4 - Expanding the Laws

Bringing back Do Not Track is all about creating this opportunity. We seem to agree it would be better for Do Not Track to become legally stronger. I believe we will have the greatest chance that this will happen if Mozilla brings back Do Not Track. I believe it is also important to increase the user adoption percentage of enabling Do Not Track signals partially to increase legal pressure by providing legislators with a meaningful statistic.

Regarding this point: “Only when a consensus is being reached should Mozilla and browsers prepare to support the enforced feature.” We already have legal consensus of website operators who serve California users being legally required to describe a stance on Do Not Track.

Note that the original posting describes how it was only after major web browsers offered the Do Not Track feature, a law was created requiring website operators to take a stance on Do Not Track. After a technology is implemented, we get laws to refine it. Laws are unlikely to begin with a detailed technical specification and so I ask you to change your expected order to the technology firms first putting an implementation in place and then laws coming afterward to refine the implementation.

I understand how the length of time for laws to get applied may be frustrating. We have already seen some progress on Do Not Track and the German legal case less than 2 years ago shows recent progress. But if we want to see further legal progress, we really need to bring back Do Not Track in Mozilla’s user interface.

Please demonstrate your support for Do Not Track.

First, I really appreciate you taking the time to share your thoughts and rationale. It is great to have informed debate. Let’s try to address your points.

1 - Fingerprinting

As our first consideration, data shows that if you are concerned about fingerprinting, you should enable Do Not Track signals, as has already been explained, to blend in with the majority of others who can block fingerprinting JavaScript and who have enabled Do Not Track signals. Users who do not block fingerprinting JavaScript can be uniquely fingerprinted regardless of the Do Not Track preference and are encouraged to enable Do Not Track to benefit from the websites which obey it, such as some medical websites.

Regarding this point: “It still is however a data point often masked to follow the herd in order to minimize fingerprinting in territories where user privacy isn’t enforced by law.” I think your point better applies to Global Privacy Control, since it is Global Privacy Control which is being interpreted by some implementing companies as only applying to territories in which users live, while Do Not Track appears to be consistently described in privacy policies and listed in code snippets as applying to users worldwide, meaning that a user’s territory is not relevant in the effectiveness or ineffectiveness of Do Not Track.

Data has not convinced you so let’s take a logical approach to look at the situation a little differently, calling it our second consideration. When we consider the scenario of websites aggressively attempting to fingerprint us, there are two cases: when we cannot block JavaScript and when we can block JavaScript.

Case a) If we are unable to block a website’s fingerpriting JavaScript, an HTTP header attribute value (such as Do Not Track) need no longer be a relevant concern. I encourage you to visit https://amiunique.org/fingerprint or other websites like it.

For example, under the JavaScript Attributes section, the Audio Data value gives me a Similarity Ratio of 0%. With only one JavaScript Attribute, it may be possible to uniquely identify me from my Audio Data if a website (or a set of websites with the same fingerprinting service provider) uses fingerprinting techniques.

There are a number of JavaScript Attributes which are difficult or time consuming for a user to modify, such as Audio Data, and a combination of these values can probably be used to create a unique fingerprint about a user.

What is important to understand in our discussion is that it may not make sense to have every measureable value contribute to a fingerprint analysis. If you resize your web browser’s window and the Screen Width JavaScript Attribute changes, should you be assigned a new fingerprint and should the fingerprinting website blindly not recognize you as being the same user? We might conclude that it may not be effective for fingerprinting code to incorporate into the fingerprint a value which is easy for a user to change.

Case b) If we are able to block the fingerprinting JavaScript, there are less HTTP Header Attribute values compared to JavaScript Attribute values. Some of these HTTP Header Attribute values include: User Agent, Accept, Content Encoding, Content Language, Upgrade Insecure Requests, Do Not Track, and Global Privacy Control.

Suppose we found a website with naive fingerprinting code which relies on a Do Not Track value when generating a fingerprint. We can visit the website with a Do Not Track signal enabled. The next day, we can take off our sunglasses (disable Do Not Track signals), visit the same website, and the website will not be able to recognize us! The about:config method makes it very easy to switch to another window and toggle a button, which is similar effort to resizing a web browser window.

A question to ask ourselves is if we think a website fingerprinting technique would be that poorly coded. If we do not think this will be the case, then is it reasonable to say it is unlikely for Do Not Track signals to be consistently used in generating a fingerprint because it is easy for a user to toggle the preference?

