Daring Fireball: Cookies and Privacy
daringfireball.net
daringfireball.net
I can almost guarantee that, if asked, most users would request that their browsing not be tracked some ad company you have no knowledge of. An interesting case where Apple's policy is far more reasonable than Google's.
That comment has completely disappeared.
[Edit: bstar77 has cleared up the situation.]
Anyway, I'd just like to hear an opposing view as they seem to be out there.
It's difficult to picture many people wanting this at all. I agree with Gruber 100% on this.
Disabling third party cookies seems like a sensible default to me. You can have an argument about which option is better and there are good arguments for either of them – but neither of the two options seems outrageous to me if you were to pick them as the default.
I can almost guarantee that, if asked, most users would request that their browsing not be tracked some ad company you have no knowledge of.
For me, ads are a necessary evil because I don't want to ever pay for every content I consume on the internet. So, If third party cookies are used to serve me better ads, ads that actually interest me, then I'm all for it.
Just this past week I finally decided to move my blog from Dreamhost to a Managed WP Hosting company, and it was all because of their ads following me all over the internet. I'm thankful to Google that it showed me those ads and not something about beer or hip-hop music or macrame or whatever I don't care for.
In the case of most ad networks, no one knows who they are, no individual visits their site directly. Now in the case of Google, I don't know why they couldn't just serve ads from google.com and still get around this issue, since most people would have accepted cookies from them already.
My instinct is that most people would not want dozens of faceless ad companies collecting large swaths of their websurfing history.
But, but... better ads! Let me know how that sales pitch works out in the long run.
A friend of mine was not very happy when he discovered that he was served ads about "how to lose weight!", and "struggling with depression?". Of course, I don't even know if those were targeted to him. Maybe the next ad he'll see is "struggling with paranoia?" :)
Plus, if I searched Google or visited sites for "depression", "dildos", "flatulence problems", "David Hasselholf CDs", "weight loss", "quit your job" etc, I sure as hell WOULDN'T want to see "better ads" targeting me for such topics --especially when I'm browsing with other people around me.
Higher click through rates come from a better match between the user's interests and what the ad is offering. It is good for the advertiser (since they get more customers), and the site (since they get more ad revenue), and the user (since they see relevant ads instead of garbage).
Well, I'd happily pay to get rid of the ads, given the chance.
Higher click through rates come from a better match between the user's interests and what the ad is offering. It is good for the advertiser (since they get more customers), and the site (since they get more ad revenue), and the user (since they see relevant ads instead of garbage).
It sure as hell isn't good for me. I don't want to see "relevant ads".
For one, they are just there to make me spend more.
And second, as I said above, I ABHOR relevant ads shown when I browse, especially with other people around, that can guess that all those "adult diaper" ads I'm being shown have something to do with what I was searching for in private.
Second, if Google can't do a good job of showing me relevant ads in gmail -- and it can't -- I don't think its cookies will help it. You're assuming facts not in evidence.
Three, there's also no evidence that making ads better targeted has been good for the ad industry (whose overall revenues have if anything fallen) or ad quality (when's the last time you saw a great online ad? I've seen plenty of great print and tv ads).
Judging from my personal anecdote with A/B testing targeted ads, there's a lot of evidence that it's good for both advertisers and users. Just try running tests and you'll see it for yourself.
If a/b testing increases conversions all that demonstrates is you can get more revenue per ad dollar. Whether any "good" occurs is an entirely different matter. You might be selling penis enlargement pills.
I can understand, sort of (even though the parts of the Internet I use most are community supported, not ad supported so I don't think less effective ads will suddenly destroy the Internets even if a large majority currently is ad supported)
> So, If third party cookies are used to serve me better ads, ads that actually interest me, then I'm all for it.
But this I do disagree with. I surf the Internet a lot, and there's already more than enough stuff distracting me that I wasn't looking for. No matter how useful it may seem to be, it cuts deeply into my productivity if every venture into some research or just surfing gets sidetracked by extremely interesting ads. Extremely interesting (but non-relevant to the topic at hand) links are already enough of a problem, slurping bits off my willpower to not click them, that I don't need any ads hypertargeted at my personality to draw away my attention from what I was looking for in the first place.
No really, I prefer ads that don't apply to me at all.
Some browsers have an even tighter setting, between "first-party only" and "no cookies": prompting for every cookie being set.
That's what I use in Camino. It is more expensive as I'm prompted every time I browse as site for the first time, but the default dismiss via "[ESC]" is to deny the cookie, and to set a deny rule in the browser.
That way, I only accept cookies on sites in which I want to log in, and (depending on the site) sesion-only cookies of sites which require cookies.
That's also a framed question, because it's a false dichotomy. You don't need targeted ads (and thus, tracking) to make money of ad income. I'm not even sure (as others have pointed out) if targeted ads are more profitable. Even assuming that non-targeted ads are less profitable than targeted ones, then so be it. I don't think that the business model and/or profit margin of a company (Google or not) is a valid argument when considering privacy, which I would consider a fundamental right.
