The sad, slow-motion death of Do Not Track

July 22, 2020

This article was contributed by Ben Hoyt

"Do Not Track" (DNT) is a simple HTTP header that a browser can send to signal to a web site that the user does not want to be tracked. The DNT header had a promising start and the support of major browsers almost a decade ago. Most web browsers still support sending it, but in 2020 it is almost useless because the vast majority of web sites ignore it. Advertising companies, in particular, argued that its legal status was unclear, and that it was difficult to determine how to interpret the header. There have been some relatively recent attempts at legislation to enforce honoring the DNT header, but those efforts do not appear to be going anywhere. In comparison, the European Union's General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) attempt to solve some of the same problems as DNT but are legally enforceable.

In 2007, the US Federal Trade Commission was asked [PDF] to create a "Do Not Track" list, similar to the popular "Do Not Call" list. This would have been a list of advertiser domain names that tracked consumer behavior online, and would allow browsers to prevent requests to those sites if the user opted in. However, that approach never got off the ground, and DNT first appeared as a header in 2009, when security researchers Christopher Soghoian, Sid Stamm, and Dan Kaminsky got together to create a prototype. In his 2011 article on the history of DNT, Soghoian wrote:

In July of 2009, I decided to try and solve this problem. My friend and research collaborator Sid Stamm helped me to put together a prototype Firefox add-on that added two headers to outgoing HTTP requests:

X-Behavioral-Ad-Opt-Out: 1
X-Do-Not-Track: 1

The reason I opted for two headers was that many advertising firms' opt outs only stop their use of behavioral data to customize advertising. That is, even after you opt out, they continue to track you.

At some point, Soghoian said, "the Behavioral Advertising Opt Out header seems to have been discarded, and instead, focus has shifted to a single header to communicate a user's preference to not be tracked". The final format of the header is literally "DNT: 1".

Even back when Soghoian wrote that article, it was clear that getting advertisers to respect the header wasn't going to be easy:

The technology behind implementing the Do Not Track header is trivially easy - it took Sid Stamm just a few minutes to whip up the first prototype. The far more complex problem relates to the policy questions of what advertising networks do when they receive the header. This is something that is very much still up in the air (particularly since no ad network has agreed to look for or respect the header).

Part of the problem was defining what "tracking" means in this context. The Electronic Frontier Foundation (EFF), which has been involved in DNT efforts from the beginning, defines it as "the retention of information that can be used to connect records of a person's actions or reading habits across space, cyberspace, or time". The EFF's article also lists certain exceptions that are not considered tracking, which notably allows for "analytics providers". The article is also careful to distinguish between tracking by a first-party ("the website you can see in your browser's address bar"), which is allowed, and tracking by a third-party (other domains), which is not.

Starting with Mozilla Firefox in January 2011, browsers began to implement the "trivially easy" part, allowing users to opt into sending the new header. Microsoft followed soon after, adding DNT support to Internet Explorer 9 in March 2011. Apple followed suit with Safari in April 2011. Google was a little late to the game, but added support to Chrome in November 2012.

In September 2011 a W3C "Tracking Protection Working Group" was formed "to improve user privacy and user control by defining mechanisms for expressing user preferences around Web tracking and for blocking or allowing Web tracking elements". During its eight active years, the group published a specification of the DNT header as well as a set of practices about what compliance for DNT means. Unfortunately, in January 2019 the working group was closed with this notice:

Since its last publication as a Candidate Recommendation, there has not been sufficient deployment of these extensions (as defined) to justify further advancement, nor have there been indications of planned support among user agents, third parties, and the ecosystem at large. The working group has therefore decided to conclude its work and republish the final product as this Note, with any future addendums to be published separately.

As early as 2012, LWN wrote about how it wasn't looking good for DNT: advertising groups were pushing back (unsurprisingly), and there was no legal definition of how the header should be interpreted. In addition, Microsoft's decision in May 2012 to enable the header by default in Internet Explorer 10 backfired, as DNT had always been intended to indicate a deliberate choice made by the consumer. Roy Fielding even committed a change to unset the DNT header in the Apache web server if the request was coming from Internet Explorer 10 — possibly setting a record for the number of comments on a GitHub commit. Even though Microsoft finally removed this default in April 2015, it's likely that this well-intentioned move muddied the DNT waters.

A few high-profile web sites did honor Do Not Track, including Reddit, Twitter, Medium, and Pinterest. Tellingly, however, as of today two of those sites now ignore the header: Reddit's privacy policy now states that "there is no accepted standard for how a website should respond to this signal, and we do not take any action in response to this signal", and Twitter notes that it discontinued support (as of May 2017) because "an industry-standard approach to Do Not Track did not materialize". At present, Medium and Pinterest still act on the header.

Apple's Safari was the first major browser to lose support for "the expired Do Not Track standard" — it was removed from Safari in March 2019. Ironically, Apple's stated reason for removing it was to "prevent potential use as a fingerprinting variable". Tracking systems often use a fingerprint of a user's HTTP headers to help track them across different websites, and the DNT: 1 header — given its low use — adds uniqueness to the user's headers that may actually make them easier to track.

Since then, Apple has been steadily rolling out what it calls "Intelligent Tracking Prevention", which is an approach that prevents the use of third-party cookies after a certain time window and helps avoid tracking via query-string parameters ("link decoration"). Mozilla added similar protections from third-party cookies to Firefox in September 2019. Microsoft included tracking prevention in the new Chromium-based version of its Edge browser, released in January 2020. Even Google, where much of its revenue comes from advertising (and indirectly, tracking), announced its own plans to phase out support for third-party cookies in Chrome over the next two years.

