Microsoft sticks to its guns, keeps Do Not Track on by default in IE10
arstechnica.com
arstechnica.com
As IE10 sending DNT isn't a response to a conscious user decision ("I accept the defaults" is not consciously deciding "I don't want to be tracked"), servers are basically free to ignore the header if the browser is IE10.
This also means that IE10 will for all intents and purposes always be tracked regardless of what the setting is set to and whether the server in general honors DNT or not (currently I know of only twitter to do so).
Way to go!
If you ask 100 random people whether they want to be tracked on line by advertisers, are you really going to tell us that 90% will say yes?
The default of "do not track me please" is 100% correct because it represents the consumers' natural setting.
From the article... "the company said that Windows 8 will inform users of the Do Not Track preference during the first run experience."
They even offer the consumer to make the choice for him/herself.
You present a false dichotomy. In the absence of asking consumers what they actually want in regards to tracking (whatever that means), it is impossible to know what their sentiment is. There are three kinds of people: those who are aware of DNT and have opted in, those who are aware of DNT and have opted out, and those who are not aware of the option. Guess which group is the largest.
You could certainly say that advertisers are intentionally playing dumb here, and would like to continue to do so by forcing the opt-in decision for DNT to be buried in layers of settings dialogs rather than having an opt-out decision front-and-center when installing windows.
But that doesn't imply that anyone thinks most people want to be tracked. It just implies that in the absence of intent one way or the other, advertisers will continue to treat consumers as they always have.
It all comes down to intent. Which is why the whole DNT header is a silly idea in the first place. See qntm's comment below: https://news.ycombinator.com/item?id=4355458.
"How, exactly, are they intending to detect the user's explicit consent via the medium of HTTP headers?"
From the original blog post by MS ... "Since then, we have conducted additional consumer research that confirmed strong support for our "consumer-privacy-first" approach to DNT."
Sounds like that's exactly what they did (asked their users).
> Guess which group is the largest.
The group that you explain what DNT is, and then enables it...
> "How, exactly, are they intending to detect the user's explicit consent via the medium of HTTP headers?"
My understanding is that when shipped (Windows 8 or IE 10), on first run the user is prompted to opt-out of, opt-in, or dismiss DNT. DNT is explained, and is given its own huge screen in the first-run process/dialog.
A set DNT header to 1 (don't track) or 0 (do track) signifies an "explicit" choice was made.
A missing DNT header signifies that user has not set, or has dismissed the option.
http://www.w3.org/2011/tracking-protection/drafts/tracking-d...
http://www.w3.org/QA/2012/04/the_state_of_do_not_track.html
http://blogs.technet.com/b/microsoft_on_the_issues/archive/2...
*I'm taking some guesses here with the "dismiss" choice. But I'm pretty sure MS pulls up a screen explaining DNT and gives the opt-in/out-out options to the user.
Then, by shoving it in their face like that, your point is invalid and they comply with the spec because the user has chosen not to be tracked, among other things. Now, they would need to force a user to go through that setup as a requirement to use IE10, but that shouldn't be a big issue for MS.
Can the W3C justify this amendment at all being for the good of the user?
(And, given the context of what the group is trying to do -- build a do-not-track mechanism that advertisers are willing to honor -- I agree that it's obvious.)
Here's the working group: http://www.w3.org/2000/09/dbwg/details?group=49311&publi...
I don't know enough to determine what % of companies represented on the panel are ad-supported; per a comment on the Microsoft blog:
> thank you for not folding to the corrupt w3c standards
> body that is setting the standards with a full deck of ad
> supported companies on the panel
http://blogs.technet.com/b/microsoft_on_the_issues/archive/2...http://www.zdnet.com/microsoft-sticks-to-default-do-not-trac... >Customers will receive prominent notice that their selection of Express Settings turns DNT “on.”
The amendment does not appear to restrict the selection of this option to those who go into settings, click on a privacy tab, and then choose an Advanced settings button, only to have to go through what choosing this means.
Although I assumed what all this meant is when you got to that part of the setup the box will be already checked and you had to click on it to turn it off.
Either way, if an attempt to inform the user of the option has been made before they click an "I Agree" button, then that should be good enough.
