AP Adopts Firefox's 'Do Not Track'; Others On the Way

theweatherelectric writes "As noted by the Mozilla Blog, the AP News Registry is the first large scale service to support the Do Not Track (DNT) feature of Firefox 4 and Internet Explorer 9. They write, 'The Associated Press (AP) is the first company to deploy DNT on a large scale, and it only took a few hours for one engineer to implement. The AP News Registry tracks 1 billion impressions of news content, with 175 million unique visitors per month, and has membership with more than 800 sites. When consumers send a DNT preference via the browser while viewing a story at one of its publisher's sites, the AP News Registry no longer sets any cookies. The previous solution was for users to opt-out via a link to a central opt-out page referenced in each participating news site's privacy policy. They still count the total number of impressions for each news story, but aggregate consumer data for those with DNT in a non-identifiable way.'"

Comments

Non-identifiable?

[JeffSh]

"but aggregate consumer data for those with DNT in a non-identifiable way.'"

hmm. Haven't we had many stories about how "non-identifiable" is still identifiable in some cases? It sounds like "Do Not Track" may mean actually "Might track less". As with all voluntary things though, the implementation is completely up to the company implementing it. There's no reason for them to do anything different. I might think it would even allow another layer of tracking since if you have "DNT" on then all that means is yet another flag could be used as a unique identifier, and now they can infer that you're tech savvy and paranoid enough to flip that flag.. What is the point of this again?

Re:Non-identifiable?

[GameboyRMH]

Yeah Do Not Track is a great big joke. It's like going through a bad neighborhood at night, loaded with jewellery like a Hollywood diva with a Do Not Rob sign stuck to your back.

Re:Non-identifiable?

[mcmonkey]

Well, how does it work?

You visit site, the server checks your DNT flag before sending a cookie...and then what?

I'm guess the server records GameBoyRMH visited site xyz.com, but no cookie was set. And whenever you visit one of those 800 sites, they know it's you, because they have to check for your DNT flag.

So you've preserved the 100-or-so bytes the cookie would take on your drive, but how is that not tracking?

It seems to me a real DNT track system would be client-side only, and the setting would instruct the browser to accept and instantly (or after the session) delete the cookie, without giving any indication of the activity to the server.

Re:Non-identifiable?

[Richard_at_work]

They would store "someone visited page X at date Y and time Z" and they may also be able to store "and they were referred in from page ABC", but they would have no way of seeing where you went from that page, even if it was to another page on the site, because all that page is going to store is the same non-identifiable information.

A cookie allows them to give you a unique identifier, which works for differentiation down to individual browsers on the same machine, and that allows them to get a good picture of your travel around their site (and their affiliate sites etc) - the DNT flag would remove that, only allowing them to track the number of hits on a page and where the visitor came from.

They don't know its "you" each time, because the DNT flag contains no identifiable information - to them, this is the equivilent of you clearing out your cookies after each individual page visit. No cookie, no ID, no tracking beyond the current page. Same deal.

Re:Non-identifiable?

[Anonymous Psychopath]

All those cookies you listed have already expired. Just look at the timestamps, it's right there.

If someone wanted to track you badly enough to do the things you're suggesting, they would simply ignore the DNT flag.

Something I suspect a lot of the folks on /. struggle with, as I do myself, is accepting the axiom that perfect is the enemy of good. DNT isn't remotely perfect, but that isn't the same as not being a good thing.

Can't Wait for the NSA to Follow Suit!

[BJ_Covert_Action]

Great! I can't wait for the NSA to follow suit and respect the "Do Not Track," option in FF4. Then we will know with all certainty that Hell has frozen over, we will be able to opt out of TSA ball-groping by using flying pigs for transportation instead of planes, that girl I had a crush on in HS will finally kiss me, and all my preparations for the zombie apocalypse will finally show their true value as the world crumbles around us as the final sign of the times.

This is nice but the obvious remains...