In May 2014, LWN wrote about Privacy Badger, "a browser add-on that stops advertisers and other third-party trackers from secretly tracking where you go and what pages you look at on the web". Privacy Badger enables the DNT header and blocks requests to third-party sites that it believes are likely to track a user (which, not surprisingly, happens to block most ads). One of the goals of Privacy Badger is to goad advertising companies to actually respect the header. If Privacy Badger sees that a domain respects DNT by publishing the DNT compliance policy to company-domain.com/.well-known/dnt-policy.txt, it will stop blocking that domain. This sounds like a great idea for users, but it just doesn't seem to have taken off with advertisers.

One recent attempt to revitalize the DNT header is by DuckDuckGo, which is a company that builds privacy-oriented internet tools (including a search engine that "doesn't track you"). It found (in November 2018) that, despite web sites mostly ignoring the header, DNT was enabled by approximately 23% of adults in the US. In May 2019 DuckDuckGo published draft legislation titled "The Do-Not-Track Act of 2019 [PDF]" which it hopes will "put teeth behind this widely used browser setting by making a law that would align with current consumer expectations and empower people to more easily regain control of their online privacy". The company's proposal would require web sites to honor the DNT header by preventing third-party tracking and only using first-party tracking in ways "the user expects". For example, a site could show a user the local weather forecast, but not sell or share the user's location data to third parties.

Unfortunately, in the year since DuckDuckGo published the proposal, nothing further seems to have come of it. However, around the same time, US senator Josh Hawley, supported by senators Dianne Feinstein and Mark Warner, introduced a similar Do Not Track Act that was "referred to the Committee on Commerce, Science, and Transportation". There has not been any activity on this bill in the last year, so it seems there is little chance of it going further.

In June 2018, the W3C working group published an article comparing DNT with the GDPR. The GDPR requires a web site to get a user's consent before tracking them and, unlike DNT, that is enforceable by law. Similarly, the recent CCPA legislation is enforceable, but it only applies to businesses operating in the state of California, and only to the "sale" of personal information. As law firm Davis Wright Tremaine LLP noted, the CCPA waters are almost as muddy as those of DNT: "we do not yet have clarity under the CCPA, however, regarding which tracking activities (e.g., tracking for analytics, tracking to serve targeted ads, etc.) would be considered 'sales'". One possible way forward is to generalize efforts like the GDPR and CCPA rather than trying to give DNT a new lease on life.

It looks as though, after a decade-long ride with a lot of bumps, the Do Not Track header never quite got enough traction with the right people to reach its destination. It is still possible that one of the political efforts will go somewhere, but it seems less and less likely. Similar to how most of us deal with email spam, we may have to rely on technological solutions to filter out tracking requests, such as Privacy Badger and DuckDuckGo's browser extensions or the various browsers' "intelligent tracking prevention" schemes.

Index entries for this article
GuestArticles	Hoyt, Ben

Perhaps the opposite approach could cut down on meaningless clicks

Posted Jul 22, 2020 16:19 UTC (Wed) by epa (subscriber, #39769) [Link] (30 responses)

How about the opposite: a header which indicates you're happy to accept cookies and happy for the website owner to use that cookie data as they see fit. When a website gets that header, it knows it doesn't have to pop up the boilerplate 'Accept cookies and continue' over the top of whatever page you were trying to view.

That couple of seconds, multiplied by the number of sites you visit and the billions of people using web browsers, adds up to quite a lot of wasted time.

Perhaps the opposite approach could cut down on meaningless clicks

Posted Jul 22, 2020 17:26 UTC (Wed) by NYKevin (subscriber, #129325) [Link] (1 responses)

If Google, Microsoft, or Apple introduced such a thing, there would be 30,000 comments on LWN and elsewhere (like Hacker News) screaming about how evil it is, how the companies are trying to erode privacy protections, and so on. Mozilla, I think, would be unwilling to introduce it given their current stance on privacy issues. It would look a bit hypocritical, regardless of the benefit to the user. So that leaves the niche browsers, like Vivaldi and Brave. But they don't have the clout to push through a new standard like this.

(Disclaimer: I work for Google; opinions are my own.)

Perhaps the opposite approach could cut down on meaningless clicks

Posted Jul 25, 2020 11:52 UTC (Sat) by cpitrat (subscriber, #116459) [Link]

You could have both options: deny all and allow all

Perhaps the opposite approach could cut down on meaningless clicks

Posted Jul 22, 2020 17:42 UTC (Wed) by josh (subscriber, #17465) [Link] (4 responses)

They're not meaningless. Every time I run into one of those banners, if I care enough to use the site at all, I explicitly open it and reject all rejectable cookies.

I've noticed that at least a few of the cookie banners listen to DNT, and default all the tracking cookies to "off". Would be nice if all of them did.

Also, the GDPR explicitly requires agreement and disagreement options to be equally prominent; I don't think a top-level "accept" and having to dig through a UI for "reject all" meets that requirement.

Perhaps the opposite approach could cut down on meaningless clicks

Posted Jul 22, 2020 23:28 UTC (Wed) by LtWorf (subscriber, #124958) [Link]

It does not meet it. I just hope someone will get a huge fine to scare everyone else into making them legally.

