Slashdot Mirror
Privacy Groups Mull 'Do Not Track' List for Internet
Technical Writing Geek writes with a Reuters story about a collection of privacy groups looking to set up a 'Do Not Track' list online, similar to the 'Do Not Call' list meant to dissuade telemarketing. "Computer users should be notified when their Web surfing is tracked by online advertisers and Web publishers, argue the Consumer Federation of America, the World Privacy Forum and the Center for Democracy and Technology, among other groups in a coalition promoting the idea. Rather than burying privacy policies in fine print, companies should also disclose them more fully and provide easier ways to opt out, the groups said. The organizations submitted the proposals to the Federal Trade Commission, ahead of the consumer watchdog agency's workshop on Nov. 1-2 to study the increasing use of tracking technology to target online ads.
So when will I be able to add my email to a "do not spam" list?
Rather than burying privacy policies in fine print, companies should also disclose them more fully and provide easier ways to opt out, the groups said.
Also, they want world peace, and a pony.
The theory of relativity doesn't work right in Arkansas.
mull, from what i remember means scuttle, bar, make harder, oust. these people are not trying to prevent a do not track list, they are trying to establish one.
Read radical news here
This is going to be very hard to enforce. Besides, privacy doesn't exist these days.
"The only ones fighting for privacy are the ones who have something to hide" - Rupert Murdoch
--
Madonna is the only talented content creator!
Anyone else see the problem here?
OK, let's set up a "Do Not Track" list. How are they going to know not to track you? By figuring out who you are, then checking to see if you're on the list.
Oops.
A better idea would be a standardized opt-out system where your browser tells every server, "Do not track me," then set up web applications to honor that choice.
Maybe set up an X-DontTrackMe header for HTTP requests. Or a standardized DontTrack=true cookie not linked to a domain. Something that has no unique information and gets sent to every website. Then turn it on and off in the browser with a checkbox.
Something like that could be tested as a Firefox extension or IE browser helper (if I'm remembering the terminology correctly) to start with, then added to browsers themselves.
The 'Do Not Call' list works - to a degree - because people who ignore it run the risk of legal action, due to all being inside the country they're calling. I can't see many companies going to the extent of running offshore telemarketing companies due to the high cost of international calls.
This problem obviously does not exist on the internet - the cost of serving up those banners to millions of people clearly doesn't eat into the profits of these companies, so there's no reason for them to stop, and if laws are passed forcing them to stop, they'll simply be replaced by foreign companies advertising either on behalf of the same companies serving up the ads now, or set up by the advertising companies to circumvent the laws.
This won't work.
Dealing with lawyers would be a lot less tedious if they all looked like Casey Novak.
I could see this causing alot of sites to shut the doors because of lost advertising money Personally i'd rather see a little ad than have to pay for all the sites that I like. Online tracking/advertising is a really effective system, and usually not too intrusive unless a particular website goes overboard
Unless of course they are using Mull as in Mull Over which means 'Reflect deeply on a subject'
>
> Currently, if users choose to opt-out from online ad tracking, a cookie, or small piece of software, is placed on their browser reflecting that choice. But if users delete their cookies, then the opt-out is lost. AOL's technology would enable the opt-out cookie to reset after cookies are deleted.
In other words, we put this cookie here to track you.
If you don't want to be tracked, let us put this special cookie here.
And if you really don't want to be tracked, and you delete your cookies, we've got some double secret probation "technology" that can put it back for you! (What do you want to bet it's a persistent Flash object, or given that this is AOL we're talking about, a background task that runs 24/7 to put the cookie back, should it ever be accidentally deleted...)
Where I come from, that's spyware.
The real opt out is to block all traffic to advertising domains at the router, and it's the one method the marketing companies dread the most, because who would ever opt back in?
When applied to an idea, "mull" generally means to think about it in detail.
You're incorrect. As in; not correct; not in conformity with fact or truth; "an incorrect calculation"; "the report in the paper is wrong"; "your information is wrong ...