[alostpacket]

What good is a privacy feature when it rests on the compliance of those who have conflicted interests in the matter? I'm scratching my head a bit as to why Mozilla went down this road at all. I know everyone is pushing for the Web-2.0-cloud-service-based-thin-client-web-app-with-local-storage and video embeded in buttons, but there has to be some kind of gatekeeper. If our gatekeepers (the browser makers/W3C) are merely going to add a "please be nice" button, what chances are there that the web will continue to be a medium of information excahnge, and not turn into a see of potentially dangerous apps? I know that's a bit chicken little sounding but this was one advantage the plugin model afforded. Don't want Flash/Java? Easily blocked. Don't want HTML privacy invasion? Ask the advertisers nicely to comply? Something seems seriously broken with this philosophy. It's arleady diffucult to browse a lot of sites sans-javascript, and it seems only to be getting worse. Personally, I've always thought one of the advantages of the web, one of the things that caused it to grow so rapidly, is that sites were sanboxed away from the user via the limitations of the browser.

Re:This is nice but the obvious remains...

[BJ_Covert_Action]

I'm scratching my head a bit as to why Mozilla went down this road at all.

Well it seems like a bit of a publicity ploy for Mozilla to me, albeit, a good one. Mozilla has had issues with FF in recent versions (I'm looking at you FF3 bloat), but it still remains the poster child browser for a private/independent/free browser. I think the devs at Mozilla know full well that the Do Not Track flag requires the unlikely compliance from other entities. However, by making the feature easy to use and by publicizing it, it has brought the problem of, "Random data mining companies are harvesting everything about you," right into the main view of every user that configures their own Option settings in FF.

Furthermore, if users start checking the option because it sounds like a good idea, but there is still a big fuss about companies tracking users anyway, the users will start to ask what the hell is going on. If Mozilla takes the time to explain that, for true non-tracking web-browsing, those data mining companies have to take it down a notch, it could very well increase public criticism of data mining in general.

So all in all, I think adding the "Do Not Track" option was much more of a political move by Mozilla than an actual technical one. It's nice to see someone with money and clout sticking up for such things for once.

I wasn't worried about the good actors...

[metrometro]

This is a nice thing for everyone to be doing, but it's still a trust relationship with no transparency. Bad actors won't respect my wishes. That's the definition of a bad actor.

The solution has to be on client side. Otherwise it's just more trust, which is what we've been using all along. I'd much rather trust the Ghostery extension to just block the tracker scripts to begin with.

Stupid Idea

[Anonymous Coward]

To start with, they should rather strip all the unnecessary, incredibly detailed version information off the default user-agent string. Relying on the "goodwill" of ad companies is just absurd.

Oh and, as soon as this Do-Not-Track header becomes a default setting it will be ignored anyway...

Re:OK, I'll admit

[dmomo]

What's worse about this, is that it is implemented by an iframe. The "like" button is actually at facebook. bigfatsluts.com doesn't know anything about your facebook info, but, because you are logged in, and the facebook content knows what page it is being loaded into (the iframe source looks likes this: facebook.com/plugins/like.php?http://bigfatsluts.com/thehairiest.movie), facebook knows that you have visited the page.

The more sites that implement this, the more facebook is able to track your web browsing outside of facebook. I find this scary because Facebook has already proven that they would like to market to your friends using your data. Imagine this: "Hey Jim. Bob likes Big Hairy Sluts!! We thought you might like them too. Click here for Big Hairy Sluts." That may sound paranoid. But all the technology for it is in place. The only reason we are not seeing it is because Facebook hasn't implemented it. They certainly have the power to. That's granting them too much trust in my opinion.

I have yet to see a feature to disable this "facebook functionality on external sites" crap. I want facebook to honor the do not track. If everyone got riled up about it, Facebook might do so. Sadly, I'm just not seeing the "critical mass" of user outrage.

Sorry, too late.

[Chemisor]

Those of us who care, already whitelist cookies. Those who don't, are not going to bother setting the DNT flag in the first place.

Re:Sorry, too late.

[maxume]

I can convince my family to enable do not track, no way am I going to try to walk them through cookie white listing.

Re:Sorry, too late.

[psyclone]

With Cookie Monster it's not too painful. Set it to apply to the entire domain and not deal with subdomains, and have it block by default. Any time they need to login, just click the icon and permanently allow. Any time some crappy website that requires cookies denies them, then temporarily-allow.

I'm not saying most people will do this, but a fair amount can do this if they care. I doubt there is anything we can say to show them they should care, however.

Re:OK, I'll admit

[psyclone]

Not if you're still accepting cookies from facebook.com / fbcdn.net