https://blog.mozilla.org/en/mozilla/advertisers-and-publishers-adopt-and-implement-do-not-track/ Mozilla introduced the Do Not Track feature in January 2011 and other major web browsers soon did the same. With the Do Not Track preference enabled, when a user attempts to connect to a website, a Do Not Track signal is sent as a part of the header which is sent during the connection attempt. A website which obeys Do Not Track requests is able to act on the user's choice before loading a webpage.
A website which obeys a Do Not Track signal value of "true" can use this setting positively in multiple ways.
a) https://lemmy.world/post/22974927 More than 15 analytics tools can be conveniently configured by a website operator to obey Do Not Track signals.
b) https://filippovicentini.com/notes/2019-04-22/ https://medium.com/@fixitblog/solved-how-to-make-google-analytics-respond-to-quot-do-not-track-quot-7f9785385371 Multiple websites explain how a website operator can obey Do Not Track signals, such as when an analytics tool does not have that option. These methods can be used to prevent connections to third party tracking services.
c) At least one "cookies consent" tool obeys a Do Not Track signal by silently disabling tracking cookies without the need for user interaction with potentially annoying cookie popups.
https://www.cookieyes.com/blog/respecting-browser-do-not-track-setting-cookieyes/
"If you install CookieYes banners on your website, it will respect the active DNT of the users’ browsers and avoid placing any tracking cookies"
d) Do Not Track signals have also been legally defended as a compatible mechanism of the General Data Privacy Regulation (GDPR) for a user to indicate a preference to not be tracked, in a court case in Germany. Do Not Track signals are expected to legally apply to other countries and other scenarios involving GDPR, but court cases would likely have to happen first.
https://wideangle.co/blog/do-not-track-gdpr-opt-out
"A recent German court case against LinkedIn suggest that websites that track their users should recognise DNT signals or risk violating the General Data Protection Regulation (GDPR)."
"'The court stated the obvious and even quoted a bunch of legal commentaries on it,' Hense said. 'They all agreed with DNT being a valid signal.'"
In the German court case, Microsoft's LinkedIn could attempt to overturn this verdict on appeal if first Mozilla permanently removes the Do Not Track setting from Firefox's user interface and if Chromium then, in turn, removes the Do Not Track setting with partial reasoning being because Mozilla, the original champion of the setting, also removed it. Microsoft could then ask to have the verdict dismissed on appeal because a majority of web browsers might no longer have a Do Not Track setting in the user interfaces, and such an appeal result could be a terrible blow to privacy, as well as a blow to the possibility of conveniently obtaining private web browsing on potentially many more websites in the future.
There have been some arguments raised which call for the removal of the Do Not Track setting. Let's explore these arguments and see if they are strong enough to justify removing the Do Not Track setting.
These arguments include:
1 - Global Privacy Control (GPC) is legally supported in some jurisdictions and thus can replace Do Not Track.
2 - Global Privacy Control can replace Do Not Track in terms of functionality.
3 - Hardly anyone enables the Do Not Track setting and thus a user may stick out in terms of fingerprinting.
https://connect.mozilla.org/t5/ideas/keep-the-quot-do-not-track-quot-option/idi-p/81951 "even with our past education campaigns around DNT... users did not care to enable it."
4 - Hardly any of the websites which a user visits obey Do Not Track signals.
https://connect.mozilla.org/t5/ideas/keep-the-quot-do-not-track-quot-option/idi-p/81951 "it no longer made sense to offer a signal that is consistently ignored by the vast majority of site operators while also being a potential fingerprinting vector itself due to how unique it is because of its low adoption."
5 - It gives users a false sense of security.
Counter-arguments include:
1 - Global Privacy Control is legally enforceable in some states in a country. Do Not Track is legally enforceable in a country and is expected to be legally enforceable in most European countries if corresponding legal cases get presented.
https://wideangle.co/blog/do-not-track-gdpr-opt-out "For now, the judgment only applies to companies operating in Germany. However, the relevant parts of the GDPR are the same in every other country that has implemented the law."
It seems reasonable for both settings to exist in the user interface since each setting is supported by law.
2 - Global Privacy Control is akin to Do Not Track's weaker sibling and thus is not a valid replacement for Do Not Track. Suppose we discuss the scenario where a website obeys both Global Privacy Control signals and Do Not Track signals.
For Do Not Track, a website operator can either enable a setting in multiple analytics tools or can follow multiple websites which list a code snippet to check for Do Not Track signals. With most of these implementations, tracking data will not be sent to a third party analytics service.
For Global Privacy Control, the approach is to still send the tracking data to the third party analytics service!
https://www.techpowerup.com/329753/firefox-ditches-do-not-track-feature-in-version-135-in-favor-of-global-privacy-control "one criticism of the new reliance on Global Privacy Control is that GPC doesn't block Google Analytics tracking requests"
When Do Not Track signals are obeyed, privacy policies appear to indicate that this feature applies to the general Internet population. At least one company with users around the world has decided to interpret Global Privacy Control as only needing to apply to users in some jurisdictions.
https://www.atlassian.com/legal/privacy-policy "our websites do respond to the Global Privacy Control (“GPC”) to opt-out of “sales” of personal information and targeted advertising in certain locales."
3 - The Do Not Track setting is used by a significant proportion of users, with more than 20% of users reported as using it. Now is not the time to abandon it. A visit to https://amiunique.org/fingerprint shows more than 22% of users in the last 7 days, 15 days, and 30 days have enabled a "Do Not Track" HTTP header attribute value. Similar figures were reported in 2019. https://archive.today/zzcwE "A Forrester research report found 25% of people using the Do Not Track setting, and a national survey we conducted found 23%."
