Firefox: Why we won’t enable Do-Not-Track by default
blog.mozilla.org
blog.mozilla.org
(If you really really really care about a user's choice like you say you do then make the user make a choice. On first launch get the user's choice and refuse to work without being told what they'd prefer.)
Edit 1: I read the W3 draft on Do Not Track and seems like there is a section for "Explicit Consent Requirement".[0] Although whether the committee is influenced by corporation in way that the industry is tasked with policing itself is a different topic altogether.
Edit 2: Brain Smith from Mozilla responded with websites ignoring the flag if set by default. That's what Yahoo! did.[1] But that's the problem with any honor-based system.
[0] http://lists.w3.org/Archives/Public/public-tracking/2012Jun/... [1] http://allthingsd.com/20121026/yahoo-dings-do-not-track-defa...
it needs to ask you upon installation. no one will go digging through settings - that makes it practically worthless. "Cause knowledge is power!"
I (a Mozilla employee) can understand why people worry about this, because there does seem to be a conflict of interest here. But, I've never seen anything to indicate that we consider Google's payments to us in any security/privacy decision.
DNT is not the ultimate solution to tracking on its own. It is part of a solution.
Consider this:
Let's say you go buy a box of doughnuts and take it to work, open it, and leave it open on a table next to your desk. Some people will think "Hmm, I want one of those doughnuts but I'm not sure if it is OK to take one, so I won't" and other people will just assume that it is OK to take one. (Why else would there be an open box of doughnuts? And/or isn't it better to ask forgiveness than permission?)
Let's say you write "Do NOT take these doughnuts! They are mine!" on the box with a big fat marker. If somebody were to take a doughnut, they would be clearly in the wrong in that situation, according to any kind of mainstream social convention.
Lots of people will say that it is wrong to take a doughnut without explicit permission. But, many, many people see the situation as being open to interpretation.
Now, let's say the doughnut shop pre-printed "Do NOT take these doughnuts! They are mine!" on every box. You might argue that that is the same thing as the hand-written sign. But, I would bet that the pre-printed message would get drowned out as people would normally share doughnuts out of these pre-printed boxes: "Just ignore the box, they all say that; it doesn't mean anything." The pre-printed message becomes less and less meaningful, even though the words are clear, unambiguous, and explicit. And, worse, you may be discouraged from writing your handwritten ""Do NOT take these doughnuts! They are mine!" message on the box because, well, the box already says that. Effectively, that message pre-printed on the box is harmful, as its meaning is in the eye of the beholder--just like the open box sitting on the table with no message written on it at all.
Do you see how that could possibly be problematic? This is the problem that Sid and others at Mozilla are trying to solve. "DNT: 1" means it is clearly wrong to track this user because they've gone through special effort to tell you they don't want to be tracked.
It has nothing to do with Google's money.
I agree with the default being ON (that is, DNT is turned on). The analogy with the doughnuts and pre-printed message isn't quite accurate in this case, because it is _clearly_ a better choice to not have tracking done on the user, whilst with a box of donuts, its not always clear cut whether sharing it or not is the right thing to do.
There may some validity to the idea that "the journey is part of the gift"--that is, the harder the option is to find, the stronger the signal of user intent. But, I don't think the current balance in Firefox is correct. I'm not sure that a checkbox at startup is the right answer either. if you ask on Mozilla's dev-privacy mailing list [1], you might get a response from some somebody that has thought about it more than me. Then I'll get to learn about it too.
Consider a world where your box of donuts WILL have donuts taken out of it, even if the box is closed, as soon as you walk away from the donut shop. As soon as you hit just about any website on the internet today, YOU WILL BE TRACKED. There's no maybe here, it's a virtual certainty. So this makes it accurate in your analogy.
In this world (call it Doughnet?), it makes sense to have the donut shop print a sign on the box in the event that the sign is sufficient to prevent people from ambushing you and taking your donuts. You could simply ask the donut shop to give you a blank box if you wish to have your donuts taken (opt-in donut sharing) rather than asking them to give you a box with the sign (opt-out donut sharing).
Nobody expects to have their privacy maliciously and constantly invaded. This is emphatically WRONG behavior. And so broadcasting to all parties that the user of your browser is willing to be tracked by default is precisely the wrong thing to do. I don't care what your motivations are, it's just wrong, period.
Nobody is disagreeing with either of those two statements. Like I said, DNT isn't Mozilla's final or only answer to the tracking problem.
> And so broadcasting to all parties that the user of your browser is willing to be tracked by default is precisely the wrong thing to do.
No browser does such a thing. Anybody that infers that the lack of a "DNT: 1" header implies that it is OK to track the user is using faulty logic. See http://en.wikipedia.org/wiki/Argument_from_ignorance#Absence....
Back to my analogy: I never said it was OK to take a doughnut without explicit permission. I just said it was obviously bad to take one when there is an explicit message saying it is bad to take one.
To the end user, the idea of being tracked sounds like being followed around by some stalker, and is about as enticing as having your home robbed. People, in general, don't understand either the bad (the extent to which web sites can build a deep profile on you) or the good (how much of the web that everyone loves is financed through targeted advertising). As such, how things are presented is tremendously important.