As far as I'm concerned it either means to fortify, heat and spice (mulled wine, cider etc), or to think over/consider an idea or range of options.
Usage here is just fine.
The problem with the suggestion is implementation. IP Addresses are shared and reused and so aren't unique to a user or household. Cookies also don't work since they are only sent to the site you're hitting - so a cookie for ftc.gov isn't going to be sent to DoubleClick. Having individual advertisers have opt-out systems isn't great since a lot of the time I don't know who is serving the ads I'm seeing (without delving into the HTML).
Unfortunately, there is no simple way of defining something like this. A better solution might be to regulate the type of information that they are allowed to collect in the first place. If they aren't allowed to record my IP address (or any other identifying information like a zip code I type in a form or POST/GET data), then there would seem to be limited privacy implications. They could gather data showing that people who like power tools also like Sony stereos or whatnot, but without information like IP addresses, form and GET/POST data, there is little they can use to violate my privacy.
Am I missing something?
Won't this damage a lot of adSense technology already in place by non-evil companies? Also, would this apply to browsers keeping history of where you've been?
Ask not what you can do for your country. Ask what your country did to you
The largest lesson in emal spamming has been that they'll send spam to anything resembling an email. They don't care where it came from or how and why they got it. So as I see it the only value of a "do not spam" list is that it will contain a lot of active email addresses. That is gold to spammers and I think anyone who believes such a list will reduce spamming (rather than have the opposite effect) is sorely deluded.
Sometimes I find myself idly wondering how many miserable failures of opt-out proposals will be necessary before people get a clue that opt-in offers the only possible way to success.
Then I snap out of it and remind myself that of course some people have a clue, and that's precisely why they continue to put these proposals out (or to enthusiastically back them): doing so serves their purposes nicely. It allows them to proudly say that "they've taken the lead in protecting privacy" while of course they're doing everything they possibly can to do the opposite. (They do this, of course, because they're well aware that few people would opt-in to have telemarketers bother them, or to have spammers clog their mailboxes, or to have their personal data collected.)
This situation is unlikely to change in the forseeable future. Just as it's given us ineffective anti-telemarketing measures, just as it's given us ineffective anti-spam measures, the outcome of this process will inevitably give us ineffective anti-privacy-invasion measures.
Which is why it's probably best to just ignore this nonsense and instead use technological means to either deny data to invaders or feed them bogus data.
This is a great idea, but how do you enforce it? That is the issue with most internet laws. Pass all the laws you want, you just can not enforce any of them.
This is the Internet equivalent of having a 'Kick Me' sign stuck to your back.
I already 'opt out' of website advertising - I add the advertiser to my do not advertise list. It's called adblock. It's gold.
Like many regulations added it is just a protection for coporations to prevent corporations from being prosecuted under laws intended for people. Prior such regulations have already legalized corporate stalking, this one is just in response to citizen complaints about being stalked. A big question here is how the implementation of opting out will work, this could really provide far too much indentifying info to the stalkers. With a business oriented web there is far too much identifying information already.
You may view this post as trollish, flamebait, or even tinfoil hat material, but it is still annoying that something as informative, communicative and potentially a source of world peace, may instead lead to our downfall. The exchange of knowledge and ideas built the internet into something desirable to log into and made the internet the meeting place of minds. Corporations of course noted this and applied the old marketing mantra "location, location, location". Unfortunately cost structures are such that most sites have to turn to advertising to exist, others exist solely for the advertising. Governments of the world have noticed the exchange of ideas here too and they fear them greatly and thus they have taken to stalking us as well. Somehow I doubt this new regulation will allow us to opt out of their stalking.
Remember the TNG episode where even thoughts of violence were prosecutable? Believe it or not, there is a value to anonymous thinking, travel and speech. Will technology destroy such freedoms? In many areas, I truely want to be an Anonymous Coward for in doing so I remain an Anonymous Patriot.
