"Do Not Track" HTTP header supported by IE, Opera, FF, Safari but not Chrome

http://en.wikipedia.org/wiki/Do_not_track_header

by TomAnthony • 14 years ago

146 92 14 years ago

en.wikipedia.org

Jimmie2• 14 years ago

I can hear it now "Of course not, why would an ad company sabotage itself?".

Wikipedia says Chrome is set to support the header by the end of this year (2012).

Wikipedia's source: http://online.wsj.com/article/SB1000142405297020396080457723...

cooldeal2• 14 years ago

Even if what you said is true, it's definitely interesting that the browser that is on the forefront of implementation of almost every new web feature is about a year behind on only this one while all the other major browsers have already implemented it.

Jimmie2• 14 years ago

It is a little suspicious that Chrome is dragging it's feet, isn't it?

I guess we'll see if they honour their promise by the end of the year.

chc• 14 years ago

It might have to do with the fact that most Web technologies do something useful while this just sends an extra header that pretty much every site they visit will ignore. I wouldn't prioritize it either at this point in time. This is a movement that needs support from site maintainers, not browser implementors.

cpeterso• 14 years ago

Google also said they would drop H.264 support from Chrome, but we're still waiting.

lampe• 14 years ago

the thing is why should it be supported if the website is tracking you any way?

its just a request to not track me but i don't can see if its really not tracking me.

SoftwareMaven• 14 years ago

The real question isn't whether Google's browser supports this, it's whether Google's servers support this. It may be that Google isn't adding it to the browser until it can commit to it on the server.

joejohnson• 14 years ago

Allowing people to opt out of tracking would decrease the load on Google's servers.

jrochkind1• 14 years ago

Well, sure, and if everybody installed effective ad blocking software so they never saw a google ad, that would decrease the load on google's servers too.

jrockway• 14 years ago

You can already opt out of ad targeting: https://www.google.com/settings/u/0/ads/preferences/?hl=en#o...

cooldeal2• 14 years ago

That makes no sense whatsoever. There are a few websites which do request it, and the header will do no harm to the ones that don't. So Chrome users will be unable to use that feature (going to be?) supported by Twitter, for example.

Did Google web properties use WebGL, NaCl etc. before Chrome supported them?

4ad• 14 years ago

The "Do Not Track" HTTP header is useless, equivalent to a "Do not Steal from Me" T-shirt. It is also harmful because it gives users a false feeling of protection and security. The question should not be why Chrome didn't implement it, but why Opera and Firefox did.

jiggy2011• 14 years ago

From a technical point of view it has little merit, granted.

I think from a legal point of view though , you are expressing your desire to not be tracked.

This would be preferable to legislation dictating that the user must manually approve all cookies etc.

throwaway55-332• 14 years ago

"you are expressing your desire to not be tracked."

Yes. And I think this is important. For example, for cases brought by the FTC, class actions, and other litigation it might be useful.

If a company ignores the Header sent by the user and tracks her anyway, then one could argue the company too has expressed an intent.

The Header is machine readable like any other. A server can parse it and take a specific action based on its presence or absence. Arguably it does have technical merit.

rjd2• 14 years ago

It will make all the difference in a court case when you have specifically denied consent and someone has continued to do something.

If you want to get pedantic about it just being text, all law is just text, books upon books, but its the enforcement that counts. This opens the door for enforcement of other laws.

paulgb2• 14 years ago

You're not denying consent, you're sending some non-standard bytes to their server which will be lost as soon as the request is processed. Without legislation, do not track is just an honor system.

notatoad• 14 years ago

Is there any law that actually prevents tracking? It doesn't really matter whether you consent or not if it's legal either way.

zobzu5• 14 years ago

Well Twitter won't track you if you have "do not track" enabled.

Unless you have Chrome.

It should be pretty obvious why Chrome doesn't implement it. It's against the core business of Google (tracking). They will only implement if it causes a PR issue (and this very post is a PR issue btw, even thus a small one)

jabr• 14 years ago

Google has already committed to supporting it in Chrome. It's just not in it yet.

I don't know if they've made any promises to honor DNT requests, but their browser will be able to send them.

vog• 14 years ago

Google has an "Incognito" mode which provides an even better tool against tracking than DNT, because it doesn't depend on the merci of the websites you are visiting.

Also note that almost no other browser are supporting such a feature out-of-box, at least not when this feature was added to Chrome.

So while I'm not a big fan of Google, either, I find it hard to argue that Google doesn't care about privacy features in Chrome.

lolcraft• 14 years ago

It reminds me a lot of RFC 3514's evil bit[1].

[1] http://www.ietf.org/rfc/rfc3514.txt

TazeTSchnitzel2• 14 years ago

We can finally rest assured our computers are safe, since all evil packets get filtered. Right?

waterlesscloud• 14 years ago

It enables social pressure on sites to honor it.

Once it exists, sites can be forced to explain why they don't obey the users' express wishes.

throwaway55-332• 14 years ago

Not only social pressure, but perhaps legal pressure too.

revelation• 14 years ago

Why would Chrome not support a meaningless header sent by the client?

