Coalition Announces New ‘Do Not Track’ Standard for Web Browsing (2015)

[NelsonMinar]

The decision of the Internet advertising industry to ignore the original Do Not Track setting is a landmark in the cynicism of the industry. I mean users made an explicit request to not be tracked and companies like Google and Facebook were all "lol, no, we'll track you anyway". It's one of the reasons I feel no remorse running an ad blocker.

[ocdtrekkie]

In fairness, a leading cause of DNT's failure is that Microsoft, for marketing purposes, chose to set DNT by default for a while. While I applaud the goal of assuming people don't want tracking, it gave ad companies an excuse to dismiss DNT: Because many users showing DNT settings had not explicitly meant to do so.

[TravelTechGuy]

As others have mentioned here, this is akin to a sheep carrying a sign saying "please don't eat me", hoping wolves would respect it.

Furthermore, this sheep just highlighted the fact that it's a troublesome sheep, that requires special attention (i.e. if the DNT flag is in the header of the first request to my site, I know I can bust out my adblock-bypassing scripts, and start serving ads differently).

When I worked for [name of major ad-supported company redacted], I specifically asked a senior PM one day why are we ignoring the DNT flag in our products. He said "because that's how we make our money", thought for another second and added "also, everyone else ignores it".

[user5994461]

The wolf comparison is on point in that advertisers are evil creatures who rely on hurting internet users to survive and thrive.

[wmeredith]

And this analogy is exactly why I am remorseless in cutting out all forms of advertising my and my families lives.

[xg15]

I don't really understand how this is supposed to help. If I'm an advertiser/tracker/etc, what keeps me from adding the policy file to my website - so adblock, duckduckgo etc. are happy - and then blatantly violating it?

The "policy" doesn't seem to be legally binding in any way, there is no way to even detect violations and the EFF itself writes that it can't enforce it:

> Posting the dnt-policy.txt file makes a promise to the users who interact with their domain. We believe it would be a false and misleading trade practice to post the policy without the intent to comply in good faith. However, EFF is not in a position to enforce this promise or monitor compliance. [1]

So what's the point?

[1] https://www.eff.org/dnt-policy#faq-What-does-the-dnt-policy....?

[greglindahl]

If you're a US company and you lie to your customers about what your policies are, the FTC may well sue you. They do it all of the time over privacy policies.

[eli]

This is basically what happened to P3P, an earlier attempt to regulate privacy rules with a machine-readable policy. Microsoft set IE to reject cookies by default if a site didn't have 1) a P3P header that 2) met certain requirements. It wasn't very well thought out and, in practice, required a bunch of sites to create a bogus P3P header or core functionality like "logging in" was broken for many IE users.

[lotu]

This is trying to create a way for publisher to say, "I don't want to track users" and have it be understood by software. Right now no such system exists. You could see organizations doing testing to see if tracking happens but they need to know what the publisher say they will or won't do. It still might not get adoption but it isn't nothing.

[javery]

This is from 2015.

[Ajedi32]

Yeah, my first thought when I read the headline was "Again?".

DNT was actually pretty widely implemented in browsers for a while, but it ultimately failed because there wasn't anything actually enforcing the standard. It was essentially just a way to politely ask servers not to track you.

[jasonkostempski]

That needs to be added to the title. I would've stopped my Amazon Smile donations to EFF if they were still wasting money pursuing this obviously pointless idea.

[hermitdev]

I seriously doubt this will gain much traction. I would love it to, but I doubt the motives behind advertisers.

I mean, just look at the current state of advertising on mobile. One constantly gets ads hijacking the browser to show ads ostensibly from Amazon or Walmart (I doubt either Amazon or Walmart would actually prevent you from getting to the content you're looking at). The "well-done" ads prevent you from even hitting the back-button on your browser to return to the content. Being an Android user, I've effectively taken to using MS Edge on Android, because at least in Edge, I can disable javascript, which has gone a long way to crippling such ads. (Before anyone asks: I'm normally a Chrome user + UBlock, etc etc, but Chrome doesn't support extensions on Android, and I've never had good luck with FireFox for anything other than draining battery).

When Ad companies learn to play nice and not hijack my browser and occasionally serve up out right malware, maybe, just MAYBE, will I reconsider playing nice with them.

[mtgx]

You're right. The ship has sailed...for advertisers. They'll wish this DNT variant had caught-on, because since then ublock origin and others like it have become significantly more popular, the native-adblock Brave browser is growing slow and steady, and now even Mozilla offers users the option to disable all tracking. Perhaps in another couple of years Mozilla will enable it by default for everyone.

[anowlcalledjosh]

> at least in Edge, I can disable javascript

Note that you can also do this in Chrome: Settings/Site settings/JavaScript.

If you're looking for another way to block ads on mobile, DNS66 works pretty well for me, and it's FOSS IIRC (obviously it doesn't get everything, there's only so much a DNS-based blocker can do, but it catches most ads except YouTube's in my experience).

[mmagin]

My issue with DNT is that it is generally another bit of uniqueness that makes my browser slightly EASIER to track for anyone who doesn't care about obeying it, which are likely the greatest threats.

[jackhack]

If a security or privacy model depends on the cooperation of those on the other end of the wire, it will fail.

[nykolasz]

This is the reason why DNT failed. If it can't be forced, the bad players won't follow it.

[TheAceOfHearts]

IMO, tracking should be strictly opt-in, making it opt-out is abusive and ubethical.

I recently learned of GDPR. Although I'm uncertain of the exact law's implementation details, I think it's a step in the right direction. It's strictly opt-in and requires providing a clear explanation of what data gets collected.

[noncoml]

It is one of these things that it is too little too late. Ad blockers filled in the gap and there is no need for a solution anymore.

Not to mention that AdBlock has lost all the good faith from the users, so including it in the coalition only does damage to the public image.

[Feniks]

Please don't kill anyone vs. killing is against the law and you'll go to jail if you do it.

I know which one works best.

[tzahola]

Coalition Announces New “Please Don’t Listen” Standard against Man-in-the-middle Attacks

[Endy]

Or even better a new, "Please Don't Listen" standard against cell-phone conversations on busy streets!

[labster]

Cool, a new way our browsers can be fingerprinted! Thanks EFF for one more bit of entropy!

Yes I know this was in good faith, but when you are trying to get good faith agreement against the business model of an industry, it's no surprise it was a failure.

[Cyberdog]

> Disconnect’s partners in this launch are the innovative publishing site Medium

I know this is off-topic, but what is so innovative about Medium? Does it break any significant ground beyond what LiveJournal was doing almost two decades ago?

[jasonkostempski]

Nothing. I'm a bit surprised an EFF article is using all those meaningless fluffy words to describe the partners.

[whatusername]

Not tracking users when they ask not to be tracked?

[kevinoid]

Could someone clarify: What's the standard? Is it adopting EFF's DNT policy https://www.eff.org/dnt-policy? Is it hosting any privacy policy at /.well-known/dnt-policy.txt? Do any tools or browsers use that URL or display it to users? Has anyone else adopted this standard?

[yuhong]

The ad bubble and how it affects Google/Mozilla is now one of my favorite topics. It is not just Google, but it is the most interesting.

[zimbatm]

Now all we need if for websites to automatically hide the cookie warning header when DNT is set.

[Endy]

Oh, I'm sure that someone out there already does. The question is whether they're making enough money off it to do it en masse.

[paulogubio]

AUGUST 3, 2015