Risk
2/24/2012
12:44 PM
50%
50%

Do Not Track: 7 Key Facts

Key provision in the Obama administration's new Consumer Privacy Bill of Rights has benefits and limitations. Check out some of the compromises.

Opting out of some forms of online behavioral tracking should soon get easier, now that a number of technology and advertising firms have agreed to abide by a browser-based Do Not Track button.

That announcement came Thursday, in conjunction with the Obama administration announcing its proposal for a Consumer Privacy Bill of Rights.

After three years of advertisers battling Do Not Track, their shift represents a "win," said security and privacy researcher Christopher Soghoian in a blog post. Notably, the Do Not Track initiative has been backed by Google, Microsoft, and Yahoo, as well as the Digital Advertising Alliance (DAA), which counts almost 90% of the firms that engage in online behavioral tracking as members.

But questions remain. In an election year, pushing legislation to enforce Do Not Track would be difficult, according to Justin Brookman, the director for the non-profit civil liberties group Center for Democracy and Technology's Project on Consumer Privacy. Accordingly, the White House is encouraging online advertisers to agree to its new consumer privacy framework. Such an agreement would allow the Federal Trade Commission to then monitor and enforce compliance.

[ When it comes to privacy, we're our own worst enemy. See Google's Privacy Invasion: It's Your Fault. ]

In other words, as it now stands, the Do Not Track proposal only goes so far, and has been built on some compromises. Here's why:

1. Demonstrating Do-Not-Track Desire Easy

How did Do Not Track come about? Soghoian said that he and Mozilla's Sid Stamm created a prototype in 2009 as a Firefox add-on, which added these two headers to outgoing HTTP requests: "X-Behavioral-Ad-Opt-Out: 1" and "X-Do-Not-Track: 1." Simple, right?

2. Advertisers Prefer Tracking

While signaling intentions sounds straightforward, how those intentions can and should be interpreted is open to debate. Or as Mike Zaneis, senior VP of industry trade group the Interactive Advertising Bureau, has put it, "It's like sending a smoke signal in the middle of Manhattan; it might draw a lot of attention, but no one knows how to read the message."

3. What's Coming: Browser Opt-Outs

Thanks to growing criticism of online tracking, the DAA said it will now encourage all companies engaged in online behavioral advertising to commit to the new Do Not Track principles, which include informing consumers about how their data is being collected, as well as how they can opt out. At the same time, however, the group has also promised to educate consumers about how online tracking helps support "the free content, products, and services you use online."

4. Browsers Won't Be Tracked

While any step toward the advertising industry committing to some type of Do Not Track mechanism is welcome, it's only a first step. "The DAA members have committed to respect 'Do Not Track' instructions with respect to targeted advertising implemented through browser settings," said privacy expert and attorney Christopher Wolf of Hogan Lovells in a blog post.

5. Mobile Devices Can Still Be Tracked

Beyond browsers, tracking smartphone users--as practiced by the likes of Google--is a different story. Luckily, California officials have been working to get technology firms and advertising agencies to agree to curb such practices.

6. Browser Makers Must Work Out Details

While Do Not Track sounds great on paper, some pundits have warned that it's still up to browser makers to decide what a Do Not Track button will do. Mozilla, however, has said that it's "firmly committed" enabling users to opt out of whatever they want to opt out of. Google, meanwhile, said that its Chrome browser will "adopt a broadly consistent approach" to the Do Not Track proposals. Of course then it will still be up to consumers to actually press such a button.

7. Should You Trust A Browser Button?

Regardless of whether the online advertising industry's self-regulatory approach to allowing consumers to opt out of being tracked works or not, there are other steps that Internet users can take. Notably, numerous browser add-ons and features, such as Ghostery and Internet Explorer's TPL will help users see how they're being tracked, and block such behavior.

Security professionals often view compliance as a burden, but it doesn't have to be that way. In this report, we show the security team how to partner with the compliance pros. Download the report here. (Free registration required.)

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3971
Published: 2014-12-25
The CmdAuthenticate::_authenticateX509 function in db/commands/authentication_commands.cpp in mongod in MongoDB 2.6.x before 2.6.2 allows remote attackers to cause a denial of service (daemon crash) by attempting authentication with an invalid X.509 client certificate.

CVE-2014-7193
Published: 2014-12-25
The Crumb plugin before 3.0.0 for Node.js does not properly restrict token access in situations where a hapi route handler has CORS enabled, which allows remote attackers to obtain sensitive information, and potentially obtain the ability to spoof requests to non-CORS routes, via a crafted web site ...

CVE-2004-2771
Published: 2014-12-24
The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an email address.

CVE-2014-3569
Published: 2014-12-24
The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 1.0.1j does not properly handle attempts to use unsupported protocols, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an unexpected handshake, as demonstrated by an SSLv3 handshak...

CVE-2014-4322
Published: 2014-12-24
drivers/misc/qseecom.c in the QSEECOM driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not validate certain offset, length, and base values within an ioctl call, which allows attackers to gain privileges or c...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.