They'll give you a cookie that tells them you have opted out. Then another firm will track which things you weren't tracked in because you opted out of it. That's so great!
I don't see how this could be reasonably implemented. You can't put your IP address on the do-not-track list, because it could change day-to-day. You'd need a cookie in your browser saying you opted out. But that's as much information as if you hadn't opted out in the first place, they'd just have to toss the info after they got it.
User: "Hi, I don't want you to track the places I've visted."
Marketer: "Ok."
User: "Remember, I don't want you to track me, and I have just visted XYZ site."
Marketer: "Ok, I'll forget."
IMarv
Trusting software vendors is no smarter than trus
that website owners pay for bandwidth since this would kill adsense, pretty much?
The alternative to tracking via cookies is micropayments where you have to pay a fraction of a cent for each web page you view.
It's not even you that's being tracked. It's your browser. Unless you constantly use your real name online, there is no way to link a name to the observed browsing habits of a person unless ISPs get involved and connect IPs to names.
Cookies don't work, they'd have to be set for each site. IP address doesn't work, they change and are shared. And what exactly is it people are worried about in the first place? That's what I don't get here... how is your privacy being violated if they don't know who you are?
If this is limited to advertising to people who are customers... that is, people who have some kind of relationship that would allow them to be identified... that would work. But it doesn't sound like that's what people are concerned about...
I can't believe I'm responding to this, but the outfit you're looking for is the Business Software Alliance, not the SBA.
Why don't you contact them, throw yourselves on their mercy, and let us know how that works out for you?
I recall when commercialism was just beginning on our early utopian internet. Now the net is largely garbage and advertising leaving people to assume that the net wouldn't exist without it... kinda like cable TV without commercials. I don't like it and we don't need it. But it isn't going away.
But there should be some kind of W3C standard for web browsers and commercial web sites that could offer up a simple "dash board" that identifies a variety of characteristics about the sites users are browsing and the information should be across the board standard and unified whether it's on MSIE, Firefox, Opera or whatever. The dashboard should display the site's host nation, information about whether various cookies are being used in tracking, any categories of the site and stuff like that. Then people will begin to have the information they need when visiting various sites. At the moment, just about all of these things are available but in bits, pieces and extensions here and there and it's not all the same everywhere you go. And this idea can't work for everyone I know... not everyone looks at the dashboards in their cars, so why would they look on their browser? Still. The information should be easy, available and most importantly, standardized for all professional/commercial sites to support.
Any excuse is being used these days to label people as terrorists, imagine if you are in a 'do not track' list for online activities!
I believe people in this "do not track" list would most certainly make their way into some other NSA terrorist tracking list as well. People would protest against that, they would say that this violates their privacy,their civil liberties, but The US government would simply cite the Patriot Act and some other national security excuse like "not all people on the 'do not track' list are terrorists, but terrorists are using this list against the US people, so we must take action and monitor the people that wish not to be tracked!". The initial fuzz would cease and everybody would passively accept this 'violation', mostly thinking they have nothing to hide. After a couple of years we would find out that some major telecommunications company is helping the US government tracking people in the 'do not track' list and a federal suit would be placed against this company. The suit would last only a few month, because the government would issue some new legislation (with the cooperation of all the legislative from both parties) that would protect the telecom company (and all others like it) against such charges (after all they are helping national security!). Again, after a few months, some other non-governmental institution would propose a new list (much in the same sense as the do not call list) that would protect people against social networking stalking. The government would consider the people on this list as potential terrorists, then.... etc... etc... etc... and everybody would accept that passively as they have nothing to hide... etc... etc...and the telecom company would be charged... etc...etc... and charges would be dropped... etc... etc... national security... etc... etc...
They want to keep track of the people who don't want to be tracked ... *blink*
Why "opt-out" at all? If there's potential for abuse, it should be opt-in. That's already been accepted with bulk commercial email. Now, it just needs to be enforced.
