like DNT. "We fundamentally believe the best web is a personalized one," the privacy team said in a blog post.

The third-party cookies used by advertisers and their agencies to track web browsing activity are under attack. Browsers like Firefox and Internet Explorer try to block the years-old technology with "Do Not Track," and now internet behemoths are looking to replace cookies with their own tracking technologies. The newest entrant, according to Ad Age, is Microsoft, which sources say is working on a technology that could track users across Windows computers, Bing, Internet Explorer, Windows Phone devices, and Xbox consoles in order to serve highly targeted ads.

Microsoft said in a statement to the website that "We agree that going beyond the cookie is important. Our priority will be to find ways to do this that respect the interests of consumers." However, the primary interest is likely in filling the gaps where cookies fall short, like on mobile, consoles, and streaming video services, where they have limited to no ability to track user activity.

Google is reportedly developing its own system of tracking our activity online. According to a report from USA Today, Google is building an identification method for advertisers, called AdID, that would replace third-party HTTP cookies. An unnamed source tells the newspaper that AdID data would be shared with advertisers and online ad-sales networks that agree to a Google-defined set of guidelines and privacy controls.

The World Wide Web Consortium (W3C) has spent nearly two years trying to standardize and implement Do Not Track — an HTTP header that tells advertisers and other third parties not to follow you around the internet — and the many delays and roadblocks that have cropped up since are starting to make it look like its efforts will be futile. According to The Hill, a major group representing the online advertising industry has pulled its support and believes that it's essentially impossible for the W3C to carry out its plan to create a Do Not Track Standard. The Digital Advertising Alliance (DAA) said it was withdrawing from the W3C's disucssions around Do Not Track and also said that the talks "have reached the end of [their] useful life" — and it also said that those talks should stay dead.

While the W3C can certainly carry on without the DAA, it's just another in a long series of setbacks. Despite pressure from the FTC and members of Congress, the W3C has missed a number of deadlines for getting a final Do Not Track proposal in place. A bill was reintroduced back in February, but the group was never able to finalize it in time for a July deadline. Peter Swire, who led the W3C until being tapped for the White House's NSA review panel, rejected a proposal endorsed by the DAA back in June, and there's been no movement forward since. In fact, Swire's just as skeptical as the DAA that Do Not Track will ever move forward. "I no longer see any workable path to a standard that will gain active support from both wings of the Working Group," he said.

After announcing that it would soon start blocking cookies from third-party advertisers by default in Firefox, Mozilla has walked back on its plans while it continues to test the system. In a blog post, Mozilla's Brendan Eich said that the patch needed more testing and data in order to refine it for release. "The idea is that if you have not visited a site (including the one to which you are navigating currently) and it wants to put a cookie on your computer, the site is likely not one you have heard of or have any relationship with," he said. "But this is only likely, not always true."

Eich cited false positives — cookies from a site you visit being blocked because it has multiple addresses — and false negatives, in which an ad is clicked accidentally or a formerly trusted site starts adding cookies. The patch, developed by Stanford law student Jonathan Mayer, was initially set to be deployed in Firefox 22. Now, there's no set timeline for its release, but Eich will provide a progress update sometime in the next six weeks.

Do Not Track is back in the spotlight today as senators Jay Rockefeller (D-W.Va.) and Richard Blumenthal (D-Conn.) reintroduced a bill that would let people opt out of having their online activity tracked by advertisers. Originally introduced in 2011, the Do Not Track Online Act was envisioned as an online equivalent to the nationwide Do Not Call list, but talks have broken down between privacy activists and the ad industry, and nearly two years since its initial proposal, there is still no consensus about how to move forward.

As advertising has moved online, the way companies buy space for it has also changed. The New York Times has outlined the rise of "programmatic buying," an automated ad system in which tracking consumers has become as important as making sure the ad matches the site's tone. Ad space buyers look not for certain kinds of places, but certain kinds of viewers, often following them across multiple sites. "Accessing media is a commodity now," says digital advertising executive Sheldon Gilbert. While Do Not Track and other privacy efforts promise to take data out of advertisers' hands, the Times indicates that tracking-heavy, algorithm-based buying is here to stay.

Google just released the latest stable version of Chrome, which finally includes support for the somewhat-controversial Do Not Track protocol. This makes Google the last major browser developer to support it, as Microsoft, Mozilla, Apple, and even Opera enabled it in their browsers some time ago. Google's chosen to have the option turned off by default, the opposite of Microsoft's default behavior in Internet Explorer 10. There's some question as to how effective Do Not Track will be — a number of companies, including internet giant Yahoo, have said they will not recognize Microsoft's DNT requests from IE 10, so it's possible Chrome will be treated similarly. Google acknowledges this possibility in its blog post announcing Chrome, saying "the effectiveness of [DNT] requests is dependent on how websites and services respond, so Google is working with others on a common way to respond to these requests in the future."