Perhaps the opposite approach could cut down on meaningless clicks

Posted Jul 26, 2020 12:34 UTC (Sun) by niner (subscriber, #26151) [Link]

I don't think the defaulting of tracking cookies to "off" does have anything to do with the DNT header. Websites doing so simply follow the law as a decision by the European Court has made clear in ECLI:EU:C:2019:801:

"On the basis of those explanations, it should be noted that, in accordance with Article 5(3) of Directive 2002/58, Member States are to ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a user is only allowed on condition that the user concerned has given his or her consent, having been provided with clear and comprehensive information, in accordance with Directive 95/46, inter alia, about the purposes of the processing.

[...]

Thus, as the Advocate General stated in point 60 of his Opinion, the requirement of an ‘indication’ of the data subject’s wishes clearly points to active, rather than passive, behaviour. However, consent given in the form of a preselected tick in a checkbox does not imply active behaviour on the part of a website user."

http://curia.europa.eu/juris/document/document.jsf?docid=...

Thus it can be said, that there is now no longer any doubt that tracking EU users is only legal if they explicitly gave their consent by clear and unambiguous action, e.g. opt-in. The only exception is if tracking is necessary to actually provide functionality to the user, e.g. login sessions.

The EU is really a gift to Europeans.

Perhaps the opposite approach could cut down on meaningless clicks

Posted Jul 27, 2020 10:39 UTC (Mon) by anselm (subscriber, #2796) [Link] (1 responses)

There are certainly enough sites whose cookie configuration panels have a huge vibrant-green “ENABLE ALL TRACKING AND CONTINUE” button alongside a barely perceptible light-grey one that says “Save cookie preferences and continue”.

Perhaps the opposite approach could cut down on meaningless clicks

Posted Jul 28, 2020 8:09 UTC (Tue) by nilsmeyer (guest, #122604) [Link]

Yeah I think that's called a "dark pattern". And I don't think that would hold up as legal.

The opposite opposte approach

Posted Jul 22, 2020 18:05 UTC (Wed) by ragnar (guest, #139237) [Link] (21 responses)

I think it would be better if browsers just not store cookies until the user explicitly says they want to allow it for a particular site. Then websites wouldn't need to have extra "accept cookies" dialogs, because if the cookie is stored the user have explicitly allowed it to be stored.

The opposite opposte approach

Posted Jul 22, 2020 18:23 UTC (Wed) by NYKevin (subscriber, #129325) [Link] (3 responses)

You can do this in Chrome by going to chrome://settings/cookies, choosing "Block all cookies (not recommended)", and then unblocking sites individually with the padlock (or globe, if non-HTTPS) widget on the left side of the URL bar (or with "Sites that can always use cookies" on the same settings page, if you want to allow a whole bunch of sites in one go). There's also an option to just block third-party cookies (subject to the same unblocking list), which is probably closer to what the average non-technical user wants ("What do you mean, I can't log in without fiddling around with my browser? If I gave the site my username and password, of course I want it to remember that!").

I'm not sure if other browsers support either of these things.

The opposite opposte approach

Posted Jul 23, 2020 6:40 UTC (Thu) by ragnar (guest, #139237) [Link] (2 responses)

Yes, I can do that for myself, with the Chrome approach you suggest or simulate it via Cookie Autodelete in Firefox (I actually do this). The problem with doing it myself is that then I get the annoying "Accept cookies" popup every time I visit a site. My point is that if we make that behaviour the default in all major browsers, there won't be a need for the "Accept cookies" popup anymore.

The opposite opposte approach

Posted Jul 23, 2020 9:18 UTC (Thu) by leromarinvit (subscriber, #56850) [Link] (1 responses)

I don't care about cookies takes care of that at least for some sites (but certainly not all).

The opposite opposte approach

Posted Jul 24, 2020 9:22 UTC (Fri) by epa (subscriber, #39769) [Link]

Thanks for the link. My suggestion was for an HTTP header which achieves the same thing -- slightly cleaner in my view, but perhaps unlikely to be adopted. (Your company's legal department might not agree that you are compliant with data protection laws just because of that header. They might expect an explicit I Agree click, header or no header. But there is nothing the legal department can do about a browser extension.)

The opposite opposte approach

Posted Jul 22, 2020 18:27 UTC (Wed) by josh (subscriber, #17465) [Link] (15 responses)

Ideally, I'd like to see sites providing *programmatically* distinguishable information about cookies. The various in-page cookie UIs classify cookies, from the important ones that track that you're logged in, to the ones nobody wants that track your behavior. That classification information should be attached to the cookies themselves, and then browsers could implement this logic in-browser, with defaults that serve the user. Most users *do* typically want a site to allow them to log in, but *don't* want to be tracked; the browser could implement that logic.

The opposite opposte approach

Posted Jul 23, 2020 6:42 UTC (Thu) by ragnar (guest, #139237) [Link] (14 responses)

That would be nice. But what would stop a site from misclassifying a cookie as being required for login when all it does is track you?

The opposite opposte approach

Posted Jul 23, 2020 13:52 UTC (Thu) by pabs (subscriber, #43278) [Link] (11 responses)

Cookies that are used for login sessions are just another form of tracking.

The opposite opposte approach

Posted Jul 24, 2020 13:42 UTC (Fri) by smurf (subscriber, #17840) [Link] (10 responses)

Well, the alternative is to log in on every visit *and* to mangle each and every one of your links with session IDs.

I'm not quite convinced that that approach has any advantages WRT cookies.

The opposite opposte approach

Posted Jul 25, 2020 4:15 UTC (Sat) by pabs (subscriber, #43278) [Link] (9 responses)

The technical mechanism used to login was not the point of my post.