A third consideration is how the benefit of fingerprinting for many website operators may be solely to serve targeted advertisements using JavaScript. Such a website operator may not want to waste time trying to fingerprint users based on HTTP attribute values since a user who disabled fingerprinting JavaScript probably also disabled advertisement JavaScript.

If you remain unconvinced about fingerprinting, please let me know and we can explore the fingerprinting topic further.

When it comes to a website which obeys Do Not Track signals, there are implementations which will prevent connections to analytics JavaScript, which is very likely to be the source of fingerprinting code. For websites which disable fingerprinting JavaScript because we have enabled Do Not Track signals, enabling the signals benefits us against fingerprinting!

In this scenario, it is important to note that Global Privacy Control will not save us because the analytics and fingerprinting JavaScript will not be blocked! With Global Privacy Control signals enabled but with Do Not Track signals disabled, the same website and its third party analytics will fingerprint us!

2 - Law

I will repeat some points from the original posting and also add additional information.

By law, any website which plans to serve customers living in California must declare a public position regarding Do Not Track signals. Multiple tools exist to generate privacy policies and it has become standard to include this declaration in privacy policies for websites even for regional websites which may never get a visitor from California. This fact allows us to have a very quick way to consistently evaluate a website’s practices. If you are a person who does not like reading privacy policies (maybe many people feel this way), please take a moment to understand how incredibly powerful a role this standard of requiring websites to declare a Do Not Track stance can perform in allowing you to evaluate a website’s expected practices with just a web search.

By law, companies operating in Germany are required to obey Do Not Track signals. It is expected other European businesses will have to do the same in the future but maybe only if we bring back Do Not Track and keep it around long enough for corresponding legal cases to solidify the law.

https://wideangle.co/blog/do-not-track-gdpr-opt-out “And in fact, Article 21 (5) of the GDPR states that a person “may exercise his or her right to object by automated means using technical specifications”. Doesn’t this include DNT signals?”

“According to Hense, this part of the law was “basically invented” or “lobbied into” the GDPR “to help DNT signals become a standard.””

You also raised an important point about writing fake information in a privacy policy. Privacy policies represent one of the main sources of commitments a website legally needs to follow in its relationship with you. Many companies are unlikely to lie because companies can and do get sued when a privacy policy does not match with the truth.

https://inspiredelearning.com/blog/a-brief-history-of-the-gdpr/ “Ireland’s DPA fined WhatsApp €225 million for not being transparent about how they use their users’ data in their privacy policy.”

California law explicitly requires truthful statements for Do Not Track declarations.

https://www.loeb.com/en/insights/publications/2013/10/california-enacts-law-requiring-do-not-track-dis__ “The bill was signed into law Sept. 27, 2013 and applies to any operator of commercial websites or online services that collects personally identifiable information about a California resident, whether the operator is physically based in California or not.”

https://www.foster.com/duff-on-hospitality-law/california-adds-do-not-track-disclosure-requirement-to-the-california-online-privacy-protection-act “Operators are in violation of CalOPPA if they knowingly and willfully, or negligently and materially fail to comply with either the law or the operator’s own privacy policy.”

https://termageddon.com/do-not-track-caloppa/ “Operators should be cautious to follow the promises they make in their Privacy Policy. If an operator claims to respect these signals but really ignores the requests, they are violating CalOPPA. Further, the FTC considers misrepresentations in a Privacy Policy to be a deceptive practice, so an operator could face an FTC investigation for misleading consumers.”

3 - Listed Websites

Because lemmy.world seems to use mostly English, I performed the web searches in English. I believe most of the links are for websites in the US.

This list is not exhaustive. I ran out of space in the Lemmy comment and stopped collecting websites. The list is intended to demonstrate it is more than “just 1 popular website in Germany” which decided to obey Do Not Track signals.

Some of these websites are regional, such as a medical office or restaurant. It is nice to know you can get life basics such as medical treatment and food without targeted advertisements.

Regarding this point: “There is just about zero reason I think nicely asking website admins to monitor and add support for DNT.” Maybe your dental office has a website. It seems reasonable to ask your dental office to make changes to the website to obey Do Not Track signals. There is a supported real life business and this business wants to please its real life customers. Many analytics tools make it very easy. The code snippets linked in b) also make it easy for other analytics tools. You may give 300 families local to where you live a nicer experience and you might make your dental office gain more business from customer appreciation, which is likely to exceed any potential monetary compensation from targeted advertisements.