"Would you feel comfortable giving away information regarding your online activities in exchange for free web services like Google Search, Maps, and Gmail?"
Using the phrase "targeted advertising" is misleading. It's not that the advertising is targeted that people oppose, it's the insight into your online activities is exposed without you having any control over that information's use.
Given that Mozilla claims they "fight for the users," is there a reason Firefox doesn't also default to only allowing first-party cookies? (Perhaps it has something to do with the massive deal with Google that represents 90% of their revenues?)
It mentions: "Some websites (e.g. Microsoft's Hotmail, MSN, and Windows Live Mail webmail) use third-party cookies for purposes that are not necessarily privacy concerns, and disabling third-party cookies may cause problems with those sites."
That's probably the reason.
It's only sleazy if you see it as an attack and not a simple explanation.
Mozilla is willing to break html5 video for all intents and purposes because h264 isn't open enough (but this oddly helps Google) and allow third party cookies by default of reasons that make no sense (but this oddly helps Google) and it gets it's money from... Oh that's weird.
Everyone has an agenda. Gruber is an very pro-Apple/anti-Google advocate. He could also be credibly classified as anti-web (where the argument suits his prior agenda. As I'm sure many will call shenanigans, I could happily reference at least a dozen examples of his misinformed anti-web sentiment). Did Gruber declare any of that in his observations? Did the submitter?
Given that Mozilla claims they "fight for the users," is there a reason Firefox doesn't also default to only allowing first-party cookies?
To most people the benefit of third-party cookies outweighs the detriments. Outside of the functional benefits, the economic foundation of most of the content that people rely upon depends upon third-party cookies.
Firefox isn't an irrational group. They realize that undermining the platform doesn't do much for their users. Apple, on the other hand, has no advantage helping the economic cause of the web as a whole. Quite the opposite, in fact. Which is how they chose a default that is contrary to every other web vendor. If you want to monetize users you'll just need to wrap that HTML up into a WebView and submit it to the app store -- be sure to add some iAd support.
The Safari policy was designed to pick a tradeoff of privacy vs. compatibility that would let it be enabled by default. Since most users never change default settings, this arguably gives more privacy benefit to the typical user, at the expense of a bit more control for experts.
Side note: the Chrome third-party cookie blocking setting behaves roughly the same as that in Safari, but is not on by default, so it has less privacy impact than either the Safari or Firefox approaches.
They could have gone public with the issue. They could have alerted users and given them the option to change the defaults. They could have found some interesting ways to make allowing 3rd-party cookies more advantageous to the consumer.
Instead, they coded a hack to intentionally ignore your privacy settings. Maybe it's not a huge action, but I can't hold that action in my head together with the mantra of "do no evil." I just can't. And I'm truly saddened by that.
That is - I might visit nyt.com, and have no problem have them tracking who I am, (I.E. that I have a subscription and can see more than 20 articles / month) - but I would prefer that the underlying advertisers not be able to track me from site to site just because they happen to be one of the advertisers on nyt.com (and whatever other web pages I visit - eventually they would start to build a pretty significant profile around me)
It may be the case that there are some legitimate (and useful) cases where third-party cookies are useful - but, if that's the case, I'd rather _explicitly_ allow that use, rather than have it allowed by default.
Hard to imagine very many people who would prefer the third-party tracking by default - and I vote for inconveniencing that small group of people, in order to protect the privacy of the much larger group who don't even know what a "cookie" is or how it works.
This "3rd party cookie only on interaction" is a setting that most desktop browsers don't have. You can either accept or deny 3rd party cookies. So, in that regard Safari on iOS is different than the rest. But I'd argue that it's a very sane default setting and I hope that normal browsers everywhere start adding this setting too. I'd use it!
Its not 3rd party cookies to blame, its their use. There are legitimate uses for third party cookies. If I care about blocking ad networks, I use an ad blocker. I just dont go ahead and limit the functionality that these cookies offer.
I think it'd be more fair to say that this particular use-case is the one that he's emphasising. And, in the context of privacy, it's the one that regular users are going to care about the most.
> If I care about blocking ad networks, I use an ad blocker. I just dont go ahead and limit the functionality that these cookies offer.
That might work for you, as an individual, but Apple couldn't do it without copping a lot of flak. Imagine if they suddenly blocked ads by default—the web would go crazy.
I would posit a guess that there are more sites out there that need ad revenue to survive than there are sites that need third-party cookies to survive.
So, who is to blame? The ad service for serving something inappropriate, my browser for having a bad default privacy setting, or myself for not changing the privacy setting and lending my wife the laptop to check her email?
No more 3rd party cookies for me. It's rather shameful that these ad networks have seen fit to work around a sensible default. It's worth a mention that this isn't new - flash cookies have been a workaround for ages.
I'm pretty sure you want that too but please continue with this utopian straw man about how this is only about better ads.
But then again: when everybody is blocking Google and Facebook, how would they earn there money?
I think that endgame is obvious, they bribe users to let them track them.