The opposite opposte approach

Posted Jul 27, 2020 10:34 UTC (Mon) by anselm (subscriber, #2796) [Link] (8 responses)

I don't think people have anything against being “tracked” (through an HTTP cookie or otherwise) by a single web site that they have deliberately logged in to. It's being tracked by a large number of third parties, without explicit consent, across a large number of – otherwise unrelated – web sites that is objectionable to many of them.

The opposite opposte approach

Posted Jul 27, 2020 16:27 UTC (Mon) by rgmoore (✭ supporter ✭, #75) [Link] (7 responses)

This seems exactly right to me. Once I've accepted the need to sign on to a site, I've accepted their ability to gather my information. If I'm unhappy with that, I need to either stop dealing with them or complain to them about what they do with my data. The big problem comes when some third party I have no desire to have a relationship with gathers data on me from numerous sites. There is a huge potential for abuse there, and they've almost always evaded any attempt to get my consent.

The opposite opposte approach

Posted Jul 28, 2020 3:22 UTC (Tue) by pabs (subscriber, #43278) [Link] (6 responses)

I don't think it is appropriate, for eg, for LWN to record which articles and comments I am loading, which they could do since I am always signed in, so that I can read subscriber-only articles.

The opposite opposte approach

Posted Jul 28, 2020 7:44 UTC (Tue) by anselm (subscriber, #2796) [Link]

OTOH, you probably appreciate the “Unread comments” function (I certainly do).

In the end it comes down to a question of trust. Of course LWN.net sees everything I do on their site as I interact with their web server, and they remember enough of it to ensure that the site works conveniently for me. I do trust them that they won't build up a long-term profile of everything I look at on LWN.net and sell that to (whom exactly?) or give it to the likes of the NSA (unless compelled by law). I don't have that trust when it comes to the data RANDOM_AD_COMPANY collects via ads they serve to hundreds of sites that I might be visiting.

The opposite opposte approach

Posted Jul 28, 2020 20:18 UTC (Tue) by rgmoore (✭ supporter ✭, #75) [Link] (4 responses)

There are legitimate, user favorable reasons for wanting to track what things you have seen. For example, it makes it possible to show you only new comments, or to highlight new comments so you can quickly skip the stuff you've seen before. It would be good if LWN had an option not to record that information if you don't want them to track it, but I'm personally OK with it because I find the features it enables to be very helpful. I see that kind of simple feature as being qualitatively different from tracking intended to enable advertisers to profile me.

The opposite opposte approach

Posted Jul 29, 2020 1:12 UTC (Wed) by pabs (subscriber, #43278) [Link] (3 responses)

LWN's approach to unread comments appears to work without tracking what you have seen, it seems to be solely based on tracking the dates when you load the unread comments page. Thats marginally better, but of course article/comment delivery via email and MUA-side read tracking would be nicer.

Anyway, we appear to have gotten side-tracked, my point was that logins allow an increased level of tracking and browsers facilitate that by making login sessions long lasting instead of only for requests that "need" to be authenticated.

The opposite opposte approach

Posted Jul 29, 2020 11:52 UTC (Wed) by excors (subscriber, #95769) [Link] (2 responses)

I don't think that's correct, because the "unread comments" page is not the only way LWN indicates what you've read. For example when I view this article (https://lwn.net/Articles/826575/) all the comments are displayed as "old" (the faded yellow colour). But if I open your comment's parent (https://lwn.net/Articles/827260/), your comment is displayed as new, until I refresh the page and it's displayed as old. If I open your comment's grandparent (https://lwn.net/Articles/827186/) they're all displayed as new again. I expect (based on prior observations) that if I open those pages after posting this comment, my comment will initially be marked as new and the earlier comments will be marked as old.

I assume that means LWN is tracking the date you visited every /Articles/NNN/ URL (which includes comment pages, not just articles). If you've never visited that specific page, all comments are considered new (even if you've seen them via a parent page). If you have visited, only comments posted after the last visit are considered new. So LWN knows exactly which pages you have visited, and actively uses that information. I don't know how long that is tracked for - from some very rough testing I suspect it's at least a month, but not many months. LWN's privacy policy doesn't appear to disclose the collection of this information, but I can't see any other reasonable way the observed behaviour could be implemented.

(This all applies to a logged-in subscriber. I assume the behaviour is different for anonymous users and maybe for non-subscribers.)

Comment display

Posted Jul 29, 2020 13:04 UTC (Wed) by corbet (editor, #1) [Link] (1 responses)

The feature you describe is for project-leader subscribers; it is indeed implemented by storing the date/time the reader last looked at specific articles. That information is only kept for those subscribers, expired out after 60 days, and used for no other purpose.

I'll review the privacy policy and make sure that's covered.

Comment display

Posted Jul 29, 2020 14:41 UTC (Wed) by excors (subscriber, #95769) [Link]

Okay, thanks for clarifying that! (I have no problem with it personally, I was just curious in the context of this discussion.)

The opposite opposte approach

Posted Jul 23, 2020 22:17 UTC (Thu) by josh (subscriber, #17465) [Link]

What stops a site from doing that today, with the existing cookie-classification UIs?

Misclassifying a cookie might potentially subject the site to legal trouble, or lead a browser or search engine to treat the site as malicious.

The opposite opposte approach

Posted Jul 24, 2020 18:50 UTC (Fri) by NYKevin (subscriber, #129325) [Link]

Nothing at all, which is one of the reasons this proposal has already failed.

