Risk
11/14/2011
12:11 PM
Connect Directly
RSS
E-Mail
50%
50%

W3C Proposes Do Not Track Privacy Standard

Microsoft, Mozilla, Google, Apple, privacy groups, and online advertising associations work to balance consumers' interests with Web companies' requirements for user data.

Firefox 8 Beta: Visual Tour
Firefox 8 Beta: Visual Tour
(click image for larger view and for slideshow)
The World Wide Web Consortium (W3C), the standards body that develops the protocols and guidelines for the Web, Monday released the first draft of its proposed standard for implementing "Do Not Track" online.

Do Not Track refers to giving consumers the ability to opt out of having their personal information and online browsing habits tracked by advertisers, marketers, and websites in general. The final W3C Do Not Track standard--due out by the summer of 2012--will detail both how consumers can express their tracking preferences, as well as how websites and their affiliates will acknowledge those preferences.

"We know there are many types of users. Some eagerly welcome the benefits of personalized Web services, while others value their privacy above all else," said Aleecia M. McDonald, a privacy researcher for the Mozilla Foundation, and co-chair of the Tracking Protection working group developing the standard, in a statement. "Do Not Track puts users in control, so they can choose the tradeoffs that are right for them.

[Privacy experts worry that Amazon's Kindle Fire tablet will stockpile your browsing habits. See Amazon Addresses Silk Tablet 'Optimized Browsing' Privacy Concerns.]

How will the W3C working group balance the needs of privacy-conscious consumers with the data-collection demands of online advertising, which provides the revenue that many websites require to stay in business? "The overall goal is to match the expectations of the users. On average, users have expectations for if they turn tracking off, and what this means, and we try to get as close as possible to these expectations," said Matthias Schunter, who's part of IBM Research and a co-chair of the W3C Tracking Protection working group.

But adding more anonymity to the Web creates challenges. "From a technology perspective, I think a big challenge will be research and statistics," said Schunter. "Advertisers, even if they don't show targeted ads, it's important for them to know how many people viewed and clicked, what your conversion rate is. Currently, many mechanisms used for these statistics are not so privacy-friendly."

The working group's mission will be to find the right checks and balances among these various requirements. "I wouldn't want to come up with a lame compromise that falls apart in a year," he said.

Accordingly, the group includes representatives from many organizations with a stake in both sides of the online advertising and tracking debate. "The working group has just started, but the big achievement at this point isn't the documents that we've put out, but that we've gathered all of the big players in the space together--Google, Facebook, IBM, Mozilla, Microsoft, Mozilla--as well as the big privacy organizations--the Center for Democracy and Technology, the Electronic Frontier Foundation--and also the interactive advertising organizations, which are usually umbrella organizations for advertising agencies," he said. The Federal Trade Commission and German Independent Center for Privacy Protection are also advising the group.

The working group is crafting two standards. The first is Tracking Preference Expression, "to define a standard for a how a browser can tell a website that a user wants more privacy," said Schunter, so browser makers can implement Do Not Track consistently. "So you send a signal, and you get a response from the website which tells you that the request has been honored." The second standard, meanwhile, is the Tracking Compliance and Scope Specification, which details how websites should comply with Do Not Track preferences.

Once finalized, these standards won't be enforced by the W3C. Rather, enforcement would likely involve advertising industry associations, who could require their members to comply with Do Not Track. In addition, any U.S. advertiser that said it complied would be held to account by the FTC, as well as by privacy monitoring organizations, such as TRUSTe--also part of the Tracking Protection working group--and the Better Business Bureau.

Do Not Track will likely not be active by default. "Simply speaking, if all browsers would ship with Do Not Track on, then you'd offer too much privacy to the people who don't care. So the agreement that I do see happening is that the browser should only transmit preferences that the user has expressed," said Schunter.

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
jrapoza
50%
50%
jrapoza,
User Rank: Apprentice
11/15/2011 | 6:22:39 PM
re: W3C Proposes Do Not Track Privacy Standard
How this is implemented will be key. If it's easy for sites to ignore user preferences, then it is essentially toothless.

Jim Rapoza is an InformationWeek Contributing Editor
Bprince
50%
50%
Bprince,
User Rank: Ninja
11/17/2011 | 4:01:15 AM
re: W3C Proposes Do Not Track Privacy Standard
I agree Jim. Also, the second to last paragraph I think spotlights the question of enforcement, and whether or not that will be sufficient.
Brian Prince, InformationWeek/Dark Reading Comment Moderator
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2021
Published: 2014-10-24
Cross-site scripting (XSS) vulnerability in admincp/apilog.php in vBulletin 4.4.2 and earlier, and 5.0.x through 5.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted XMLRPC API request, as demonstrated using the client name.

CVE-2014-3604
Published: 2014-10-24
Certificates.java in Not Yet Commons SSL before 0.3.15 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

CVE-2014-6230
Published: 2014-10-24
WP-Ban plugin before 1.6.4 for WordPress, when running in certain configurations, allows remote attackers to bypass the IP blacklist via a crafted X-Forwarded-For header.

CVE-2014-6251
Published: 2014-10-24
Stack-based buffer overflow in CPUMiner before 2.4.1 allows remote attackers to have an unspecified impact by sending a mining.subscribe response with a large nonce2 length, then triggering the overflow with a mining.notify request.

CVE-2014-7180
Published: 2014-10-24
Electric Cloud ElectricCommander before 4.2.6 and 5.x before 5.0.3 uses world-writable permissions for (1) eccert.pl and (2) ecconfigure.pl, which allows local users to execute arbitrary Perl code by modifying these files.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.