If JavaScript is enabled, fingerprinting can be extremely accurate with just JavaScript alone, without examining HTTP header attribute values, meaning that Do Not Track might only be considered for fingerprinting for users who have a solution for selectively blocking JavaScript, such as a web browser addon.
https://backlinko.com/ad-blockers-users
"Sep. 02, 2024" "31.5% of internet users worldwide report using an ad blocker."
https://explodingtopics.com/blog/ad-block-users
"June 25, 2024" "DataReportal found that approximately 1 in 3 (32.5%) internet users use ad blockers."
It might be reasonable to say at least 75% of users who enabled "Do Not Track" are also users who know what an addon is and would install an addon such as uBlock Origin, Privacy Badger, NoScript, AdGuard, etc, which can be used to selectively block JavaScript. Given this assumption, 75% of the 22% of users using "Do Not Track" signals is 16.5% of all users. 16.5% represents more than half of the reported 32.5% of users using an addon to block JavaScript. Given this assumption, to blend in with the majority of the users who use an addon to block JavaScript, we should be enabling "Do Not Track" signals!
4 - Maybe we could consider intentionally searching for and visiting more websites which obey Do Not Track signals. Websites which obey Do Not Track signals indicate they are a part of the Good Guys. Having this way of differentiating websites is a good thing. We can use a web search or even an AI web search to search for "name-of-website Do Not Track privacy policy" to quickly find some of the Good Guys. A legal requirement has caused a large proportion of websites to indicate in a privacy policy whether they choose to obey or not obey Do Not Track signals.
https://www.freeprivacypolicy.com/blog/privacy-policy-do-not-track-dnt/
"As of January 1, 2014, changes to the California Online Privacy Protection Act (CalOPPA) required the owners of websites, web apps, mobile apps, and desktop apps to include a Do Not Track disclosure in their Privacy Policy agreements."
"In order to comply with CalOPPA's DNT requirements, website owners must make sure they: State how they respond to the DNT signals they receive from user's web browsers"
"Even if a website owner or operator isn't based in California, it still must include a DNT disclosure in the Privacy Policy. This is because the website or app may be attracting visitors who live in California."
This law was created after Do Not Track signals were introduced into major web browsers. The continued existence of the Do Not Track setting in the user interfaces of web browsers means the law will still have a reason to exist and privacy policies will continue to be required to display this information, allowing us to quickly identify some of the Good Guys and even more of the Bad Guys.
If we are stuck using a Bad Guy website, the very existence of the ability to easily configure obeying Do Not Track signals in more than 15 analytics products means it is possible to contact a website operator and ask the website operator to enable the setting. For anyone who says it won't work, I ask you, have you tried?
If there are a lot of bad apples in a market, should we make it even harder to find the good apples, or should we feel happy that a tool exists (Do Not Track) which makes it easier to distinguish some of the bad apples from some of the rare good apples (by using a search engine to look at a very specific section common to most privacy policies)? The same argument can be used for any market where it is difficult to find something you think is good, including shopping for good clothing or finding a suitable marriage partner.
Why is it okay to say we should remove the Do Not Track feature because many websites do not obey it and because it could be used for fingerprinting, but exactly the same statements can be made about Global Privacy Control, while it is supposedly okay to use the Global Privacy Control setting?
5 - In Mozilla Firefox, immediately next to the Do Not Track setting is a link that has an explanation which does not seem to give a false sense of security.
https://archive.today/evyo1 "Honoring this setting is voluntary — individual websites are not required to respect it."
Mozilla has made multiple revisions to the wording of the Do Not Track feature and if someone feels there is a better way to formulate the text of the option, Mozilla allows anyone to make suggestions.
If we want to talk about a false sense of security, when we see Global Privacy Control's Firefox option's text of "Tell web sites not to sell or share my data" should we expect a website which obeys Global Privacy Control signals to share our data with a third party like Google? We might not expect as much, but our data will apparently be shared with that third party when that third party's analytics service is used by a website operator.
What can we do?
A] Enable Do Not Track signals in our web browsers and teach our family members how to do the same.
The following website obeys Do Not Track signals and gives instructions for many types of web browsers on how to enable Do Not Track signals.
https://www.surreycc.gov.uk/website/cookies/do-not-track "How to enable the 'Do Not Track' browser setting"
For Firefox users, the Do Not Track option can be toggled in about:config. In the top address bar, type in the text about:config and go to the about:config webpage. When asked to Proceed with Caution, choose to Accept the Risk and Continue. In the "Search preference name" text field we can enter a value of "donottrack" and then look at the value (true or false) of the privacy.donottrackheader.enable preference. If the value is false, we can use the toggle button to set the value to true. Our change will be applied immediately and we can close the about:config webpage tab at our convenience. This approach still works in Firefox 135 and also works in older Firefox versions.
B] Use one or more methods of selectively blocking Bad Guy JavaScript. Probabilistic tracking using a Do Not Track signal is likely to apply only to users who block JavaScript deterministic tracking. Do a good deed for the world and teach your family members how to use such an addon.
https://ublockorigin.com/ https://privacybadger.org/ https://noscript.net/ https://adguard.com/
C] If you have a Mozilla account or you do not mind creating one, you are invited to log in and "give kudos" at the following link.
https://connect.mozilla.org/t5/ideas/keep-the-quot-do-not-track-quot-option/idi-p/81951
D] Contact the website operators of websites which you use a lot and ask them to enable the Do Not Track feature in their analytics tools and send them the links in b) at the start of this posting. If you get a response, consider sharing that response with the community.