My understanding of some points:

For California residents, perhaps only when you browse a website from an IP address in California, a website which obeys Global Privacy Control signals can opt you out of sharing and selling your data after it is collected but it will not opt you out of data being collected by the website and the website’s third party analytics services. Colorado and Connecticut residents also have some legal protection using Global Privacy Control but the legislation is different and a website may react differently. The video was made in California and details about other locations were not fully discussed. Some states such as Virginia have corresponding legislation but do not appear to enforce the use of Global Privacy Control by website operators. Floria appears to primarily target big tech. Utah, Texas, Montana, Tennessee, Oregon, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Nebraska, New Hampshire, New Jersey, and Rhode Island have also enacted some form of privacy legislation with different degrees of applicability.

Global Privacy Control will apparently not apply to users in regions without corresponding regulation, at least for the example website in the video. In contrast, Do Not Track appears to apply to users everywhere when a website claims to obey Do Not Track signals. The act of claiming to obey Do Not Track signals makes that claim legally binding.

Global Privacy Control allows for third party analytics tools to still collect data about you. In the process of collecting data about you, a website may use a Global Privacy Control signal as a reason to ask you to disable Global Privacy Control protection for this website. Do Not Track does not appear to have this drawback, at least for Do Not Track implementations which follow the code snippets in b) which prevent third party analytics connections.

“Technical identifiers” is a very scary term and if you see it, it can mean many terrible things. According to the video, “technical identifiers” can include: your IP address, your cookie IDs, browser local storage identifiers, mobile device identifiers such as the Android advertising ID or the Apple identifier for advertising platforms, operating system based identifiers such as those offered on smart or connected TVs or media streaming devices, partner supplied technical identifiers, encrypted or one-way cryptographic hashes of personal information such as email addresses and phone numbers, account identifiers, derivatives or escalated versions of these identifiers, operating system or browser versions, cohort audience, and more. “In other words, everything. Trying to find some way to track you, hook onto you, see where you went, what you’re thinking, what you like, what you’re doing. We want it all.”

“There is no US federal law requiring companies to respect GPC. Also the GDPR interpretation of GPC sadly seems a little weak.”

“There are still too many regions that have no privacy regulations and the various regulations that do exist need to be harmonized with one another on what GPC really means. For example does the request apply only to further data collection or should it apply to data already collected? Does it apply to the user or just the device that set the GPC flag?”

In summary:

Global Privacy Control is not a replacement for Do Not Track. Do Not Track may offer stronger consumer protection. Global Privacy Control may be implemented by many US websites which choose not obey Do Not Track, offering arguably weak protection in place of no protection. Do Not Track has the potential to provide strong protection for European websites and for any website which volunteers to obey Do Not Track signals. Some US state laws recognize a universal opt-out mechanism, which can include Do Not Track or Global Privacy Control. The two settings deserve to coexist.

You could certainly put in some time to review various search engines against a set of criteria. Since we are in the Privacy forum, I would think you could consider looking at privacy aspects.

For example, the following website does some simple evaluation by listing their criteria. But their list of reviewed search engines is far from complete. https://privacy-checkup.info/en/recommendations/search-engines One nice touch is they listed when a search engine is hosted on Big Tech services, meaning that Big Tech will still be watching what you do.

A good website to see what servers are being used by a website can be found at the following link, giving you a useful criterion to start with. https://hosting-checker.net/

You could also use a tool to see if third party JavaScript connections get made when visiting a website, which might indicate additional tracking is being done. One possible way is to install https://ublockorigin.com/ and use the “I am an Advanced user” option. Listing these third party JavaScript connections could be your second criteria.

If you are willing to put in the time, I think it would be a useful and unique contribution to the Internet to evaluate a lot of search engines for their privacy aspects.

Can you elaborate on what software or solution would allow someone to host an encrypted email server? Would outgoing messages be encrypted or just encrypted at rest? What about if you also had your family member on the same setup and you wrote to each other, would it be encrypted?

https://seirdy.one/posts/2021/03/10/search-engines-with-own-indexes/

That link mentions every search engine which is already on your list plus a whole lot more search engines. That link’s list is regularly maintained. It may be one of the most comprehensive lists which you will be able to find.

I would like to raise two somewhat related reasons for keeping Do Not Track which I have not yet seen discussed.

Reason 1: The analytics industry has made it easy for webmasters to make an explicit choice.

More than 15 analytics tools support the ability to obey Do Not Track signals as a setting for webmasters. Instead of leaving it up to webmasters to code a solution, the analytics industry has stepped up and has made it easy for a webmaster to make an explicit choice. A webmaster can migrate from one analytics tool to another tool while still being able to easily apply the same choice.

