Kashmir Hill* says although millions of people use the ‘Do Not Track’ privacy tool on their web browsers, it’s not doing anything because most sites ignore it.
Photo: Lloyd Freeman
When you go into the privacy settings on your browser, there’s a little option there to turn on the “Do Not Track” function, which will send an invisible request on your behalf to all the websites you visit telling them not to track you.
A reasonable person might think that enabling it will stop a porn site from keeping track of what you watch or Facebook from collecting the addresses of all the places you visit on the internet.
We’ve got bad news for those millions of privacy-minded people who do this, though: “Do Not Track” is like spray-on sunscreen, a product that makes you feel safe while doing little to actually protect you.
“Do Not Track,” as it was first imagined a decade ago by consumer advocates, was going to be a “Do Not Call” list for the internet, helping to free people from annoying targeted ads and creepy data collection.
But only a handful of sites respect the request, the most prominent of which are Pinterest and Medium.
The vast majority of sites ignore it.
Yahoo and Twitter initially said they would respect it, only to later abandon it.
The most popular sites on the internet, from Google and Facebook to PornHub and xHamster, never honoured it in the first place.
From the department of irony, Google’s Chrome browser offers users the ability to turn off tracking, but Google itself doesn’t honour the request.
“It is, in many respects, a failed experiment,” said Jonathan Mayer, an assistant computer science professor at Princeton University.
“There’s a question of whether it’s time to declare failure, move on, and withdraw the feature from web browsers.”
That’s a big deal coming from Mayer: he spent four years of his life helping to bring Do Not Track into existence.
Why do we have this meaningless option in browsers?
The main reason DNT, as insiders call it, became a useless tool is that the US Government refused to step in and give it any kind of legal authority.
If a telemarketer violates the Do Not Call list, they can be fined.
There is no penalty for ignoring Do Not Track.
The “stakeholders” involved in the DNT standard-setting process couldn’t come to an agreement about what a website should do in response to the request.
“Do Not Track could have succeeded only if there had been some incentive for the ad tech industry to reach a consensus with privacy advocates and other stakeholders,” said Arvind Narayan, a Professor at Princeton University.
“Around 2011, the threat of federal legislation brought them to the negotiating table.”
“But gradually, that threat disappeared.”
“The prolonged negotiations, in fact, proved useful to the industry to create the illusion of a voluntary self-regulatory process, seemingly pre-empting the need for regulation.”
The biggest obstacle was advertisers who didn’t want to give up delicious data and revenue streams; they insisted that DNT would “kill online growth” and stymied the process.
By the time the debate was winding down at the end of 2013, it wasn’t even about not tracking people, just not targeting them, meaning trackers could still collect the data but couldn’t use it to show people intrusive ads based on what they’d collected.
The inability to reach a compromise on what DNT should be led sites like Reddit to declare “there is no accepted standard for how a website should respond to [the DNT] signal, [so] we do not take any action in response to this signal.”
Google, Microsoft, Apple, Mozilla, and others started offering the “Do Not Track” option in their respective browsers, but absent a consensus around the actions required in response to the DNT:1 signal, these browsers are just screaming for privacy into a void.
“It’s really sad that companies are not listening to their users and put weak and misleading pretexts to not respect their choice of privacy,” said Andrés Arrieta, tech projects manager at the Electronic Frontier Foundation, who attempted in 2017 to breathe life back into DNT by establishing a new standard for what websites should do when someone sends the DNT:1 signal.
(Everyone ignored it.)
“It would have been better for the web if DNT had worked,” said Mayer.
It was the polite option: users could signal their preferences and websites would honour those preferences.
“The alternative is the non-polite option of ad-blocking and cookie blocking, which is the way the conversation is now moving,” said Mayer.
Every year, more people turn on adblockers, much to websites’ chagrin, causing publishers to institute paywalls and use pop-up requests to beg people to turn the blockers off.
Meanwhile, tracking is becoming even more intrusive and spilling over into the real world, with phones emitting ultrasonic sounds and Google tracking Android users’ locations despite their stated preferences.
By not giving people a real choice about whether they are willing to be tracked, the internet remains locked in an arms race over privacy, with new methods constantly being created to try to subvert the desires of the party on the other side of the data divide.
Many of the technologists and privacy advocates who pushed for the DNT option admit that the setting could give users a false expectation of privacy, but they remain stubbornly attached to it.
“The flag gives websites a strong signal of the demand for privacy from their users,” said Narayan.
Some think DNT shouldn’t be abandoned because of the hope that it might one day be empowered to actually do something.
Gabe Weinberg, the founder of the private search engine DuckDuckGo, which doesn’t track any of its users, may have framed it best.
He thinks unless DNT is given “some real regulatory teeth”, the option “should be removed from all browsers because it is otherwise misleading, giving people a false sense of security.”
Until that happens, please know that if you turn on “Do Not Track,” it’s not doing anything to protect you unless you’re surfing Pinterest or reading Medium while logged out.
It’s one thing to tell someone you want to be left alone, and another to get them to care.
* Kashmir Hill is a journalist at Gizmodo Media. She tweets at @kashhill.
This article first appeared at www.gizmodo.com.au.
