Lots more users can be expected to activate do-not-track on their browsers soon. The top web browser in the U.S. and around the world, Microsoft’s Internet Explorer will automatically enable do-not-track for users in version 10, the preview version of which is already available. Meanwhile, Microsoft’s own ad network currently does not acknowledge DNT, meaning it still tracks users who have by choice enabled DNT in their browsers.
Since Microsoft quietly made its default DNT plans public yesterday, they have been panned by some privacy advocates and even Mozilla – first to add a DNT tool to its browser. While touting its new Windows 8 operating system, Microsoft mentioned its decision to automatically turn on do-not-track (DNT) in the upcoming version of its IE browser. The current version relies on users to choose to opt-in to DNT.
Of course, advertisers are not happy about it. Some believe that as a participant in the organizations helping to develop standards for DNT, Microsoft has already agreed that such a mechanism should not be enabled by default. Others suggest that because industry has counted on minimal consumer adoption of DNT, ad networks, site publishers and ad tech firms will make and industry-wide choice to ignore DNT signals, rendering them impotent.
Still some see a conspiracy brewing: they say Microsoft’s default DNT move is part of the company’s grand scheme to cripple Google’s online advertising business, one so successful Microsoft once even tried to acquire Yahoo just to compete with it.
Microsoft Surprises Privacy Wonks
If anything, Microsoft shocked a lot of privacy and DNT stakeholders yesterday. “I did not know about MSFT’s upcoming announcement prior to the call yesterday,” wrote Aleecia M. McDonald, co-chair of the World Wide Web Consortium’s Tracking Protection Working Group on the group’s public discussion list. The W3C is developing standards for DNT.
McDonald, a part-time senior privacy researcher at Mozilla, suggested the Microsoft decision is a reason for the group to determine once and for all whether DNT should be by default or not. “I see this as a reason to push for a recommendation sooner rather than later: this is the sort of thing that happens in the days before a recommendation, with companies interpreting and implementing as they like on all sides,” she continued in her discussion post.
More publicly, Mozilla’s privacy and public policy lead, Alex Fowler disagreed with Microsoft’s plan, pointing directly to the W3C’s most recent DNT draft, which states a standard DNT mechanism “must reflect the user’s preference, not the preference of some institutional or network-imposed mechanism outside the user’s control.”
In a Mozilla blog post, Fowler wrote, “If DNT is on by default, it’s not a conversation. For DNT to be effective, it must actually represent the user’s voice.”
(Some) Government Likes It
FTC chairman Jon Leibowitz reportedly called Microsoft’s default DNT “yet another step forward in giving consumers choice about their browsing data,” as reported by Cecilia Kang in The Washington Post. “Despite this positive development, industry should honor consumer choice not just for receiving targeted ads, but for all tracking other than for expected purposes like security.”
Congressman Ed Markey of Massachusetts, co-sponsor of the Do Not Track Kids Act of 2011, called the decision “an important first step towards greater privacy protections for consumers,” adding, “It is my hope that Microsoft and other companies will go further in the future, so that Do Not Track also means ‘Do Not Collect’, giving consumers the ability to say no to both targeted advertising and collection of their personal data.”
The news had online ad industry self-regulators scrambling. While the trade coalition behind the behavioral ad privacy program is working in conjunction with the Federal Trade Commission and U.S. Commerce Department to design a standard do-not-track mechanism for browsers, the group is not comfortable with DNT by default.
The Digital Advertising Alliance, which operates the ad industry’s behavioral advertising privacy program, called Microsoft’s decision “unilateral” and made without consultation with industry partners. “Microsoft’s technology announcement appears to include requirements that are inconsistent with the consensus achieved over the appropriate standards for collecting and using web viewing data (and which today are enforced by strong self-regulation).” Microsoft is a member of both the DAA and the W3C’s DNT working group.
“Our decision to turn on DNT by default in IE10 for Windows 8 should be seen as part of this discussion, as it helps to provide clarity on one side of the discussion – when and how browsers send the DNT signal – and because it advances the idea of privacy as the default state,” noted Brendon Lynch, chief privacy officer at Microsoft on the company’s blog.
Ironically, Microsoft Advertising does not acknowledge DNT signals yet. “Microsoft does not yet respond to the DNT signal, but we are actively working with other advertising industry leaders on what an implementation plan for DNT might look like, with a goal of announcing more details about our plans in the coming months,” added Lynch.
Conspiracy Theories Emerge
“Do Not Track by default in IE 10 isn’t an example of IE competing against Chrome, but Microsoft going for the jugular – Google’s ad revenue,” wrote Christopher Soghoian a security and privacy researcher, on Twitter. Indeed, he and others believe Microsoft aims to injure Google’s ad business, which, like just about every other digital advertising operation, is reliant on tracking data for ad management, targeting, and measurement.
If Microsoft actually does implement DNT by default (some stakeholders think the backlash may persuade it not to), the online ad industry could simply decide not to recognize DNT signals at all, meaning companies would continue tracking and collecting data whether or not a user has DNT enabled.
“Prediction: Ad networks that have already pledged to respect Do Not Track will backtrack for IE10 due to Microsoft enabling it by default,” stated Soghoian on Twitter. Another privacy advocate, Jim Brock of PrivacyChoice put it simply in a tweet: “This is doom for a common DNT standard.”