Information about TV and radio habits is very lucrative for companies like Nielson -- they pay quite well for participation and diary keeping. Even taking short surveys over the phone is rewarded with $25-50+ checks.
A company like Google is in a unique position to automate this process -- opt in to tracking and receive a tiny percentage of the more lucrative ads google is able to get. Win-win, tell your friends and almost everyone signs up.
Just like we keep telling the MPAA/RIAA to do.
I'm only half joking.
If I were to run FB or Google, and discovered ads of any type were being blocked, I'd naturally try to change the minds of my users the old-fashioned way: money.
The problem is the entire "free through advertising" model. Once you set the price of something as "free" (ala Gmail/Google search) you have a tremendously hard time charging people for it. Sure you can provide "premium" features (ala the freemium model) but how can you do that with search?
It's either no longer a problem or depends on a site's implementation though because I've used both platforms without 3rd party cookies recently.
Meanwhile, j.mp (bitly) works just fine.
I’d have used “tracking” in place of “engaging with”, but that’s semantics
Actually, it does break Google's way of engaging with consumers. +1 buttons (as well as Facebook Like, Diqus comments etc) require 3rd party cookies.
Example: I don't have a Google+ account, so I don't need to see the +1 button. If you have a Google+ account, you would have a cookie, and thus be able to see the +1 button.
An alternative solution on the browser side (and I think I saw this before somewhere) would be to only send cookies to a 3rd part site if the user has visited that site 1st party style before; i.e. don't accept 3rd party cookies if they are new. That's a pretty weak signal in the case of Google (who doesn't visit that page?), but at least for many other websites it could improve the status quo ante. If I've never visited some ad network's site, they should probably not be able to track me. Ads could then display inline a "Customize Ads" link that allows users to opt in to targeted advertisement.
"User has visited 3rd party host somewhen" is probably too bad a signal. We'd need something like "User wants to use 3rd party website". That's probably not possible to build with the tools we currently have.
"Don't want to be tracked by advertisers? Use Firefox, not that browser built by the web's largest advertising network."
2. Select Under the hood on the left
3. Hit the Content Settings button at the top under Privacy
4. Check the box labeled Block third-party cookies and site data.
The reason for the cookies is this plugin: https://chrome.google.com/webstore/detail/hhnjdplhmcnkiecamp...
---
Maybe you can help me: I have the same preferences but there are some strange cookies I can't delete.
My Preferences: http://cl.ly/EW0B
My current cookies: http://cl.ly/EWuU
After I clicked on "Remove All": http://cl.ly/EX96
When I now restart Chrome (without visiting any sites and about:blank as start page) all cookies are back: http://cl.ly/EWBr
Any idea what could be causing this?
"I’d have used “tracking” in place of “engaging with”, but that’s semantics."
"Sounds wrong, or is wrong?"
Gruber on Apple's storage of GPS data:
"[It's] either due to a bug or, more likely, an oversight."
I don't mean to rip on the guy directly. Gruber's a competent writer, and in the technology world, that's rare. But I don't understand why his opinion on Google's cookie debacle are "news" when his agenda is so obvious; what Apple does is good, what Google does is bad.
Google, Facebook and many other companies are different though. Collecting data is their primary source of revenue (unlike Apple & Microsoft that sell hardware and software).
One was an error of incompetence, the other was willful.
We can see the practical problems with this situation in that Gruber cannot come out and say the plain truth -- that Battelle's opinion is absurd, and only furthers the case to look at him as a Google shill. Apple's default privacy settings on Safari are to be commended; they are part of why I always suggest Safari as the best option for a WebKit-based browser, regardless of Chrome's bells and whistles. Google's actions in this area cannot be defended by any sane person -- they are clearly subversive, and the notion that Google "knows what's best for consumers who simply didn't know better" is utterly Microsoft-Circa-1990s Evil (with a capital E! This was the whole argument for bundling Internet Explorer, among other things).
I don't believe Gruber has ever written a book.
99% of Gruber's articles are just him providing a (somewhat snarky) view on the industry - it's pretty rare for him to write an article that has any inside knowledge - My guess is that it's less than 1 in 100.
He's been a pretty enthusiast regarding Metro/WP7 recently - as those product appeal to his design aesthetic. I suspect that if Microsoft continues to execute well, that Gruber will be seen as a Microsoft/Apple Design elitist in years to come.
I kind of like it when the argument is about the idea rather than the person. I wish HN discussions more often would be as well, sadly we rarely afford Gruber that courtesy.
But, at the very least, most people know where Pogue, Gruber, Siegler are coming from - so we go to them when we want the "Pro-Apple" perspective. The sad thing is how rarely fans of the Apple Aesthetic are willing to go read the "Anti-Apple" perspective (Is there such a source? ) And what about the Objective review? Mossberg has been panning Apple quite a bit recently - maybe he's the objective reviewer...
Also, I think it's extremely disingenuous to conflate Gruber's income from his blog with the income Batelle derives from being the founder of Federated Media Publishers. To say that Battelle has an agenda in supporting Google's practice is obvious.