The opposite opposte approach

Posted Jul 22, 2020 19:08 UTC (Wed) by leromarinvit (subscriber, #56850) [Link]

I remember back in the old days Netscape had a setting to ask you, individually for every cookie, if you wanted to accept it. Must have been Netscape 3.0 some time in the mid 90s. It was even usable, because most pages simply didn't use cookies back then.

Anyway, what I use nowadays is a combination of Temporary Containers, Containerise, and Cookie AutoDelete. I've set it up so that each domain gets its own container, and they can track that single session (but nothing else) all they want until I close all related tabs. And then a few permanent containers with cookie whitelists for the few sites I actually want to stay logged in to (like LWN). I'm much more careful what I open in those. As an added bonus, I can open several distinct sessions for the same page (e.g. log in with different accounts) without resorting to private tabs or the like.

Perhaps the opposite approach could cut down on meaningless clicks

Posted Jul 22, 2020 18:51 UTC (Wed) by leromarinvit (subscriber, #56850) [Link]

I think the opposite of the off-by-default "Do Not Track" header would be a similarly off-by-default "Track Me" header. If a user doesn't explicitly set that, the website owner can assume that the user doesn't want to be tracked and should stop doing so. It would then be entirely unnecessary to display these annoying pop-ups, because the assumption would be that if the user wanted to be tracked, they'd set that header.

I realize it's not going to happen because of ad (and possibly other) revenue, but I can dream...

The sad, slow-motion death of Do Not Track

Posted Jul 22, 2020 16:57 UTC (Wed) by Cyberax (✭ supporter ✭, #52523) [Link]

They should have named it the "Do-No-Evil" bit.

The sad, slow-motion death of Do Not Track

Posted Jul 22, 2020 18:53 UTC (Wed) by jzb (editor, #7867) [Link]

DNT was DOA. It was clear from the outset that if compliance was voluntary then it would never be particularly effective in protecting user privacy. Might as well wear a button that says "do not pickpocket" and hope that would-be thieves would go after someone else's wallet.

The sad, slow-motion death of Do Not Track

Posted Jul 22, 2020 18:55 UTC (Wed) by logang (subscriber, #127618) [Link] (21 responses)

Personally, I never understood why any one would *want* to be tracked. It's like it was designed so only people informed enough to check a box in their browsers settings got the privilege of privacy. The majority of people just get the undesirable choice simply because it's default and it's what the powers that be want you to do. This was what made the whole IE 10 fiasco so ridiculous.

The sad, slow-motion death of Do Not Track

Posted Jul 22, 2020 19:39 UTC (Wed) by zdzichu (subscriber, #17118) [Link] (20 responses)

Well, if you look at ads all day, you may want them to be relevant to what interests you. Realize that majority of people do not use ad-blocker.

The sad, slow-motion death of Do Not Track

Posted Jul 22, 2020 19:57 UTC (Wed) by Wol (subscriber, #4433) [Link] (1 responses)

I normally disable "personalised ads". I get rather fed up, when I buy a system camera, to be bombarded with ads for a *different* system's accessories ... I regularly buy presents for my family - from their favourites list! - so I don't want to buy similar stuff because I don't know whether they like it, or already have it, or or or. I don't want to be bomvarded with "you've bought one, how about another" ads... "personalised ads" usually piss me off, not encourage me.

Cheers,
Wol

The sad, slow-motion death of Do Not Track

Posted Jul 22, 2020 20:29 UTC (Wed) by pizza (subscriber, #46) [Link]

> I don't want to be bomvarded with "you've bought one, how about another"

I once bought a new shower head. For *months* afterwards I was getting ads for other shower heads, like I was some sort of showerhead collector.

...the reason DNT failed is that there was zero economic incentive for advertisers/etc to respect it.

(and by that, I mean there were no legal penalties if it was not respected)

The sad, slow-motion death of Do Not Track

Posted Jul 22, 2020 19:58 UTC (Wed) by josh (subscriber, #17465) [Link] (17 responses)

I've never once heard someone suggest that they'd rather see relevant ads than no ads, outside of apologists for advertising or weak justifications given by sites asking to track you ("please let us show more relevant ads"). Rather, most people just don't think about "not seeing ads" as a choice readily available to them.

The sad, slow-motion death of Do Not Track

Posted Jul 22, 2020 20:03 UTC (Wed) by Cyberax (✭ supporter ✭, #52523) [Link] (5 responses)

Well, you've just heard it twice here.

I don't particularly care about ads either way (as long as they are not obtrusive), but seeing ads for databases is more interesting than seeing ads for feminine hygiene and laundry detergents. And I have actually found interesting (for me) products from targeted advertisement.

And no, I'm not working for an ad-related business.

The sad, slow-motion death of Do Not Track

Posted Jul 22, 2020 20:26 UTC (Wed) by josh (subscriber, #17465) [Link] (4 responses)

You're now the first person I've ever seen say that. (The comment I was responding to sounded like a hypothetical.)

I get why you'd rather see targeted ads than untargeted ads, and I can even understand caring more about that than about being tracked.

Do you actually prefer that to not seeing ads at all? Or do you just not care enough to block them because they're not blocked by default?

The sad, slow-motion death of Do Not Track

Posted Jul 22, 2020 21:10 UTC (Wed) by Cyberax (✭ supporter ✭, #52523) [Link] (3 responses)

I don't care about being tracked by websites. I'm already being tracked by my cell phone company, the license plate readers, my credit card companies and so on.

I run AdBlock which deals with most of obnoxious ads, but I don't go out of my way to block JS or do anything more proactive.