But honestly, I don't expect many people to honor the DNT header anyway. What's going to happen if they don't, get a strongly worded letter from somebody?
Suppose John Doe sets up a new browser and wants to make sure the DNT header is being sent.
They're basically saying, "We're sticking up for consumer privacy! Oh, what? Well we don't want that much privacy - here's an amendment to our proposal so that we can still track you..."
I'm at a loss as to how such an amendment could be in the end user's best interest. How can you even detect such a thing as "the user has actively chosen not to be tracked"? Either the header is there and it means "do not track", or the spec is a joke.
It seems like it would be more productive to focus on helping users not disclose their identity than helping them ask sites to pretend they don't see it.
You start with the general consensus that stealing is socially unacceptable, and you make it illegal.
Which is exactly what will inevitably happen with tracking unless tracking with permission becomes the exception rather than the rule.
It might even take a few decades, but being tracked by corporations anywhere you go online is socially untenable in a free society.
Microsoft understands this, although their enthusiasm is probably more inspired by the fact that a certain competitor that has a major part of its business model depending on it than by ethical considerations.
And then, as a sensible person, knowing that there exist people who don't care about laws, and knowing that law enforcement can't catch all criminals, you also use a lock.
I would love to have laws and penalties for lawbreakers here, but this is the internet: it spans many legal jurisdictions. Law is not a panacea, and it's also much harder to get than a software patch.
If Microsoft can look like the good guys while sticking a knife in Google's back, preventing them tracking users and targeting ads, then they might as well go for it.
IE on it's own won't do much damage but other browsers will be under pressure now to also add DNT, after all, they don't want their users to think they're privacy online is safer in IE's hands.
If all browsers slowly make this move Google could be affected quite badly. And that is the logic I think Microsoft is using here.
Which could also be exactly what they wanted: Get the good press for enabling the header by default while ensuring that they and everybody else will be able to track IE10 users normally, regardless of the setting being enabled or not.
It would look a little bad if Google just straight up ignored the DNT header on IE10.
Please, Microsoft is doing this for the same reason its pouring billions in competing with Bing - so it can strangle their competitors revenue streams.
In terms of revenue per impression, revenue/behavioral tends to beat out contextual. After contextual you've got site targeting and run of network, in that order. Google is the only one that does a really good job on contextual, that I've seen.
As of last month IE market share is now down to 16.4% (w3schools.) What IE does won't be so important because soon no one will be using it anyways.
It's a lot easier to pass legislation to make tracking illegal for users who have explicitly opted out, for example, than it is to pass legislation making tracking illegal period.
That is, DNT is a first step with more steps planned, not a complete solution for the tracking problem.
But if Microsoft derails the first step, then the followup steps can't happen, which is somewhat unfortunate.
The Explicit Consent Requirement is nonsensical. But then the DNT header itself is also nonsensical, because there's no legislation or tangible benefit to make request handlers respect it.
Nobody should be tracked unless they've explicitly asked for it.
Ask everyone in the world if they "don't want to be tracked" and 100% will say yes.
Ask everyone in the world if they "don't want to be tracked, understanding that is the economic foundation for almost all of the content they enjoy and thus they will either need to directly pay or go without" and somewhere approaching 0% will say yes.
DNT is like commercial skippers on PVRs -- it's beneficial to most user's experience if a small enough group of users partake, but very detrimental if a large enough group uses it.
Personally I think sites should honor the DNT header by implementing a paywall for such users (really the same holds true for Adblock patrons).
Ad-supported sites have an implicit two-way contract that you get content that you obviously want in return for providing advertiser value. If you don't want to provide advertiser value, partake of micropayments or some other mechanisms. As someone who would make use of those alternate payment mechanisms, I would welcome that.
Both of the wordings you provided are positions. The first contained no context and the second is opinionated.
> Personally I think sites should honor the DNT header by implementing a paywall for such users (really the same holds true for Adblock patrons).
Personally I think tracking should be opt-in (by law) and that websites should have to adjust accordingly (whether that be putting up a pay-wall, finding an alternative revenue stream, making less revenue, or going out of business).
> Ad-supported sites have an implicit two-way contract that you get content that you obviously want in return for providing advertiser value.
Contracts which potentially do harm upon a person should never be implicit. Knowledge of cookies should not be a requirement for internet use. All contracts should be explicit, and agree upon by both parties.
