An Update on Microsoft’s Approach to Do Not Track(blogs.microsoft.com) |
An Update on Microsoft’s Approach to Do Not Track(blogs.microsoft.com) |
A smart reaction to the given reason companies were ignoring DNT. But as long as more than X% of people enable it, websites that want to track will keep coming up with lame excuses to ignore it.
DNT is a political solution, IMHO. Many websites and industries claim that consumers accept tracking. If the consumer sends a contrary message every time they connect, tracking them anyway is a practice that is difficult to defend in front of the FTC and Congress, and in the court of public opinion. On another level, it's simply rude.
Option should have been "Track Me", unselected by default. If a person wants to be tracked, let them say so.
"Do you want Ad agencies to gather and possibly share with or sell to their partners about your browsing activity?"
It was just not explicit that it should be OFF by default. Reviewers fault. Microsoft, made a Marketing stunt of enabling it by default 2 years ago, in practice killing the point of DNT and setting back the industry several years.
With a default option DNT would have no reason to be honored by any site owner. We could be enjoying native DNT tracking right now if Microsoft hadn't done that stupid dick move 2 years ago.
How many years we'll need before the number of users that already have DNT set to ON by default are negligent is hard to measure.
This should be a post apologizing for the trouble they caused and for destroyed the point of a W3C proposal that set back the industry for several years. Instead it looks like another Marketing stunt.
You're taking this really far out into left field and what you're saying is incorrect. DNT is a useless standard; it requires the visiting site to receive the preference and act appropriately on it. There is no way to enforce that the site acts appropriately. Sites that want to track users were always going to anyway. Except for maybe a few exceptions (such as I would expect browser makers to follow the standard) almost no one was ever going to honor this even before Microsoft's decision.
If you have a business where tracking users can make it more profitable and the W3C came along with a standard that said "if you receive this bit pretty please don't track the user please" why would you even care? There is nothing anyone can do about whether you track or not. At worst someone on a blog publishes a rant about how you're ignoring it but big whoop; countless other sites are also going to be ignoring it.
At worst the federal government decides the line the advertising industry has been feeding them about being able to regulate themselves is just that, a line, and decides perhaps consumers need some protections backed by force of law.
That's the only thing that ever had a chance of making advertisers take DNT seriously.
What is holding it back is that there are no teeth to it - no laws that you must respect it - and lots of rewards for ignoring it. That's what needs to change.
It needs buy in from both users, advertisers and publishers. If you make it so that you only get approval from users, advertisers and publishers will ignore it and the whole thing collapses. They already have very little incentive to honor it.
We could have seen laws, in the future, requiring business to honor it. But this move by Microsoft gave publishers/advertisers all the weapons they would need to fight those bills. It no longer express the choice of the users, and that was the key of DNT.
Microsoft move completely removed any possibility that publishers or advertisers could support it, basically killing the proposal. It is their fault. Do not expect to see anyone honoring it anytime soon.
Is there really any impetus for companies to not track you when you send a DNT header? Is there really any governing body that enforces it in any meaningful way?
This may seem paradoxical, in that this plugin would only work correctly by not sending DNT to those sites.
But I've found that some tracking cookies are useful (the one for editing Wikimedia projects, for example), and sites should be able to earn their way onto a whitelist, as long as they honor the requests of people who say "No. Don't track me. Not even you."
1) Since it's not default, it makes browsers more unique and thus more trackable.
2) It gives many (perhaps even most?) non-technical users a false sense of security, making them less likely to take more effective measures.
Weighed against what miniscule good DNT might do (I think it does next to none), these two reasons alone make DNT harmful.
Sure if you ask the question "do you want to be tracked?" you'll get an obvious no. If you ask the question "do you want better search results?" you'll get an obvious yes.
Biased questions lead to biased answers.
But this is of course only me, I hear rumors that there are actually people valuing ads. But I am still not convinced, the right question is neither »Do you want to be tracked?« nor »Do you want better search results?« but »Do you want better search results at the price of being tracked?«. My personal answer is a definitive no but I can't really tell in case of the general population.
Sites that ignore DNT should be blacklisted.
In its current state, Do Not Track is literally meaningless. Any company that respects Do Not Track is probably just not tracking anyone at all, because as long as Do Not Track is the default, it does not actually represent a user's preference.
With this change, websites could argue that they don't care and choose not to honor it. Is there any actual enforcement of Do Not Track? If not, the whole idea seems broken at its core.