Aside from DNT, Chrome 23 doesn't bring many new user-facing features — there's a redesigned interface for managing website permissions for things like location and camera access, and Windows users will now benefit from GPU-accelerated video decoding, which should help reduce power consumption. If you're interested in upgrading, Chrome 23 is out now.

Microsoft was warned that its decision to enable Do Not Track (DNT) by default in Windows 8's Internet Explorer 10 would encourage web content providers to ignore the request to keep advertisers from following user's movements around the web, and those predictions are becoming very true. Yahoo has just published its thoughts on the matter, and in the blog post says that it "will not recognize IE10’s default DNT signal on Yahoo! properties at this time." The company cites that the DNT standard has not been finalized, and that Microsoft's decision "degrades the experience for the majority of users and makes it hard to deliver on our value proposition to them."

Yahoo is quick to point out that 'In principle, we support "Do Not Track,'" but ultimately, the fact remains that DNT is being flatly ignored. The move closely mimics a much more significant decision made by Apache's co-founder in reaction to Microsoft's move, which patched the open source server software behind about 60 percent of websites to ignore the DNT setting in Internet Explorer 10. Much like the reasoning behind the Apache co-founder's decision to patch the software, Yahoo says that "we believe that DNT must map to user intent — not to the intent of one browser creator, plug-in writer, or third-party software service." We'll be keeping an eye on how this continues to develop; now the Windows 8 is officially released, we expect the debate over DNT to only intensify, and more may join in Yahoo's decision to look past Internet Explorer 10's defaults.

Following months of relative quiet on the subject of Do Not Track — an HTTP header that tells advertisers and other third parties not to follow you around the internet — the controversial browser signal is being thrust back into the limelight. After the W3C's recent face-to-face meeting in Amsterdam, the the Digital Advertising Alliance plainly said that it "does not require companies to honor DNT," effectively saying it intends to stick to its own self-regulatory approach to user privacy. Much of the renewed interest stems from Microsoft's controversial decision to turn Do Not Track on by default in Windows 8's Internet Explorer 10, and Adobe engineer Roy Fielding's subsequent decision to take a sledgehammer to the Apache web server, patching it in a way that explicitly overwrites the DNT signal coming from Microsoft's newest browser.

With the fate of our beloved internet economy allegedly at stake, perhaps it's a good time to examine what Do Not Track is. How did the standard come to be, what does it do, and how does it stand to change online advertising? Is it as innocuous as privacy advocates make it sound, or does it stand to jeopardize the free, ad-supported internet we've all come to rely on?

During the Windows 8 installation process, users are presented with a choice between default system settings (called Express) and a more customized setup. At issue is whether showing users the phrase "turn on Do Not Track in Internet Explorer" in the Express settings description (before having them click through) is truly an expression of preference, and not "the choice of some vendor, institution, or network-imposed mechanism outside the user’s control."

Roy Fielding, author of the patch, co-founder of Apache, and contributor to the DNT specification, believes the case falls squarely under the latter, saying "the only reason DNT exists is to express a non-default option… It does not protect anyone’s privacy unless the recipients believe it was set by a real human being, with a real preference for privacy over personalization."

The last we heard about Microsoft's intention to enable Do Not Track flags in Internet Explorer 10 by default, the W3C, the authority behind the entire DNT spec, was advising the Redmond company to make it a user option rather than a preset. This was mostly down to the fear that many websites may choose to disregard Do Not Track instructions from a browser that is automatically set to send them out — web content providers are more willing to respect user preferences when a user performs some action to express them. Such has been the W3C's reasoning, however Microsoft's consumer research has corroborated its expectation that most people prefer to have an aggressive set of privacy controls enabled in their browser by default.

Microsoft is today disclosing a little more information about how it will enable Do Not Track in IE10, with a specific view on how it works as you set up your fresh copy of Windows 8. Two setup choices will be provided to users, you'll be able to elect between the automatic Express Settings or Customize your own. If you opt for the former, you'll see "prominent notice" that DNT has been enabled on your computer, while the latter will naturally let you toggle DNT on or off. Additional Learn More and Privacy Statement links will furnish the user with yet more information about the choices presented.

Along with the release of Mountain Lion, Apple has rolled out Safari 6, the new browser it demonstrated last month. Some of the more exciting new features — like iCloud tabs and Tab View — are only available on OS X 10.8, but Lion users can still enjoy improved performance and a few welcome tweaks. Apple's added the unified Smart Search Field, a unified search and address bar, and the Reading List feature now works offline. Safari 6 also supports Do Not Track and a new pane for storing passwords, and Chinese search engine Baidu is a built-in option.