I honestly don't care either way about simple text ads (like the old-style Google Ads).

The sad, slow-motion death of Do Not Track

Posted Jul 23, 2020 8:39 UTC (Thu) by Wol (subscriber, #4433) [Link] (2 responses)

:-)

I ran flash-block back in the day. And I remember one conversation with a website owner (a small site I wanted to use) about his "bad taste" in running the entire web site in flash.

He was unapologetic, and I was "I'm not turning off flash-block for you", so he lost my interest. At least he KNEW flash was costing him views ...

(I had a nasty experience with a flash (and flashing) ad. As many people here know, autistic people have *major* difficulty blocking out unwanted attention-grabbing stimuli ...

Cheers,
Wol

The sad, slow-motion death of Do Not Track

Posted Jul 23, 2020 14:16 UTC (Thu) by gerdesj (subscriber, #5446) [Link] (1 responses)

Remember <blink /> ?

The sad, slow-motion death of Do Not Track

Posted Jul 31, 2020 13:15 UTC (Fri) by jezuch (subscriber, #52988) [Link]

I remember <marquee/>... Although I don't understant *why* I do ;)

The sad, slow-motion death of Do Not Track

Posted Jul 22, 2020 22:48 UTC (Wed) by rgmoore (✭ supporter ✭, #75) [Link] (10 responses)

I would rather do without ads. At the same time, I acknowledge that much of the web is funded by ads, and blocking them is undermining the system I'm benefiting from. I try to put my money where my mouth is by paying for ad-free subscriptions or using the donate button on web sites I use regularly.

If going without ads isn't an option, I think I would prefer relevant, targeted ads to completely untargeted ones. There are a couple of good reasons for this. For one thing, relevant ads are likely to be interesting and possibly complementary to the site I'm using. For another, targeted ads are likely to be more valuable to the site hosting them, so they will either be more profitable (and hence be less likely to go out of business) or require fewer ads per page.

The sad, slow-motion death of Do Not Track

Posted Jul 23, 2020 3:21 UTC (Thu) by josh (subscriber, #17465) [Link] (3 responses)

I donate or subscribe to various sites that have that option as well. But I block ads everywhere, whether there's a subscription/patronage option or not. I don't want the mental pollution.

> blocking them is undermining the system I'm benefiting from

Blocking them is pushing towards the system I want to see. Blocking ads reduces the value of ads, which makes them less viable, which pushes future companies to not treat ads as a viable business model.

The sad, slow-motion death of Do Not Track

Posted Jul 23, 2020 5:05 UTC (Thu) by himi (subscriber, #340) [Link] (1 responses)

Unfortunately I think one of the results of blocking ads is that companies like Facebook have a massive incentive to build far more intrusive advertising platforms.

Of course, they have that incentive anyway, since they can make far more money selling their users' attention with a sophisticated and intrusive advertising platform than with a simple advertising platform . . . I'm not sure there's /any/ way we can push back against this kind of thing, short of completely rebuilding the Internet economy.

Maybe if there was a pervasive, unintrusive and easily managed way to make micropayments to the sites that you visited it would remove a lot of the incentive for advertising, but getting that in place would be kind of hard to do, and would potentially have lots of /other/ perverse incentives. But short of that I don't think there's a decent solution.

The sad, slow-motion death of Do Not Track

Posted Jul 23, 2020 22:22 UTC (Thu) by josh (subscriber, #17465) [Link]

> Unfortunately I think one of the results of blocking ads is that companies like Facebook have a massive incentive to build far more intrusive advertising platforms.

And people can choose to not use Facebook as a result, and adblockers will help prevent other sites from feeding data to Facebook.

> Maybe if there was a pervasive, unintrusive and easily managed way to make micropayments to the sites that you visited it would remove a lot of the incentive for advertising, but getting that in place would be kind of hard to do, and would potentially have lots of /other/ perverse incentives. But short of that I don't think there's a decent solution.

There's absolutely a decent solution: block all ads, and don't treat it as your problem to solve. Someone else's ad-based business model does not obligate anyone to help them succeed. If enough people block ads, and enough technologies make it easier and less out-of-the-way to do so, ad-based business models will become less and less viable.

The sad, slow-motion death of Do Not Track

Posted Jul 24, 2020 14:53 UTC (Fri) by rgmoore (✭ supporter ✭, #75) [Link]

Blocking them is pushing towards the system I want to see.

Blocking ads alone is only an attempt to destroy the current system. If you want to push toward a specific alternative system, you have to actively support that alternative. Otherwise, you have no control over what you'll get in the long run. It might be the system you want, but it could be something worse, like a more abusive ad system that's harder to block or the collapse of useful ad-supported sites with nothing to replace them.

The sad, slow-motion death of Do Not Track

Posted Jul 23, 2020 23:39 UTC (Thu) by NAR (subscriber, #1313) [Link]

Once I was working at a company where I was not allowed to install adblockers. The experience was "interesting": I either got ads for businesses geographically near the company proxy (and 2000 kms from my actual location, so totally irrevelant) or ads for "marriage-minded bikini-clad Asian or Russian women (again, totally irrelevant). And it's not like I was visiting NSFW sites - they were blocked and also about 20+ people had clear view on my monitor in the open office, so I wouldn't dare to do that anyway.

The sad, slow-motion death of Do Not Track

Posted Jul 26, 2020 18:29 UTC (Sun) by nybble41 (subscriber, #55106) [Link] (4 responses)

> I try to put my money where my mouth is by paying for ad-free subscriptions or using the donate button on web sites I use regularly.