Well, out here at the Minsk Home for Deposed Nigerian Cabinet Ministers the first thing I must do is get hold of this list so I can stop scamming all you people.
Since most web usage is tracked anonymously it's much more likely that identifiable information will be hijacked from a copy of the the "no not track" list than from any of the web tracking itself. Seems like kind of a silly, tinfoil-hat-inspired idea!
Give a man a fish and you have fed him for today. Teach a man to fish, and he'll say "WHERE'S MY FISH, YOU IDIOT?"
The Do Not Call list was to prevent unsolicited calls.
This, however, is saying, "Look, I want to go to your Web site and have you not track me." To which I think the valid response should be, "Well then, don't come to my Web site."
The user is entirely in control. He initiates the actions, not the Web site. It's not as if he's running a program and the Web site suddenly shows up. And if it does, that's spyware/malware, not cookie tracking.
I second the CookieSafe, Adblock and NoScript extensions. Once a user knows how to use them, life becomes good. Yes, it has been argued that your average user can't handle some of them, or that they're quite inconvenient for some. But if you go shopping at a store, others can see what you buy, unless you disguise yourself or wear a hood, which is also inconvenient. You have to decide how much you value privacy. It rarely comes for free.
Beetle B.
Using a hash would work, but the number of problems with the list far out weight any good reason to have a sensible debate on the top.
Quack, quack.
I don't really see the point in this. For sites willing to obey the rules they can publish a P3P privacy policy for their site. This allows users to reject their cookies based on what the site owner plans to do with the data. Or alternatively a user can set his browser to accept 1st party cookies but reject 3rd party cookies.
I believe IE (and possibly firefox) actually requires a valid P3P policy to serve 3rd party cookies at all.
There is an argument that the browsers should be more aggressive at explaining to users that they are leaking their personal data due to the default privacy settings.
Please fill in all of the following required fields:
First Name:
Last Name:
Birth Date:
Gender:
Marital Status:
Social Security Number:
Personal Email Addresses you do not wish tracked:
Personal Computer / Home Network IP addresses you do not wish tracked:
Web sites that you do not wish to be tracked to:
You are a special, unique individual, and that's a great thing. Unfortunately, you also have a special, unique definition of "mull", and that's not working out so well.
Chris Mattern
Browsers should probably delete all cookies when they close, for privacy reasons. This wouldn't be a major problem - it would just mean people need to log in to sites more often.
It would be like the default-block pop-up blocker, with a simple mechanism to opt-in to long term cookie storage on a per site basis.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
Ah, but what is the definition of "contect".
We have what you're asking for - it's called the HOSTS file. Put every damned ad tracking domain next to a 0 and you're done. Mine has already gone past 20,000 entries and it works just fine with Win XP and Tiger, thankyouverymuch.
Your job bunky, is to be part of the solution and start submitting entries. I wish stopbadware.com would publish its list instead of making me look up domains one at a time. Those guys are part of the problem.
This isn't stupid enough by itself. It gets even stupider.
In order for a web site to know that a person has "opted out" of tracking, the site would have to set a cookie to track that user's preference to not be tracked.
While I realize there is a difference between a cookie like:
It's still tracking. Maybe I'm nitpicking...but, so are they, yes?
My ZooLoo
One opt out to rule them all
One opt out to bind them
One opt to find them all
And in the freedom blind them
Three levels of security for the paranoid King
Useless and a waste of time
Five cookies for the hapless sap
Who clicked on Track Me For All Time
Seven credit checks for the customer
Whose identity has been stolen
Nine illegal agreements for the click thru license
Soon to be voided
One opt out to rule them all
One opt out to bind them
One opt to find them all
And in the freedom blind them
-- Tigger warning: This post may contain tiggers! --
The only way to do it is via some sort of "don't track me" token. But what do we really mean by "don't track me". Some services need cookies etc. Are cookies tracking? What about the context used to set up a secure connection for transactions?
Engineering is the art of compromise.