Reason 2: A significant number of websites have added text in their privacy policies indicating an explicit choice regarding Do Not Track signals.

Privacy policies are difficult to read and interpret. There are not many standards for privacy policies, making them typically very hard to compare against each other.

If we put our creative minds to the task, we might see that Do Not Track offers us a solution by providing a reasonably consistent way to QUICKLY EVALUATE a company’s explicitly chosen practice by looking at only a small portion of a privacy policy.

We can either spend the time to open up a privacy policy and search for the Do Not Track section or we can perform a web search with the website’s name and the “Do Not Track” text.

It is not important whether we actually set the Do Not Track setting in our web browser! What is important is that the setting actually exists in our web browser as a potential choice. By keeping that setting available as a choice for users, some webmasters may continue to feel compelled to describe the explicit choice made for their websites, and we gain the ability to quickly understand the INTENTIONS of a given website. Do Not Track grants us the ability to be able to SAVE TIME by having a common way to evaluate multiple websites.

Here is a list of analytics services which offer a setting to enable or disable the obeying of Do Not Track signals.

https://experienceleague.adobe.com/en/docs/marketo/using/product-docs/web-personalization/getting-started/setting-web-personalization-to-do-not-track “In Web Personalization and Predictive Content, a marketer can set a toggle to indicate whether to support or ignore the browser’s Do Not Track (DNT) setting.” “When the toggle is set to On, Web Personalization will honor and support the browser’s Do Not Track (DNT) setting, and will not track any web activity or run any campaigns or content recommendations on your website.”

https://saschaeggi.medium.com/setup-matomo-analytics-with-drupal-and-respect-do-not-track-header-gdpr-compliant-d382b12e2740 “Matomo already provides you a setting to respect users with a ‘Do Not Track’ (DNT) header set.”

https://docs.simpleanalytics.com/dnt “By default the data will not include visitors with the Do Not Track enabled. To also record DNT visitors you can add data-collect-dnt=‘true’ to the script tag” “If you don’t add the data-collect-dnt attribute we will not record visits from users who have DNT enabled.”

https://developer.bitmovin.com/playback/docs/do-not-track-cookie-handling-in-analytics “By default Bitmovin Analytics will honor this user preference and ignore all incoming requests that have the DNT header set to 1.”

https://www.hotjar.com/policies/do-not-track/ “Before collecting your data, Hotjar always checks to see if you have enabled the ‘Do Not Track’ setting in your browser.”

https://wp-statistics.com/resources/do-not-track/ “The DNT-respecting functionality is active by default, aligning with our privacy-first philosophy.”

https://help.mouseflow.com/en/articles/4325367-the-privacy-settings “Honor Do-Not-Track” “This setting allows you to honor the Do-Not-Track (DNT) signal. When enabled, Mouseflow will listen for the signal and if it is found, prevent the user session from being recorded.”

https://jetpack.com/support/jetpack-stats/jetpack-stats-honor-do-not-track-dnt/ “As a site owner, you can force the Jetpack Stats feature to honor any visitors with DNT enabled and not track their activity”

https://wideangle.co/documentation/data-do-not-track-handling “Wide Angle Analytics proudly handles the Do Not Track irrespective of broader adoption. Doing so allows your visitors to indicate their Opt-Out of the tracking process.”

https://docs.metrical.xyz/privacy/what-we-track “Metrical will honour the Do not Track setting and we don’t send the visit when we find the do not track flag enabled.”

https://umami.is/docs/v1/tracker-configuration “You can configure Umami to respect the visitor’s Do Not Track setting.”

https://wpcrux.com/blog/how-to-make-google-analytics-respond-to-do-not “To make Google Analytics respond to ‘do not track,’ you can enable the ‘Respect Do Not Track’ option in the settings of your Google Analytics account.”

https://documentation.freshpaint.io/integrations/destinations/apps/mixpanel/mixpanel-reference “Ignore DNT” setting “When enabled, Mixpanel will track all events, regardless of if the browser has ‘Do Not Track’ enabled.”

https://websmithiananalytics.ca/help/dnt “Yes, we honor the Do Not Track (DNT) setting from browsers that support it.”

https://github.com/milesmcc/shynet “By default, Shynet will not collect any data from users who specify DNT.”

https://baseanalytics.io/do-not-track-dnt/ “We do honor the Do Not Track (DNT) setting from browsers which support this.”