It is a statement of reality. Choices can have consequences, and giving someone a choice with the implied notion that it is all win -- ignoring the very real consequences -- is a profound lie. The sophistry, and intense myopia around this conversation pushes such limits of intellectual dishonesty that I have to wonder what the agendas really are.
Just to be clear, my position is that the world would be a much better world minus all advertisements (television, the web, print, etc). I believe in direct compensation, micropayments, and all of that. But a lot of people think they can have their cake and eat it too, yet they can't.
And just to be clear, the internet existed before tracking was widespread, your predictions on what it will be like without it are speculative.
I don't think internet advertising violates users' privacy to a significant degree. If there was (or when there is) an easy way to price bits of personal information and accept payment for web products via cash or information, most people would give up the information required to keep the site free. Being able to control one's personal information in a manner that makes the side-effects clear is the ideal situation. The IE 10 situation will lead to fewer free products, which isn't a trade-off that most people would consciously make.
No, something approaching 100% of users will still say yes, adding that robust economic foundation is the content providers' problem, not the users'.
The content providers will then close down or find alternative business models.
Who do you think "users" are? HN denizens?
Users -- most especially those using Internet Explorer -- are average people who are entirely unconcerned about tracking cookies. They really aren't. They don't care whether you know that they visit Facebook and TMZ. They care that they can access those sites for free, and anything that threatened that would be a threat to them.
There is a serious detachment from reality that occurs in discussions like this.
Of course, if you ask them, "Do you want to pay for this or do you want it free?", they'll choose free.
But if you don't ask and just charge for it, I don't think most people would mind. It's the way things worked for thousands of years. It's the way things still work for every product in the world except online content. Maybe it's a huge issue for you, but most people just don't mind paying for products and content they find worthwhile.
Maybe it's a huge issue for you
Except that I've made the opposite painfully clear over and over again. But you apparently thought this would work as some sort of position antidote, pretending that I'm some sort of abnormally cheap person?
I am actually aware of the world around me. I watch how things work. I pay attention. My observations are not personal.
Sites and services that charge from the beginning, and/or offer a very clear value added payment option from the beginning are usually successful. Success being defined as self-sufficient without violating user privacy and whoring themselves to advertisers.
Ask people the question straight up: "Do you want more relevant ads, where relevancy is determined by tracking cookies that track what sites you go to on the web." I bet most people say, "Give me the less relevant ads".
Is your analogy perhaps a bit ridiculous?
Tell most people that their PVR is going to report usage data and most would click yes in an instant. Most don't care if some faceless corporation knows how much American Chopper they watch. Many applications (including Apple and Microsoft products) start their journey with a user with the notification that usage data is going to be reported. I am just guessing, but I would wager that 99%+ click okay to that.
In other words, lie to them? Of course some consumers would change their minds.
That is pretty strong hyperbole. Individual tracking is not an essential component of an advertising business model. The print and TV industries both created tremendous economic growth with an advertising model, despite not being able to track individual users. Instead companies developed a wide variety of statistical tools to analyze their markets and advertising ROI.
Doubleclick -- the nefarious agent of evil -- essentially single handedly changed that by building up user profiles by tracking, with which they could individualize ads to a great enough degree that performance was somewhat useful.
What I described isn't hyperbole at all -- the actual industry already went through this.
You are talking about how the advertising industry went from measuring ads statistically, to measuring them by direct action--the click. Before the Internet, the only "ads" that were measured by direct action were coupons, because stores could keep track of redemption transactions. Other than that, it was understood that the value of ads could not be correlated to direct actions by consumers. Sort of like how no single thunderstorm can be directly attributed to global warming.
It's not that online ads perform abysmally. All ads perform abysmally when they are measured by the metric of direct action at the moment of viewing--the Internet was just the first time that could be directly measured on every ad. DoubleClick and others established a competitive advantage by being able to slightly reduce just how abysmal the measurements were. They spent a lot of time and money "educating" brand owners that direct clicks were the "right" way to measure their value.