I always disable all of Microsoft's "on" settings when installing Windows, as they usually try to pass some sneaky stuff by me, and even if I don't fully understand what something does, I feel safer having disabled it.
As for the DNT option, I've never really cared for it, as I never use IE for anything.
But my point is that Microsoft tries to hide these "user choices" in its Express Settings when installing Windows, so of course this doesn't reflect people's true choices.
Now if only Microsoft approached their "default settings" there in the same way, and didn't assume stuff like "you want to use a Microsoft account, rather than a local account, don't you?" (This is actually represents two of the top 3 request in Windows 10 user feedback in the Security section - not requiring a Microsoft account by default).
https://windows.uservoice.com/forums/265757-windows-feature-...
That was in Win8: http://www.theeldergeek.com/windows_8/win8_install_setup_per... (Sign in without a Microsoft Account)
And Win8.1: http://www.theeldergeek.com/windows_8/win_8_1_install_setup_... (Create Account > Sign in without a Microsoft account)
At no point were you required to use a MSA, it was always the preferred option (since you get the sync, OneDrive, as well as automatically signing into the store and any other Microsoft services) but you always had the ability to turn it off in the setup screens, and the option was always clearly labeled. If you didn't want an MSA, local accounts worked perfectly fine as the default account on the box, and you can always convert to and from within the PC settings.
Advertisers don't need a case. They don't need to ever care about this bit.
But more importantly, this isn't a binary flag. People might want to be tracked, they might want not to be tracked, or — most likely in my opinion — they might not give two hoots. Similarly, when people walk into an physical place, they might want to be looked at, they might not want to be looked at, or they might not be particularly concerned with whether anyone in particular is looking at them.
Though I don't know that I'd say that they are such a firm.
The actual positive form of the question, ignoring the politics and just thinking about user intent, would be something like "Do you want this computer to serve a unique fingerprint to websites, allowing companies to both reconstruct your identity between sites on their network, or to persist your identity after you have purged cookies and other session data? Companies tend to use this tracking ability to enhance your advertising experience, to collect statistics on the usage of their sites, and to ensure they don't double-count you. Malicious uses of this data are also possible, though currently rare."
The important bit of the question, when phrased this way, is that it doesn't just ask about a mechanism (the DNT header), but about the user's intent—and because of that, it's activation state could be made to control all sorts of things besides the DNT header. For example, saying "no" to the question should cause the browser to try to add some per-domain jitter to its answers to questions about what links are visited, what fonts are installed, what the User-Agent string is, etc., so that the browser can't be fingerprinted.
The idea that advertising needs "enhancement" sounds suspicious. Couching the premise of the question in 77 words of pseudo-legalese-style terms and conditions would muddy the waters, and sow confusion, and probably innure users to do anything to make the checkbox go away, so they can simply get to the internet.
Politics aside, that kind of twisting and turning smells like a dark pattern, in my opinion.
An excellent point. It's like asking, "do you want to pay $100?" or "do you want to pay higher taxes?" without indicating the benefits you receive in return.
Most advertisers that I read about who were also vocal against DNT said they would not honor it before Microsoft even made it a default. Quit kidding yourself that Microsoft's decision did anything but hasten its irrelevance.
>DNT is not a technology that will automatically restrict people from tracking you like adBlock for instance.
But turning the browser-side setting into that? Now there's an idea.
I think one of the reasons robots.txt is generally respected is that there's a stick behind that carrot; hypothetically (what with us all using so much cloud these days), a site administrator that noticed a traffic spike commensurate with something ignoring robots.txt can respond by treating the requests as attacker-originated, which most "legitimate" sites would want to avoid.
What's the stick behind the carrot for do not track?
That's the difference between the two scenarios. A sysadmin will know what to look for and will know how to appropriately react to it. Your average end user probably doesn't know, care, or know how to react to it. And a built-in browser implementation will never happen because all the major companies have it in their best interests not to implement such a feature. If that weren't the case, we'd have had that feature long ago.
I disagree. robots.txt is almost always used for hiding pages that shouldn't be exposed to the internet and are useless to expose. For example you don't need a robots.txt crawling the html document you're statically serving to prove domain ownership for Google Apps.
Everyone wants the most views on their content as possible so the incentive is to let as many things as possible be indexed therefore using robots.txt is limited as much as possible. It would not be good for search engines to crawl the things put into robots.txt.
Anyway I'm not sure I put the responsibility on the right group. It will probably be down to websites choosing ad networks that respect their users' DNT settings. Just like they choose ad networks that don't host malicious ads or ads that take over the whole page.