Another option is Scroll <http://scroll.com/>. In exchange for a flat subscription fee of $5 per month you get to browse all of their partner sites ad-free. Much better IMHO than subscribing to each individual site just to avoid the ads. (Premium content is still separate. No affiliation, just a happy subscriber.)

I've often thought it would be nice to have some integration with the *advertiser* networks, not just the publishers. As I understand it there is a sort of auction system running in the background to decide which ads are displayed for each page view. Why not provide a way to let the end user in on that auction? If the visitor's automated agent wins, bidding from a pool of money set aside for that purpose, then the ad slot could just remain empty.

The sad, slow-motion death of Do Not Track

Posted Jul 28, 2020 10:29 UTC (Tue) by nix (subscriber, #2304) [Link] (3 responses)

That would never do! It directly works against the interest of the auction operator (who wants *lots of advertisers* to drive up prices, not lack-of-advertisers to drive them down) *and* provides people with actual evidence that they're willing to pay to get rid of this stuff (and thus, that it is toxic rubbish that nobody actually wants), *and*, uh, could easily be spun as extortion and/or converted to extortion by sufficiently unpleasant advertising network operators (and these are not pleasant people). All they have to do is set up an "advertiser" of their own that always bids unrealistically high and that their advertising network always eventually refuses bids from, to jack up the price the user has to pay arbitrarily high. A crime? Sure, but very hard to prove, given that the operation of these auctions is even concealed from the advertisers.

The sad, slow-motion death of Do Not Track

Posted Jul 28, 2020 15:54 UTC (Tue) by nybble41 (subscriber, #55106) [Link] (2 responses)

Your objections seem a bit contrived. Adding another party to the auction system would drive prices up, not down. It's pretty obvious that most people don't want ads, and we already have plenty of evidence that they are often willing to pay to avoid them ("pay to remove ads" is a popular option in various mobile apps), but they are sometimes willing to put up with them in order to fund sites or apps that they care about when no other convenient method is available. The auction operator has no reason to care whether any ads are actually shown; they get paid the same either way.

As for jacking up the prices with fake bids, they're welcome to try. The user's agent wouldn't be configured to always place the highest bid at any cost. The user would set a threshold based on how many ads they're willing to see. If an advertiser's bid is excessively high then it would just let them win. At that point they can either pay up or take a penalty for cancelling after winning the bid (in which case no ad is shown and the user still effectively gets what they wanted).

The sad, slow-motion death of Do Not Track

Posted Sep 14, 2020 15:20 UTC (Mon) by nix (subscriber, #2304) [Link] (1 responses)

It's pretty obvious that most people don't want ads

Don't ignore the power of self-delusion when your paycheque depends on it. I know several people who work in adtech and a couple who work in old adland, and all of them are insistent that I am a freakish exception and that everyone really, really loves ads and everyone loves pervasive tracking and it's not creepy at all. (One of them actually watches ads in his spare time because he thinks they're an art form in their own right.)

I've pointed out that this is sort of disproved by the soaring popularity of adblockers, but nooo the problem there is that the messaging is wrong: people who use adblockers have all been lied to by evil people who point at the occasional rare bad apple like malware being delivered in ad networks, and if they can only find the right 'message' (i.e., countervailing lie) everyone will love ads again: sure they slow down your web browser, but in return you are gifted all these wonderful ads! Everyone loved ads in the high days of TV, you could tell by the way there were ads on TV: since the market is always right, that is proof enough!

(The existence of the ad-free BBC apparently does not constitute any sort of disproof, since it's government-funded. You'd think this would mean that it had a closer tie to the people the market is sampling the true opinions of, but apparently letting the people actually have input rather than leaving it up to the mythical superpowers of the all-wise market is axiomatically bad. Odd that.)

The sad, slow-motion death of Do Not Track

Posted Sep 14, 2020 21:10 UTC (Mon) by mpr22 (subscriber, #60784) [Link]

Bill Hicks Was Right.

The sad, slow-motion death of Do Not Track

Posted Jul 22, 2020 19:30 UTC (Wed) by LiPo (guest, #129784) [Link] (8 responses)

DNT is currently mentioned in the latest version of proposed ePrivacy regulation by both EU parliament and the council. GDPR mentions that users do not want to see banners in one of its recitals. Interpreting DNT as a signal of the user that does not want to be tracked as the implementation of the recital 66 of ePrivacy directive from 2009 seems to be a very natural way. The problem is that no data protection authority in EU has the courage to enforce such interpretation at the moment. Hopefully this will change sooner than later.

The sad, slow-motion death of Do Not Track

Posted Jul 22, 2020 20:01 UTC (Wed) by Wol (subscriber, #4433) [Link] (6 responses)

DNT was *spec'd* as "opt in". That's why it was so egregious of IE to enable it as the default. Basically completely ignored the whole point behind it.

It would be nice if the EU said "it's opt-in. The user has explicity asked for what they want. IT'S ENFORCEABLE".

Cheers,
Wol

The sad, slow-motion death of Do Not Track

Posted Jul 23, 2020 8:30 UTC (Thu) by mageta (subscriber, #89696) [Link] (4 responses)

The logic would still be the wrong way around. The default ought to be "I don't want to be tracked", and you can opt-in to be tracked if you like. If its any other way no meaningful amount of people will ever use it.

I mean that's also how the GDPR works AFAIK. It is opt-in for your personal data being processed, not the other way around, where personal data would be processed by default.