Imagine if it was called "Disable Ad Personalisation", or even, "Do Not Tip" where the notion of denying monetization to the web sites you use (which is what Do Not Track will do) is invoked. It would have a very different response, I think.
As for Mozilla and this letter, Do Not Track isn't legislated. Basically, it's a way for you to tell websites that you don't want to be tracked, but they have no obligation to follow your wishes. Some advertisers [citation needed] have indicated that they will follow Do Not Track if it's an opt-in system. A cursory search shows that Yahoo ignores the setting from IE10 because Microsoft made it a default (http://www.theregister.co.uk/2012/10/26/yahoo_to_ignore_ie10...). As the article notes, the W3C says that Do Not Track should be opt-in.
So, on the one hand, advertisers seem to be saying "if Do Not Track is a default setting, it isn't a user choice and we'll ignore it." If Mozilla makes it a default, it doesn't help anyone. However, I think browser makers could call their bluff by making it a very apparent option when starting the web browser.
I think Do Not Track should be the norm. However, it isn't. The norm is tracking. Once a norm has been established, it's hard to replace it with a new norm. Cigarettes would never get approved for sale if they were invented/discovered today. If subways were a new invention, it seems like they would be built with walls preventing people from being pushed onto the tracks. But norms were established and it's hard to move away from them.
In this case, I think there's an easy solution: explicitly asking on first launch. Browsers already ask to be the default, some try to tell you about rights, some ask you about search engines, etc. Just add Do Not Track to that process. Then we explicitly have a user opinion on the matter.
Microsoft did right(for once) with making DNT default on IE. It exposes the DNT idea for what it is: Snake oil.
6.2. User Interface RECOMMENDED
A user agent that implements Do Not Track SHOULD provide a user interface
for modifying preferences. The user interface design is left to the
user agent.
6.3. Default
A user agent MAY adopt NO-EXPRESSED-PREFERENCE or OPT-OUT by default.
It MUST NOT transmit OPT-IN without explicit user consent.
Countries that have opt-in default on organ donations have at most around 30% of consent.
Those that have opt-out have above 90% consent.
http://blogs.lse.ac.uk/politicsandpolicy/archives/11953
Basically Mozilla is saying: "It your decision to not be tracked." and thinking "But we think you should allow everyone to track you if you don't mind that much."
On another note, cookies are domain specific, which means that a cookie can't be accessed by another domain.
Opt-out from privacy invasion is not sufficient. In Europe at least, it is politically and socially unacceptable that people have to opt-out. So as long as the industry comes up with half-assed protocols and self-regulation that is based on the assumption "we have the right to violate your privacy unless you stop us" instead of the other way around, this will continue to trigger ever stronger anti-tracking legislation.
And please don't think that the faltering so-called "cookie-law" will be the end of it. That was just the softest option, and just like with early anti-spam laws the industry chose to sabotage it instead of trying to make it work. I wouldn't be surprised if this ended with a full blown ban on any form of cross-site tracking.
Of course "do not stalk" should be the default. The whole notion that having your privacy violated by the marketing industry is somehow about individual choice is bullshit. It's as idiotic as "do not film me in the privacy of my own home" being opt-out and we're all Big Brother contestants by default.
Mozilla is claiming they do not want to enforce a preference for the user, and instead would like the user to make the choice. But Mozilla has previously enforced their preference for a number of different features:
* Mozilla has disabled java plugins and silverlight in the past to protect their users (from security vulnerabilities).
* Mozilla has enforced their preference for blocked popup windows in the past to protect their users (from annoying content).
* Mozilla has enforced their preference for the handeling of cookies to protect their users (from privacy violations). https://blog.mozilla.org/privacy/2013/02/25/firefox-getting-...
Why not disable tracking features to protect your users (from privacy violations)?
Their explanation does not make sense.
The only way for a "Do Not Track" feature to be on by default is if it legally or technically prevents ad networks from tracking, otherwise it'll be ignored (see IE).
if they had both introduced the feature AND made it default, since following the hint is voluntary from the advertisement providers (ie server side decides to honor it or not), well, NONE would have followed it.
The situation with 3rd party cookies is different, because it's up to the client, not to the server side.
So, this has little to do with the Google search engine deal, in fact.
I don't buy that. They are making a choice either way, whether they enable or disable it by default. Just like they are making a choice about the hundreds of other options Firefox has. A few examples of how Mozilla thinks:
> JavaScript enabled by default. Why? Developers and designers can do some really awesome websites with it and we want users to have that experience.
> SSL enabled by default. Why? It improves your security.
> Do Not Track disabled by default. Why? Because we don't want to fuck with the people who are paying us (i.e. Google).
The idea was that, given a significant enough amount of people turning it on, advertisers would take notice of it and react accordingly. If it's on by default it is meaningless.
It's a tool that enable users to send a message to advertisers that they are not okay with their practices. It was designed this way. It says you are okay with ads but not with the tracking.
> There are no incentives to do so, and no punishment or repercussions if they don't.
Except for adblock. If the only option to avoid tracking is to block ads, then that is what will be used.
Therefore, browsers should come, by default, with an adblock feature (or simply, just bundle the adblock plugin). This DNT business is purely just lip service.
DNT = Math.random()> p ? on : off
That's just as true of leaving it turned off by default. What sort of idiots do you take us for?