Online Privacy Is Poised for Regulatory Showdown
nytimes.com
nytimes.com
I'd be happy to answer any questions.
Opt-out sites would be more private, but would offer less in the way of features, functionality, and personalization (both directly and indirectly because of the massive hit to monetization).
In particular, I don't think many people realize just how many features on the modern web are enabled by anonymized analysis of large scale logs. A short list:
1. UI optimization via event logging 2. Features like priority inbox in Gmail 3. Bubble up in search rankings 4. A/B testing 5. Google Analytics (determining backlinks to your site) 6. Disqus login for blog commenting 7.
While the proposal is about opting out of "third party web tracking", it is not obvious what a third party is. Is a YUI, Google Analytics, or Facebook Connect plugin which I chose to integrate into my site "third party code"? What if I have a business account with something like Crazyegg.com -- can I put their JS heatmap tracking in my webpage to figure out what buttons my users are getting confused by?
If this is complex for hackers, do you trust the government that thinks the internet is a series of tubes to get this right?
Finally, there is one throwaway sentence in the article which deserves underlining:
It also wants to ensure that any restrictions do not impede law enforcement and national security efforts.
------------
A decentralized, opt-in version of randomwalker's well thought out donottrack proposal (http://donottrack.us/) would allow users to balance privacy vs. benefits. Including "X-Do-Not-Track" in an HTTP header is an excellent idea; including it in a piece of legislation is much less so.
Opt-out sites would be more private, but would offer less in the way of features, functionality, and personalization (both directly and indirectly because of the massive hit to monetization). Specifically, I don't think many people realize just how many features on the modern web are enabled by tracking of some kind or the other. A short list:
1. UI optimization via event logging
2. Features like priority inbox in Gmail
3. Bubble up in search rankings
4. A/B testing
5. Google Analytics (determining backlinks to your site)
6. Disqus login for blog commenting
7. Google Maps or location based service integration
While the proposal is about opting out of "third party web tracking", it is not obvious what a third party is. Is a Google Analytics or Facebook Connect plugin which I chose to integrate into my site "third party code"? What if I have a business account with something like Crazyegg.com -- can I put their JS heatmap tracking in my webpage to figure out what buttons my users are getting confused by?
And if this is complex for hackers, do you trust the government that thinks the internet is a series of tubes to get this right?
Moreover, there is one throwaway sentence in the article which deserves underlining:
It also wants to ensure that any restrictions do not impede law enforcement and national security efforts.
Remember that the government which is now talking about protecting your privacy is the same one which is making the very pilots themselves go through backscatter stations on the way to their planes, the same government that forced phone companies to tap your phones and forced Google to give them your email 9000 times per year.
In my humble opinion, the solution to this kind of thing is not to throw up our hands and pray for this latest batch of Congresscritters to deliver us from evil, but for someone to build a private browser, with something like a built-in accessible Tor, which provides a better experience for those people who value privacy over functionality.
ETA: However there is one thing you say that is easily refuted -- having a DNT header without legislation to back it up is useless, because nobody has the slightest incentive to respect it.
:) Well, your website appears to be agnostic on the question! To quote donottrack.us:
> Compliance with Do Not Track could be purely voluntary, enforced by industry self-regulation, or mandated by state or federal law. We do not take a position on these alternatives.
In all seriousness, I do understand the difference between your individual position (i.e. pro-government) and the project's position, but unless Dr. Mayer has a substantially different opinion (which he may), there probably won't be a huge difference between the project & the individuals.
Which is fine.
I think the larger point is that it's a LOT more important for the government to actually stop tracking us than for it to beat up on entrepreneurs with yet more new picayune rules and regulations, especially given the current economic climate.
Current ways in which the government tracks us:
1. Social Security Card
2. Selective Service Act
3. Driver's License
4. Tax Returns
5. Bank Accounts and Funds Transfers
6. Do Not Fly List
One could go on in this vein. A hypothetical brown immigrant entrepreneur who flies a lot and isn't that enthusiastic about potentially being drafted to kill random people in Afghanistan has enough problems with government tracking as it is!
In other words: this bill does nothing to address the problem of having hundreds of millions of peoples' personal information in the databases of a bankrupt, militaristic government.
Who is being keelhauled for leaking Eliot Spitzer's peccadilloes or Joe the Plumber's unpaid plumbing license? Those kinds of abuses of government databases are a much bigger problem than the comparative ephemera of targeted advertising. The FBI's Carnivore is a lot worse than Amazon's recommendation engine, and by failing to address that directly -- indeed by assuring the government that it will retain backdoors for "national security purposes" -- the FTC push prioritizes all the wrong things.
Because if "national security" means that I must surrender my shampoo to the kindly TSA agent in broad daylight, it can mean whatever the government wants it to mean.
And I might also point out that the self-same politicians who are drafting this law were among the heaviest users of Rapleaf, and hence are quite likely to carve out "political speech" exemptions for their own tracking campaigns.
"Opt-in" would mean that by default -- with no action on the user's part -- tracking would be prohibited. Clearly that is infeasible (for precisely the reasons you describe; it would kill the industry.)
While the proposal is about opting out of "third party web tracking", it is not obvious what a third party is. Is a YUI, Google Analytics, or Facebook Connect plugin which I chose to integrate into my site "third party code"? What if I have a business account with something like Crazyegg.com -- can I put their JS heatmap tracking in my webpage to figure out what buttons my users are getting confused by?
Yes, these are exactly the questions that me and my colleagues are working out. The goal is to avoid breaking the web as much as possible. For example, one way in which an exception to Do Not Track is triggered is if the user logs in to the 3rd party provider, so FB Connect will work smoothly regardless of DNT.
If this is complex for hackers, do you trust the government that thinks the internet is a series of tubes to get this right?
Great point, which is why things are structured the way they are -- the idea is for Congress to delegate authority to the FTC, which is a highly tech savvy organization (they just tapped Ed Felten, for example). They're also great at getting input from the technical community (I was myself on an FTC privacy panel earlier this year.) In short, hackers are quite involved with the process.