P3P lets a create a all-encompassing privacy plan for their browser, and only websites that comply with particular levels of user privacy, and sign their sites as doing so, are able to set and read cookies in the way that the user specifies. The standard was created by W3C, and even had support initially from IE and Mozilla.
The code for P3P in Mozilla sat untouched from 2003 until 2007, so they turned it off for a few releases to see if anyone would notice. When no one complained, they finally yanked it out of the firefox and seamonkey trunks.
The vast majority of websites are never going to file one of these documents, since it is just a bunch of paperwork, and a setup for a lawsuit against yourself.
My questions not answered by this article are:
The Do not call registry works because it is tied phone numbers, which are static for users, and are the only gateway for phone communication between a user and a solicitor. There is no such vehicle for the internet. If the U.S. government wants to assign web browsing IDs for all users, then it could work. If that ever happens, I'm moving to Cambodia.
Free unix account: freeshell.org
isn't tracking a useful thing?
- cookies are used to maintain the session of web applications - this isn't going anywhere
- tracking user actions within a site lets us get great statistics, work out where our web apps need improving
how do you prevent malicious tracking without damaging the above?
who says what is malicious and what is good? who polices the police?
and what's wrong with being tracked anyhow?
All you need is a local HTTP proxy server set to block known advertising servers, and a local DNS server set to point the target URLs of tracking scripts somewhere benign. If your proxy server strips out __utm* cookies, so much the better.
Actually, screw local -- if you were an ISP with your own servers and the wherewithal to (re)sell ADSL, you could offer something like this as a paid-for service; and even give out CDs with a customised Firefox, preconfigured to use your proxy and DNS. I know people would gladly pay a premium for advert-free surfing -- after all, Sky Plus users pay for (what is effectively) advert-free television.
Je fume. Tu fumes. Nous fûmes!
Please give us your name, social security number, address, sex, date of birth and IP address so we can enter it into a huge all-encompassing database so as to ( not ) keep track of you.
Thank You
The Watchers
Adblocking is stealing, Just like skipping TV commercials. the Ads are the price they put on their content, and is what pays to keep them running, providing the service. If you don't like it you should, visit other sites, and watch PBS (and donate), or pay Cable/Sat. channels and pay sites. Or just eyeball past the ads if they arn't interesting to you.
... really?, even though he served in the Luftwaffe? ...
By blocking ads, you are preventing them from getting paid, while taking up thier bandwidth and other resources.
Personally, I support the adding of something like an "X-Demographics:" header to HTTP, where users can optionally list anything they like, from "age:20-30 sex:male location:texas interests:cars,babes,booze", to "Piss Off", and Ad-servers can use that data for demographics, instead of trying to guess what you may be interested in. People could easily put invalid data into the field, but, those who would would probably be the ones who would block ads anyway. No need to 'mine' for data, when most people would give it away for free, resulting in better ad targeting, cheaper, more profitable, and open, so that anyone serving a site can use it without cost, not just within the little ad boxes, but to adjust content site-wide.
I don't mind Ads that support content (as opposed to spam, which provides me nothing), but it was silly when for about 6 months I was mainly getting feminine hygene ads from some sites (being male)... and after looking up Arthritis information, getting AARP offers... Like when I saw my Grandfather recieved an offer in the mail: "If you served in World War II, you are eligible for U.S. Government Benifits!"
By giving you a tracking number that identifies you as someone not to be tracked? Duh. Someone has been smoking a little too much of what comes off the tubes.
Speak for yourself.
The DNC list is unconstitutional. Nowhere in the Constitution do the States delegate the authority to the Federal government to regulate communications.
Libertas in infinitum
1. Download moblock/peerguardian
2. Download BISS lists
Alright, not entirely foolproof, but a start in the right direction to keeping the AD tracker dirtbags off your "front-lawn"!
Windows guys please stop pissing on everyone and the Linux guys stop pissing in the wind, hoping to hit Windows guys!
a subjekt that is being discused at the particucar moment.
Read radical news here