Risk
2/24/2012
12:44 PM
Connect Directly
RSS
E-Mail
50%
50%

Do Not Track: 7 Key Facts

Key provision in the Obama administration's new Consumer Privacy Bill of Rights has benefits and limitations. Check out some of the compromises.

Opting out of some forms of online behavioral tracking should soon get easier, now that a number of technology and advertising firms have agreed to abide by a browser-based Do Not Track button.

That announcement came Thursday, in conjunction with the Obama administration announcing its proposal for a Consumer Privacy Bill of Rights.

After three years of advertisers battling Do Not Track, their shift represents a "win," said security and privacy researcher Christopher Soghoian in a blog post. Notably, the Do Not Track initiative has been backed by Google, Microsoft, and Yahoo, as well as the Digital Advertising Alliance (DAA), which counts almost 90% of the firms that engage in online behavioral tracking as members.

But questions remain. In an election year, pushing legislation to enforce Do Not Track would be difficult, according to Justin Brookman, the director for the non-profit civil liberties group Center for Democracy and Technology's Project on Consumer Privacy. Accordingly, the White House is encouraging online advertisers to agree to its new consumer privacy framework. Such an agreement would allow the Federal Trade Commission to then monitor and enforce compliance.

[ When it comes to privacy, we're our own worst enemy. See Google's Privacy Invasion: It's Your Fault. ]

In other words, as it now stands, the Do Not Track proposal only goes so far, and has been built on some compromises. Here's why:

1. Demonstrating Do-Not-Track Desire Easy

How did Do Not Track come about? Soghoian said that he and Mozilla's Sid Stamm created a prototype in 2009 as a Firefox add-on, which added these two headers to outgoing HTTP requests: "X-Behavioral-Ad-Opt-Out: 1" and "X-Do-Not-Track: 1." Simple, right?

2. Advertisers Prefer Tracking

While signaling intentions sounds straightforward, how those intentions can and should be interpreted is open to debate. Or as Mike Zaneis, senior VP of industry trade group the Interactive Advertising Bureau, has put it, "It's like sending a smoke signal in the middle of Manhattan; it might draw a lot of attention, but no one knows how to read the message."

3. What's Coming: Browser Opt-Outs

Thanks to growing criticism of online tracking, the DAA said it will now encourage all companies engaged in online behavioral advertising to commit to the new Do Not Track principles, which include informing consumers about how their data is being collected, as well as how they can opt out. At the same time, however, the group has also promised to educate consumers about how online tracking helps support "the free content, products, and services you use online."

4. Browsers Won't Be Tracked

While any step toward the advertising industry committing to some type of Do Not Track mechanism is welcome, it's only a first step. "The DAA members have committed to respect 'Do Not Track' instructions with respect to targeted advertising implemented through browser settings," said privacy expert and attorney Christopher Wolf of Hogan Lovells in a blog post.

5. Mobile Devices Can Still Be Tracked

Beyond browsers, tracking smartphone users--as practiced by the likes of Google--is a different story. Luckily, California officials have been working to get technology firms and advertising agencies to agree to curb such practices.

6. Browser Makers Must Work Out Details

While Do Not Track sounds great on paper, some pundits have warned that it's still up to browser makers to decide what a Do Not Track button will do. Mozilla, however, has said that it's "firmly committed" enabling users to opt out of whatever they want to opt out of. Google, meanwhile, said that its Chrome browser will "adopt a broadly consistent approach" to the Do Not Track proposals. Of course then it will still be up to consumers to actually press such a button.

7. Should You Trust A Browser Button?

Regardless of whether the online advertising industry's self-regulatory approach to allowing consumers to opt out of being tracked works or not, there are other steps that Internet users can take. Notably, numerous browser add-ons and features, such as Ghostery and Internet Explorer's TPL will help users see how they're being tracked, and block such behavior.

Security professionals often view compliance as a burden, but it doesn't have to be that way. In this report, we show the security team how to partner with the compliance pros. Download the report here. (Free registration required.)

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-4262
Published: 2014-07-28
svnwcsub.py in Subversion 1.8.0 before 1.8.3, when using the --pidfile option and running in foreground mode, allows local users to gain privileges via a symlink attack on the pid file. NOTE: this issue was SPLIT due to different affected versions (ADT3). The irkerbridge.py issue is covered by CVE-...

CVE-2013-4840
Published: 2014-07-28
Unspecified vulnerability in HP and H3C VPN Firewall Module products SECPATH1000FE before 5.20.R3177 and SECBLADEFW before 5.20.R3177 allows remote attackers to cause a denial of service via unknown vectors.

CVE-2013-7393
Published: 2014-07-28
The daemonize.py module in Subversion 1.8.0 before 1.8.2 allows local users to gain privileges via a symlink attack on the pid file created for (1) svnwcsub.py or (2) irkerbridge.py when the --pidfile option is used. NOTE: this issue was SPLIT from CVE-2013-4262 based on different affected versions...

CVE-2014-2974
Published: 2014-07-28
Cross-site request forgery (CSRF) vulnerability in php/user_account.php in Silver Peak VX through 6.2.4 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts.

CVE-2014-2975
Published: 2014-07-28
Cross-site scripting (XSS) vulnerability in php/user_account.php in Silver Peak VX before 6.2.4 allows remote attackers to inject arbitrary web script or HTML via the user_id parameter.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Sara Peters hosts a conversation on Botnets and those who fight them.