Risk
11/14/2011
12:11 PM
Connect Directly
RSS
E-Mail
50%
50%

W3C Proposes Do Not Track Privacy Standard

Microsoft, Mozilla, Google, Apple, privacy groups, and online advertising associations work to balance consumers' interests with Web companies' requirements for user data.

Firefox 8 Beta: Visual Tour
Firefox 8 Beta: Visual Tour
(click image for larger view and for slideshow)
The World Wide Web Consortium (W3C), the standards body that develops the protocols and guidelines for the Web, Monday released the first draft of its proposed standard for implementing "Do Not Track" online.

Do Not Track refers to giving consumers the ability to opt out of having their personal information and online browsing habits tracked by advertisers, marketers, and websites in general. The final W3C Do Not Track standard--due out by the summer of 2012--will detail both how consumers can express their tracking preferences, as well as how websites and their affiliates will acknowledge those preferences.

"We know there are many types of users. Some eagerly welcome the benefits of personalized Web services, while others value their privacy above all else," said Aleecia M. McDonald, a privacy researcher for the Mozilla Foundation, and co-chair of the Tracking Protection working group developing the standard, in a statement. "Do Not Track puts users in control, so they can choose the tradeoffs that are right for them.

[Privacy experts worry that Amazon's Kindle Fire tablet will stockpile your browsing habits. See Amazon Addresses Silk Tablet 'Optimized Browsing' Privacy Concerns.]

How will the W3C working group balance the needs of privacy-conscious consumers with the data-collection demands of online advertising, which provides the revenue that many websites require to stay in business? "The overall goal is to match the expectations of the users. On average, users have expectations for if they turn tracking off, and what this means, and we try to get as close as possible to these expectations," said Matthias Schunter, who's part of IBM Research and a co-chair of the W3C Tracking Protection working group.

But adding more anonymity to the Web creates challenges. "From a technology perspective, I think a big challenge will be research and statistics," said Schunter. "Advertisers, even if they don't show targeted ads, it's important for them to know how many people viewed and clicked, what your conversion rate is. Currently, many mechanisms used for these statistics are not so privacy-friendly."

The working group's mission will be to find the right checks and balances among these various requirements. "I wouldn't want to come up with a lame compromise that falls apart in a year," he said.

Accordingly, the group includes representatives from many organizations with a stake in both sides of the online advertising and tracking debate. "The working group has just started, but the big achievement at this point isn't the documents that we've put out, but that we've gathered all of the big players in the space together--Google, Facebook, IBM, Mozilla, Microsoft, Mozilla--as well as the big privacy organizations--the Center for Democracy and Technology, the Electronic Frontier Foundation--and also the interactive advertising organizations, which are usually umbrella organizations for advertising agencies," he said. The Federal Trade Commission and German Independent Center for Privacy Protection are also advising the group.

The working group is crafting two standards. The first is Tracking Preference Expression, "to define a standard for a how a browser can tell a website that a user wants more privacy," said Schunter, so browser makers can implement Do Not Track consistently. "So you send a signal, and you get a response from the website which tells you that the request has been honored." The second standard, meanwhile, is the Tracking Compliance and Scope Specification, which details how websites should comply with Do Not Track preferences.

Once finalized, these standards won't be enforced by the W3C. Rather, enforcement would likely involve advertising industry associations, who could require their members to comply with Do Not Track. In addition, any U.S. advertiser that said it complied would be held to account by the FTC, as well as by privacy monitoring organizations, such as TRUSTe--also part of the Tracking Protection working group--and the Better Business Bureau.

Do Not Track will likely not be active by default. "Simply speaking, if all browsers would ship with Do Not Track on, then you'd offer too much privacy to the people who don't care. So the agreement that I do see happening is that the browser should only transmit preferences that the user has expressed," said Schunter.

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
jrapoza
50%
50%
jrapoza,
User Rank: Apprentice
11/15/2011 | 6:22:39 PM
re: W3C Proposes Do Not Track Privacy Standard
How this is implemented will be key. If it's easy for sites to ignore user preferences, then it is essentially toothless.

Jim Rapoza is an InformationWeek Contributing Editor
Bprince
50%
50%
Bprince,
User Rank: Ninja
11/17/2011 | 4:01:15 AM
re: W3C Proposes Do Not Track Privacy Standard
I agree Jim. Also, the second to last paragraph I think spotlights the question of enforcement, and whether or not that will be sufficient.
Brian Prince, InformationWeek/Dark Reading Comment Moderator
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Must Reads - September 25, 2014
Dark Reading's new Must Reads is a compendium of our best recent coverage of identity and access management. Learn about access control in the age of HTML5, how to improve authentication, why Active Directory is dead, and more.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-5485
Published: 2014-09-30
registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin interface.

CVE-2012-5486
Published: 2014-09-30
ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character.

CVE-2012-5487
Published: 2014-09-30
The sandbox whitelisting function (allowmodule.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain privileges to bypass the Python sandbox restriction and execute arbitrary Python code via vectors related to importing.

CVE-2012-5488
Published: 2014-09-30
python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to createObject.

CVE-2012-5489
Published: 2014-09-30
The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
In our next Dark Reading Radio broadcast, we’ll take a close look at some of the latest research and practices in application security.