If you make privacy an optional feature that only "tech-savy" users ever will be using you already fail from the outset to do anything meaningful IMHO. Which is also one of the big failings of DNT. Its also stated in the article: the amount of people that ever used it is low.

The sad, slow-motion death of Do Not Track

Posted Jul 24, 2020 3:42 UTC (Fri) by roc (subscriber, #30627) [Link] (1 responses)

When it's "opt in", we can make the argument that DNT represents the desire of the user. That made it easier to argue in and out of court that advertisers should respect it.

When it's "opt out", it no longer reflects the desire of the user which made it much easier for the ad industry to ignore it.

The sad, slow-motion death of Do Not Track

Posted Jul 26, 2020 12:44 UTC (Sun) by niner (subscriber, #26151) [Link]

Well here in bad old Europe you need the clear and unambiguous, actively given consent of the user to be allowed to track in the first place. So DNT must be enabled by default to have a chance to be taken seriously in the first place. Only if its enabled by default can its absence be interpreted as consent of the user to be tracked. Though even then a "Please Track Me" header would be better.

The sad, slow-motion death of Do Not Track

Posted Jul 26, 2020 23:04 UTC (Sun) by Wol (subscriber, #4433) [Link] (1 responses)

> The logic would still be the wrong way around. The default ought to be "I don't want to be tracked", and you can opt-in to be tracked if you like. If its any other way no meaningful amount of people will ever use it.

That's irrelevant. If DNT is set, then the user has explicitly made a choice. In that case browsers shouldn't kick up a banner, they should just honour that choice.

If W3C or whoever specifies an equivalent "opt in" "I don't care about trackers" flag, then web sites should honour that, too.

Cheers,
Wol

The sad, slow-motion death of Do Not Track

Posted Jul 27, 2020 3:07 UTC (Mon) by smurf (subscriber, #17840) [Link]

But it doesn't match many sites' business model. So instead of no popup you'd see the annoying "hey, make an exception for us or subscribe, otherwise you won't see any content" popup we're been fed by news sites for the last couple years.

The sad, slow-motion death of Do Not Track

Posted Jul 24, 2020 8:45 UTC (Fri) by LiPo (guest, #129784) [Link]

IE was right. Tracking on the Internet brakes European fundamental rights. See also communication to W3C at https://ec.europa.eu/justice/article-29/documentation/oth..., for example, https://ec.europa.eu/justice/article-29/documentation/oth....

It is very unlikely if EU says the not tracking is opt-in. Actually, it is the other way around. The user has to give unambiguous, specific, informed and free consent to be tracked, see GDPR.

The sad, slow-motion death of Do Not Track

Posted Jul 23, 2020 15:15 UTC (Thu) by davecb (subscriber, #1574) [Link]

I also recommended giving it a legal definition in a Candian request for comments by the CRTC

The sad, slow-motion death of Do Not Track

Posted Jul 22, 2020 20:45 UTC (Wed) by marbe (guest, #134563) [Link] (1 responses)

I don't know how it is in the rest of the world but in EU one of the changes GDPR brought are 'advanced' cookie consent tools distinguishing consents for different levels/purposes of tracking. It took about few months to deploy. It would be nice to present these tools also to users who send the DNT header when sites make use of such cookies.

And by the way... Am I the only one unable to comprehend the "peace among worlds" presented by sites to users when they declare "Oh, we don't have the slightest idea of what do you mean by 'DO NOT TRACK'. Oh, you must mean you want us to run whichever javascript code we like on your computer to gather any data we desire. Well.. that's what we were about to do anyway so.. We're going to simply ignore your request. Thanks for visiting and don't forget to give us five stars in this form called 'How did you enjoy the 500ms of us gathering your data?' Feel free to come again!"?

Thumbs Up for all sites respecting the DNT and sorry for the rant.

The sad, slow-motion death of Do Not Track

Posted Jul 28, 2020 9:18 UTC (Tue) by nilsmeyer (guest, #122604) [Link]

Throw in the obligatory "your privacy is very important to us" banner, of course with the implied caveat "making money is even more important, though").

Do Not Sell standardization

Posted Jul 22, 2020 23:15 UTC (Wed) by dmarti (subscriber, #11625) [Link]

Do Not Track is not legally binding...but there is a project to automate the "Do Not Sell" signal required by the California Consumer Privacy Act (CCPA). (The CCPA definition of "sell" is much broader than just an exchange of data for money.)

https://github.com/privacycg/proposals/issues/10

Yes, CCPA is opt-out, not consent-based like GDPR, but automation might make opt-out feasible.

The sad, slow-motion death of Do Not Track

Posted Jul 23, 2020 10:47 UTC (Thu) by freemars (subscriber, #4235) [Link] (1 responses)

I'd like to see Cookie Rot - your browser will happily accept, store, return cookies, but sometimes bits of the cookies get corrupted (perhaps every time the browser gets shut down?) You would need a list of uncorruptable cookies - your login credentials for LWN.net, for example.

The sad, slow-motion death of Do Not Track

Posted Jul 23, 2020 13:47 UTC (Thu) by JGR (subscriber, #93631) [Link]

Advertisers and large sites would soon work around this by increasing the size of cookie data with multiple copies, FEC, checksums, etc.
This would probably inconvenience users logging into small sites which won't get updated, more than it inconveniences advertisers.

The sad, slow-motion death of Do Not Track

Posted Jul 26, 2020 20:08 UTC (Sun) by amarao (guest, #87073) [Link]

I believe DNT perfectly fits into GDPR. Explicit request which ought to be honoured.