The unfortunate side effect was that the shift of ad dollars from TV and print to online was greatly slowed. Brand managers look at the super-low online click numbers (even the best numbers from profile-driven networks) and say "what a waste of money, let's keep the bulk in prime time TV." They get numbers from the TV industry that indicate that millions and millions of people saw their ad--and they are not under any illusion that these people are doing anything about it that very moment. TV ads are held to a much lower standard of action, and therefore TV ads attract much higher levels of investment.
Why should online ads be measured by clicks?? The assumption that they should is quite recent (in the context of the full history of advertising), but already deeply held and rarely considered. But it's been incredibly harmful to the efforts to shift industries like TV and newspapers online.
Sure it does. When you're losing you need to differentiate, and Microsoft is choosing the "privacy first" route. It's fairly transparent, but it does get them a lot of press (almost all of the "they're really sticking to their principals" variety. At the same time I can't turn on my xbox without endless banners of ads).
From MS's perspective, that's a win-win.
And from a user's perspective it's a short-term win, long-term loss.
I think that the optimal response to IE and DNT is that every ad-supported site puts up a paywall for IE DNT users. If users associated IE with such a negative web experience, its use would quickly crater into the ground.
Its interesting that google put out chrome to force all browsers to have substantially better performance, thus expediting the migration from local applications to the "cloud". It seems like Microsoft finally decided to use their position to push something else that people care about (privacy) to slow down that migration.
Its a long term loss for users if you believe that the loss of control & privacy is worth what you get for free services on the web. Not everybody does.
That is a great observation. I would also cynically add that Chrome was a response to the growing popularity of AdBlock in Firefox. The reason many were driven to block ads was because it slowed down their browsing (scripts, animated graphics, even the transfer time), so Google kicked up efforts to try to make advertisements less costly in almost every way.
If this header would have only been useful if it was only enabled by a small set of people, then it has always been stupid, and is in no way Microsoft's fault. Imagine a perfect world where everyone using IE organically decided to poke around in their browser settings, find, understand, and enable DNT. Are the trackers now somehow less justified when they ignore it in this perfect world? No, the motivator is the same — they want to track as many people as possible and "disabled by default" is just a thin excuse. People that are defending the idea of trackers ignoring DNT because of IE are engaging in some weird kind of corporatism.
The only way that the DNT header even stood a chance was if it was only enabled by a select few individuals who are greatly concerned with their privacy. By defaulting it to 'on' for users who don't particularly care about their privacy, or understand any of the implications, they essentially guarantee that only a handful of sites will even consider honoring DNT.
Assuming they actually stick with this, DNT has lost all of the little meaning it had to begin with.
Microsoft isn't doing this to protect users against nefarious trackers, it's doing it to hurt Google's bottom line.
However, it doesn't change the fact that by enabling it by default, most other sites will likely end up just ignoring it, even if that isn't Microsoft's intent.
Besides, what happened to Google siding with the user even when their revenue was on the line? Wasn't that their corporate position with China? Or is that only the corporate position when it conveniently aligns with other interests?
This just seems like a no-brainer.
However... this possibly is too broad. "DNT" may not be something you want to do for all sites/tracking-entities, and the 'experience' of the web as a whole (untargeted ads vs targeted ads) may end up being degraded for IE10 users, who may switch to something else and be less annoyed.
ALL of this would be wholly unnecessary if 'cookies' hadn't been (and continued to be) treated as some sort of backroom black-magic that is consistently hidden from users at every turn. A little extra chrome in the browser that displays cookies being set/transmitted, along with an ability to delete/block them - directly from the browser, without having to wade through 'advanced/privacy' menus - would go a long way to giving people easy control and insight in to what's really going on.
Paranoid privacy nuts wouldn't trust it anyway, and would keep using hand-compiled lynx or amaya, but the rest of us would be able to quickly see what's going on and prevent things we weren't sure of.
Realistically the DNT header will do nothing for user privacy.
Just when you think MS is making progress with IE and the web they pull this stunt.
However, this is a good PR move by Microsoft. They don't make too many of them, so congrats.
You can track a user during a single session on a single site.
To track across multiple visits the user must set up an account of some sort.
To track across multiple sites the user must provide some kind of explicit permission.
Anonymize any session records that don't have this kind of permission.
