Risk
2/24/2012
12:44 PM
Connect Directly
RSS
E-Mail
50%
50%

Do Not Track: 7 Key Facts

Key provision in the Obama administration's new Consumer Privacy Bill of Rights has benefits and limitations. Check out some of the compromises.

Opting out of some forms of online behavioral tracking should soon get easier, now that a number of technology and advertising firms have agreed to abide by a browser-based Do Not Track button.

That announcement came Thursday, in conjunction with the Obama administration announcing its proposal for a Consumer Privacy Bill of Rights.

After three years of advertisers battling Do Not Track, their shift represents a "win," said security and privacy researcher Christopher Soghoian in a blog post. Notably, the Do Not Track initiative has been backed by Google, Microsoft, and Yahoo, as well as the Digital Advertising Alliance (DAA), which counts almost 90% of the firms that engage in online behavioral tracking as members.

But questions remain. In an election year, pushing legislation to enforce Do Not Track would be difficult, according to Justin Brookman, the director for the non-profit civil liberties group Center for Democracy and Technology's Project on Consumer Privacy. Accordingly, the White House is encouraging online advertisers to agree to its new consumer privacy framework. Such an agreement would allow the Federal Trade Commission to then monitor and enforce compliance.

[ When it comes to privacy, we're our own worst enemy. See Google's Privacy Invasion: It's Your Fault. ]

In other words, as it now stands, the Do Not Track proposal only goes so far, and has been built on some compromises. Here's why:

1. Demonstrating Do-Not-Track Desire Easy

How did Do Not Track come about? Soghoian said that he and Mozilla's Sid Stamm created a prototype in 2009 as a Firefox add-on, which added these two headers to outgoing HTTP requests: "X-Behavioral-Ad-Opt-Out: 1" and "X-Do-Not-Track: 1." Simple, right?

2. Advertisers Prefer Tracking

While signaling intentions sounds straightforward, how those intentions can and should be interpreted is open to debate. Or as Mike Zaneis, senior VP of industry trade group the Interactive Advertising Bureau, has put it, "It's like sending a smoke signal in the middle of Manhattan; it might draw a lot of attention, but no one knows how to read the message."

3. What's Coming: Browser Opt-Outs

Thanks to growing criticism of online tracking, the DAA said it will now encourage all companies engaged in online behavioral advertising to commit to the new Do Not Track principles, which include informing consumers about how their data is being collected, as well as how they can opt out. At the same time, however, the group has also promised to educate consumers about how online tracking helps support "the free content, products, and services you use online."

4. Browsers Won't Be Tracked

While any step toward the advertising industry committing to some type of Do Not Track mechanism is welcome, it's only a first step. "The DAA members have committed to respect 'Do Not Track' instructions with respect to targeted advertising implemented through browser settings," said privacy expert and attorney Christopher Wolf of Hogan Lovells in a blog post.

5. Mobile Devices Can Still Be Tracked

Beyond browsers, tracking smartphone users--as practiced by the likes of Google--is a different story. Luckily, California officials have been working to get technology firms and advertising agencies to agree to curb such practices.

6. Browser Makers Must Work Out Details

While Do Not Track sounds great on paper, some pundits have warned that it's still up to browser makers to decide what a Do Not Track button will do. Mozilla, however, has said that it's "firmly committed" enabling users to opt out of whatever they want to opt out of. Google, meanwhile, said that its Chrome browser will "adopt a broadly consistent approach" to the Do Not Track proposals. Of course then it will still be up to consumers to actually press such a button.

7. Should You Trust A Browser Button?

Regardless of whether the online advertising industry's self-regulatory approach to allowing consumers to opt out of being tracked works or not, there are other steps that Internet users can take. Notably, numerous browser add-ons and features, such as Ghostery and Internet Explorer's TPL will help users see how they're being tracked, and block such behavior.

Security professionals often view compliance as a burden, but it doesn't have to be that way. In this report, we show the security team how to partner with the compliance pros. Download the report here. (Free registration required.)

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Must Reads - September 25, 2014
Dark Reading's new Must Reads is a compendium of our best recent coverage of identity and access management. Learn about access control in the age of HTML5, how to improve authentication, why Active Directory is dead, and more.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-5485
Published: 2014-09-30
registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin interface.

CVE-2012-5486
Published: 2014-09-30
ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character.

CVE-2012-5487
Published: 2014-09-30
The sandbox whitelisting function (allowmodule.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain privileges to bypass the Python sandbox restriction and execute arbitrary Python code via vectors related to importing.

CVE-2012-5488
Published: 2014-09-30
python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to createObject.

CVE-2012-5489
Published: 2014-09-30
The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
In our next Dark Reading Radio broadcast, we’ll take a close look at some of the latest research and practices in application security.