You are asking Schneier to implement security by obscurity with emphasis on the obscurity part. Hell, you are asking the same people that sent a "This is not a P3P policy" P3P policy.

Now I don't know if they think, as do I, that all of this is just meaningless extra traffic on the wire, or that they are evil and don't want to commit to privacy guarantees. No way to tell.

hmottestad• 14 years ago

Anyone sent in a RFC for using code 666 for "Server is evil and does not support Do Not Track headers".

__ted__2• 14 years ago

The IETF does have a network-layer solution to that.

http://www.ietf.org/rfc/rfc3514.txt

kevinsd• 14 years ago

Given that Google is perhaps the only company whose main business is online ads and ads relevance is crucial, it is natural that they cannot give up the opportunity of tracking profile of ads viewers as easily as other companies.

willscott• 14 years ago

I still haven't heard a cogent explanation of what this is supposed to do.

"Do Not Track" sounds nice, but seems no easier to scope than the initial problem of excessive information collection. I think it's safe to say that I want companies to 'track' me in order to keep me logged in for a session. Likewise, I hope that my bank keeps logs of visitors, so that it can respond to abuse / hacking attempts. Is this aimed only at behavioral advertising, or is it meant to have a broader scope?

It seems like the technical execution is almost misguided without having the policy discussion first and figuring out what it is we disagree with. Without that, I don't feel like this is going to draw a strong enough line to separate people abusing tracking from the legitimate uses.

zobzu5• 14 years ago

Do not track me for advertisement, statistics, etc. is the intent.

__ted__2• 14 years ago

Ending your list with etc. undermines your point. With this header set, can my site track what pages a user views to recommend pages to him later? Can compliant sites keep stats for engineering purposes? Grandparent is dead-on - it's bad enough that this does not affect the behavior of bad actors, but if it isn't even clear what effect it will have on good ones, the false sense of security may be worse than nothing.

nl6• 14 years ago

statistics

WTF? So analytics packages will somehow have to exclude these browsers from all reports? Some reports? Can you count impressions from these users?

einhverfr3• 14 years ago

Does that mean the access_log should omit visitors who set this header? Does this mean log analysis tools should omit such records in the logs?

I am confused as to how this works for statistics purposes.

fizx3• 14 years ago

From http://donottrack.us: "Do Not Track is a technology and policy proposal that enables users to opt out of tracking by websites they do not visit, including analytics services, advertising networks, and social platforms."

Emphasis on "websites they do not visit" directly, meaning that it only applies to iframes, popups, etc. If you typed it in the address bar, or clicked on a link to get there, the site isn't limited by DNT.

This is not legal advice.

smashing• 14 years ago

I don't know what legal ramifications could follow sites which declare they support Do Not Track as a spec but in actuality do not support any of the features of the spec in a meaningful way. Other than just bad press if discovered, I don't think there is any punishment for not properly following a technical spec outside of civil lawsuits.

nl6• 14 years ago

So Disqus, and any site that uses it is screwed then?

rmc• 14 years ago

This is misleading. The important actors in the "who supports Do Not Track" is not browsers but websites. "Browser support" just means "we'll tell the website that you'd rather not be tracked". If every browser sent this header, and every website ignored it, it would be a complete failure.

So what, if any, websites support the "Do Not Track" header?

leocassarani• 14 years ago

Twitter, for one: http://www.theregister.co.uk/2012/05/18/twitter_signs_do_not...

recoiledsnake• 14 years ago

Well, websites are the ones to lose with this, not browsers(except ones with conflict of interest like Google and Microsoft). So websites can say "Hey, a popular browser like Chrome doesn't support it, so why should we?". That's why it's important for all browsers to support it so that there will be more pressure on websites to support it.

bzbarsky• 14 years ago

The key part is not the websites but the services (ads, analytics, etc) that sites use.

For those, quoting from http://donottrack.us/implementations :

3PMobile, AdInsight, AdOcean, AdTruth, AP News Registry, Blue Cava, BlueKai, BrightTag, Chitika, Effective Measure, eXelate, Jumptap, m6d, Mochi Media, TagMan, Tealium, TruEffect, Ensighten, Twitter.

Note absence of Google with their advertiser hat on, as well as Facebook.

btian• 14 years ago

but will be incorporated by the end of 2012

nigma• 14 years ago

On the other hand Google provides browser extensions that lets you opt-out from advertising cookies and Google Analytics tracking. These are not vastly popular though, each at around 100k installs for the Chrome version.

https://www.google.com/ads/preferences/html/opt-out.html

https://tools.google.com/dlpage/gaoptout

nzmsv• 14 years ago

As far as I can tell, this official extension for Chrome has been available since January of last year and supports the header: http://googlepublicpolicy.blogspot.ca/2011/01/keep-your-opt-...

jnorthrop• 14 years ago

This will only be useful if governments enforce it. The US has included it for consideration in the US Privacy Bill of Rights[1] and the EU may enforce it as well[2]. But until there is some form of punishment for not complying with DNT it is essentially window dressing.