They are trying to break a very reasonable compromise that would have benefited almost everyone. Instead, as one of the largest tech companies that doesn't depend on advertising revenue, they are trying to use their power to cripple competitors. They won't win. Online advertisers are too powerful (and drive too much of the growth in the economy nowadays), legislation won't regulate the industry in a way that will hand Microsoft a victory. Meanwhile, IE's users will lose because their choice to be tracked will be ignored.
I never made an argument that depends on their market position. Either way, I don't think your comparison is apt. Competition isn't always good on its own; it has to increase global value/efficiency to be a valid, "good" strategy. Android increased global value, Microsoft's decision to go rogue on DNT will probably destroy value. Perhaps even their own.
At the end of the day, consumers will know that "Do Not Track" is on, and that big advertising networks are igorning it. They won't know or care about the T's and C's of some agreement.
They'll also know (because Microsoft will tell them) that Bing, Outlook.com, etc will respect DNT.
Only if it benefits them or their users, which it almost certainly won't. Hurting your competitor is not the same thing as competing with them.
Defaulting tracking to off is only reasonable for advertisers.
inb4: "but ads fund free open web" - I can live with paying subscription for every single site I really want to visit (even huge subscriptions if the site is that good). There are very few of those. AND many "free open" sites do not have ads even now.
And by the way, please define "rich" and "rich enough".
The fact that results from these smaller sites show up in google searches (i.e not behind a paywall) is a good thing for the web in general as they often have good content, a few non obtrusive banners at the bottom seems like a small price to pay. If a site just bombards me with aggressive advertising I simply don't go back, these sites rarely have good content anyway.
I think that having access to free high quality information for people of modest means is a big net win for society at large, but maybe I'm just a socialist..
One individual has at most 16 hours a day for internet and if someone would estimate average times that the discrete number of sites to visit would be rather low. It is entirely possible (not 100% sure) that after initial shock communities will restructure a little, some really obscure sites with little unique content or services will die, but users won't leave. they'll just shift to occupy all the sites they really want to visit.
And right now I see that small and obscure websites are NOT findable in search engines. They don't do SEO and SMO, they are totally dominated by ad driven monsters they produce and produce and produce... well something. Sometimes good content sometimes not. Mostly not actually. I almost never find really good unknown stuff in Google&Co, only by direct links from friends and random people. Such sites are like dark matter of the internet, real but invisible knowledge. Invisible behind the noise from ad giants.
Remember the site expertsexchange.com? The Q&A site that put their answers behind a paywall, now remember how stackoverflow ate their lunch with a few small unobtrusive adverts.
I actually do find plenty of useful content on small websites, phpBBs & blogs through google. Sites with unique content tend to rank well especially if you are searching for specific terms.
It should be the default for every individual in a free country, from birth.
The fact that I'm living, breathing human being with a right to privacy should already be enough to imply that no corporation has the right to track my movements with my very explicit, informed and legally verifiable consent.
Browser manufacturers should not even be a party in this.
As a user I don't care about your politics, alliances, bias, or nefarious (to me) goals. I simply am asked when I start using the browser whether it is okay for sites to track me and I choose the "heck no, of course not" option or the "yeah, whatever, go nuts" option. If I accept all defaults including using Bing as my search engine and DNT as being on who are you (evil web developer at mega-corp) to say my choice is invalid?
On the other hand I really don't like it the idea of a website trying to glean my "real" identity and use that to do things which may be anti privacy.
I'm going to brace for Windows 8 release when clients suddenly start asking why their traffic has dropped off a cliff.
This is just messing around with marketing to 'be cool' with their new browser because Chrome is kicking their ass at the moment.
As an aside: Lots of people also seem to have big misunderstandings about browser privacy settings, for example I've spoken with people who believe that the "private browsing" feature in the browser would allow them to browse porn without the IT dept finding out..
From http://www.zdnet.com/microsoft-sticks-to-default-do-not-trac...
>Customers will receive prominent notice that their selection of Express Settings turns DNT “on.” In addition, by using the Customize approach, users will be able to independently turn “on” and “off” a number of settings, including the setting for the DNT signal. A “Learn More” link with detailed information about each recommended setting will help customers decide whether to select Express Settings or Customize. A Privacy Statement link is also available on the screen. Windows 7 customers using IE10 will receive prominent notice that DNT is turned on in their new browser, together with a link providing more information about the setting.