Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


02:33 PM
Connect Directly

Mozilla, Google Propose Defenses Against Ad Tracking

Will self-regulation will be any more effective in the future than it has been in the past?

In the wake of a Federal Trade Commission threat last month to take action against companies that violate consumers’ privacy though behavioral ad tracking, Google and Mozilla this week proposed new tools to help consumers gain more control over ad tracking cookies.

The FTC's December report, "Protecting Consumer Privacy in an Era of Rapid Change: A Proposed Framework for Businesses and Policymakers," calls for the implementation of a “Do Not Track” mechanism," similar in concept to the National Do Not Call Registry.

Yet even as the report suggests that industry self-regulation hasn't worked, it continues to recommend self-regulation, without imposing any substantive penalties for lack of compliance.

Google on Monday acknowledged the shortcomings of existing self-regulatory measures, such as the Network Advertising Initiative and the Self-Regulatory Principles for Online Behavioral Advertising. The principal problem with such programs in Google's eyes is that users who have chosen to opt-out of ad tracking have that decision erased if they ever clear their browser cookies. Also, past settings may not cover ad tracking cookies placed by companies that launched after the user set his or her ad tracking preferences.

So Google is offering a browser extension called Keep My Opt-Outs, which will store a user's opt-out preferences even if he or she subsequently deletes his or her browser cookies. This extension is intended to serve as a complement to Google's existing Advertising Cookie Opt-out Plugin.

"[W]e’ve designed the extension so that it should not otherwise interfere with your Web browsing experience or Web site functionality," explain Google product managers Sean Harvey and Rajas Moonka in a blog post. "This new feature gives you significant control without compromising the revenue that fuels the Web content that we all consume every day."

Mozilla meanwhile is proposing a Do Not Track HTTP header that will allow browser users to transmit their desire to opt-out of behavioral ad targeting to Web servers.

"When the feature is enabled and users turn it on, Web sites will be told by Firefox that a user would like to opt-out of [online behavioral advertising]," said Alex Fowler, Mozilla's head of global privacy and public policy, in a blog post. "We believe the header-based approach has the potential to be better for the Web in the long run because it is a clearer and more universal opt-out mechanism than cookies or blacklists."

Anup Ghosh, founder and chief scientist of Invincea, a browser security company, finds both approaches lacking. Mozilla's proposal, he says, is a "paper tiger."

"It's basically up to Web sites to do something or nothing with [users' preference information]," he said in a phone interview. "It's not enforceable."

Microsoft recently discussed a similar privacy feature in Internet Explorer 9. Ghosh says that while he was initially critical of what Microsoft was doing, the Mozilla proposal makes him think better of what's coming in IE9, even though Microsoft's privacy plan puts the onus on the user to identify the cookies to be blocked.

Without any penalties for lack of compliance, Mozilla's proposal, he suggests, ends up harming those companies that choose to comply rather than those that do not.

Google's approach, he observes, requires users to download and install software. "Most users aren't going to be doing that," he said.

Faced with solutions of dubious efficacy, users may resort to technology that already works: ad blocking extensions. Ghosh concedes that ad blocking extensions will prevent cookies from being placed. "But the industry doesn't want to go that way," he said. "Advertising pays for free content."

That leaves open the question of how much the ad industry really wants to pay for privacy.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Cyberattacks Are Tailored to Employees ... Why Isn't Security Training?
Tim Sadler, CEO and co-founder of Tessian,  6/17/2021
7 Powerful Cybersecurity Skills the Energy Sector Needs Most
Pam Baker, Contributing Writer,  6/22/2021
Microsoft Disrupts Large-Scale BEC Campaign Across Web Services
Kelly Sheridan, Staff Editor, Dark Reading,  6/15/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-06-25
SAS Environment Manager 2.5 allows XSS through the Name field when creating/editing a server. The XSS will prompt when editing the Configuration Properties.
PUBLISHED: 2021-06-24
Shopware is an open source eCommerce platform. In versions prior to the admin api has exposed some internal hidden fields when an association has been loaded with a to many reference. Users are recommend to update to version You can get the update to regularly via the Auto-U...
PUBLISHED: 2021-06-24
Shopware is an open source eCommerce platform. In versions prior to private files publicly accessible with Cloud Storage providers when the hashed URL is known. Users are recommend to first change their configuration to set the correct visibility according to the documentation. The visibilit...
PUBLISHED: 2021-06-24
Shopware is an open source eCommerce platform. Versions prior to 5.6.10 are vulnerable to system information leakage in error handling. Users are recommend to update to version 5.6.10. You can get the update to 5.6.10 regularly via the Auto-Updater or directly via the download overview.
PUBLISHED: 2021-06-24
Shopware is an open source eCommerce platform. Versions prior to 5.6.10 suffer from an authenticated stored XSS in administration vulnerability. Users are recommend to update to the version 5.6.10. You can get the update to 5.6.10 regularly via the Auto-Updater or directly via the download overview.