[1]http://www.whitehouse.gov/sites/default/files/privacy-final....

[2]http://ec.europa.eu/justice/data-protection/article-29/docum...

commonersense• 14 years ago

If you disable Cookies and Javascript you will stop probably 90% or more of tracking. How much tracking is done without using Cookies and without Javascript? KISSMetrics? What else?

Teapot• 14 years ago

Without JS and Cookies the web is too crippled. It's not an option for most people. DNT tries to fix this on a more legal level than technical.

othermaciej• 14 years ago

There's lots of ways to track you. Here's a sampling: <http://samy.pl/evercookie/>; Turning off cookies and JavaScript will stop many, but not all. It also makes many popular websites nearly unusable. Browsing with JS and cookies off, and selectively turning them on, is an option that is only really practical for experts.

shaggyfrog• 14 years ago

Since no one's mentioned Ghostery yet, I highly recommend it as a way to opt-out of all sorts of stupid tracking mechanisms on the Web.

http://www.ghostery.com/

lsiebert• 14 years ago

Hmm... Somebody could presumably bake it into chromium

idleworx• 14 years ago

The Do Not Track movement and its whole premise is useless. I've blogged about why this is so a while ago: http://blog.idleworx.com/2012/02/do-not-track-movement-is-us...

TazeTSchnitzel2• 14 years ago

Jesus' words (or Lincoln's, if you wish) apply here:

"If a house be divided against itself, that house cannot stand."

armini• 14 years ago

If that's not evil then I don't know what is.

plaes• 14 years ago

Will be also supported by Epiphany (default GNOME browser): http://git.gnome.org/browse/epiphany/commit/?id=f7a3fca8a8e0...

rickmb• 14 years ago

Opting out of a privacy violation that should not take place to begin with is insane.

Also, way too little way too late.

Ten years ago this might have been seen as constructive contribution towards industry self-regulation. Now it's just a sick joke that won't do anything to change the fact that tracking without explicit permission will be illegal in many parts of the world.

nikcub2• 14 years ago

DNT does not work based on trust and if somebody is going to track you they are going to track you regardless of if you send them a HTTP header asking not to, or not

(the tl;dr of the spec is that it adds this HTTP header to all requests:

    DNT: 1

it can be set to 1 or 0).

There is also a large risk here of creating a false sense of security amongst less knowledgable users. We should be teaching users cookie control, plugin and request blocking as part of using the web, not an 'install once, forget forever' solution that doesn't work.

DNT is also adding more entropy to HTTP requests, making you easier to identify or profile. You get less privacy. Think about how much an advertiser would love to know that you are privacy conscious, that puts you in a certain socio-economic group.

I am a huge privacy nut and advocate but DNT will not work. The only way to fix this is better third party blocking and controls in browsers.

I have been meaning to flesh out a blog post against DNT for a while, since I keep getting emails asking to comment on media stories about it being adopted.

mike-cardwell2• 14 years ago

"We should be teaching users cookie control, plugin and request blocking as part of using the web, not an 'install once, forget forever' solution that doesn't work."

Doomed to failure. Users shouldn't need to know this stuff, and the vast majority never will. Even if it is taught and tested at school. There are plenty of things we could do to improve privacy, but much of it will cause the major browser vendors to make less money, so is unlikely to happen.

1.) Tie all cookies to the domain in the address bar. No more third party cookie tracking.

2.) Tie all cache entries to the domain in the address bar. Gets rid of numerous tracking tricks at the cost of increasing bandwidth usage a little.

3.) Get rid of HTTP referrers. Completely. It's none of your business which site I was on before yours.

These three things alone would make a huge difference. It's the low hanging fruit that we need to get before we tackle the more difficult problems.

I think there's too much money involved though. The above improvements would definitely hit Microsofts and Googles bottom lines. But hey, there's no problem with insanely rich advertisers controlling the major browsers right. No conflict of interests there.

EDIT: I agree with all of your other points regarding DNT. Just not the user education one.

EDIT2: Another one:

4.) Make all cookies, session cookies. I configured my browser to delete all cookies on exit ages ago, and the web still works fine. I might have to type in my username each time I go to login to sites instead of having it auto-filled, but that's a good trade off. Besides, browser plugins like LastPass solve that problem better.

nikcub2• 14 years ago

I wrote a Chrome extension to do what you describe, it breaks almost the entire web. I am experimenting with a generic rule set with a view of forking Chrome with a better default privacy and security policy.

I totally agree that users shouldn't need to know the details, but there are some things, like third-party cookies, that needs to be explained and simplified. A bit like not clicking on an exe email attachment.

I think the equivalent could be that users white-list websites, or 'install' them, if they trust them, which allows those sites to execute third-party cookies. Everything else would be 'incognito' by default.

But I am not entirely sure what would work, hence my experimentation at the moment. I know that the answer definitely isn't DNT.

"Do Not Track" HTTP header supported by IE, Opera, FF, Safari but not Chrome

Related Stories