We've confirmed that the new Safari works on Lion, but it's unclear whether it's supported on Snow Leopard, and we can't find a link or dedicated page to download it for Windows. If you're running OS X 10.7, you can download it now through the Software Update app. You can check out new features at Apple's site here, and developers can review the new development tools, including HTML5 notifications and a redesigned version of Web Inspector.

Microsoft's plans to enable Do Not Track flags in Internet Explorer 10 by default have taken a setback this week as the latest draft of the DNT specification explicitly states that the user must be given the choice. You might recall that the original W3C proposal for Do Not Track was actually titled "Tracking Preference Expression," and this latest revision to its wording is reflecting the importance placed on those words — the sending of Do Not Track signals to websites from your browser must only happen as a direct expression of your will. Thus, any browser that defaults to either enabling or disabling DNT without asking the user to choose which she prefers is in breach of the spec as it currently stands.

Microsoft is still free to continue with its plans, however it would not be able to say it adheres to the proper Do Not Track specification if it does, and many websites and advertisers may opt to ignore its flags as a result. Their argument would be that it's up to users to signal they do not want to have their web browsing tracked — which, ironically, Microsoft's stated plans for IE 10 do not allow.

Amid the coverage of the Windows 8 Release Preview, Microsoft has announced that Internet Explorer 10 will be the first web browser to have Do Not Track (DNT) enabled by default. DNT is currently available as an option in most browsers that allows users to opt out of behavioral tracking, but it is not yet universally heeded by advertisers. Even though groups like the Digital Advertising Alliance are displeased about the announcement, Microsoft's Chief Privacy Officer Brendon Lynch recognizes the value in personalized ads for companies and consumers alike. Lynch explains the reasoning behind the decision in a blog post, saying, "we've made today's decision because we believe in putting people first. We believe that consumers should have more control over how information about their online behavior is tracked, shared and used."

However, documentation regarding Do Not Track features for other browsers is less common. According to Twitter support, DNT is currently available as a built-in option in Internet Explorer 9, Mozilla Firefox 5, Safari 5.1+, and Opera 12+, while Google Chrome has several browser extensions available until it fully integrates the option by the end of this year. Mozilla stated in November of last year that it has no intention of making DNT a default setting, arguing that it restricts rather than enhances the customer's power of choice.

Twitter has started allowing users to opt out of having personal information collected by its service. At a New York Internet Week privacy panel, the FTC announced that Twitter will begin using Firefox's "Do Not Track" provision, which allows users to stop sites from using cookies to collect information like browsing habits or display targeted ads. The Firefox option is easy to set, but it only works for services that have explicitly implemented it. So far, giants like Yahoo and AOL have complied with Do Not Track, but Twitter is one of the first major social networks to do so. Facebook, for example, allows users to see some of what's being collected, but it doesn't provide an opt-out feature.

Web giant Yahoo has announced that it will be implementing a "Do Not Track" system — which allows users to opt out of having information collected when they use a site — on all its sites worldwide by early summer. In a statement released today, the company said it would "provide a simple step for consumers to express their ad targeting preferences to Yahoo." It's too early to tell exactly what this will include, but it's likely Yahoo will be making its sites compatible with Do Not Track features on browsers like Firefox and Safari (Chrome's own version of Do Not Track is supposed to be coming at the end of the year.)

Do Not Track was one of the centerpieces of the Federal Trade Commission's recently-released privacy framework, and several other large companies, like AOL, opted for it years ago. For Yahoo, this is clearly a bit of an attempt at publicity, but it's good to see more sites implementing a way for users to control — to some extent — what's being collected.

From Google's new privacy policy to iOS apps that collect address book information, the new year has seen more of its share of controversy over what data is ethical and legal to collect. Now, after an initial announcement last week, the Federal Trade Commission is releasing a new framework that it hopes will provide more protection for consumers and clarify the expectations for businesses. The report, which is designed to be used by Congress and companies to set laws or policy, includes suggestions for greater privacy policy transparency, privacy setups that are built into the system instead of being added after the fact ("privacy by design"), and consumer choice about what data is collected and used. It's meant to apply to all internet-based services that collect data, from individual sites to major platforms like browsers, operating systems, and ISPs.

There was also discussion of a centralized website where users could find information about what was being traded by "data brokers," and the FTC said it strongly supported legislation regarding groups that resold consumer data. However, Leibowitz said that he was pleased with the overall progress made in privacy policies, believing that companies had an incentive not only to avoid regulation, but to gain consumer trust with clearer policies. "It's fairly limited, and it's the right thing to do... and it's good for your business."