Do Not Track

Do Not Track
IETF HTTP Working Group (HTTPbis) · Public domain · source
Name	Do Not Track
Developer	World Wide Web Consortium
Released	2010s
Operating system	Cross-platform
Platform	Web browsers
Genre	Privacy preference protocol

Do Not Track is a privacy preference mechanism that enables users to express their desire not to be tracked across websites. Conceived as an HTTP header and browser setting, it aimed to coordinate responses from web browsers, advertising networks, analytics vendors, and regulatory bodies. Early attention came from standards bodies and technology companies as debates unfolded among regulators, consumer advocates, and industry consortiums.

Background

Do Not Track emerged amid heightened scrutiny of online advertising practices involving Google, Facebook, Microsoft, Yahoo!, Twitter, Adobe Systems, and Amazon (company). Advocacy groups such as the Electronic Frontier Foundation, Privacy International, and Center for Democracy & Technology promoted user choice models paralleled by initiatives from Federal Trade Commission (United States), Office of the Privacy Commissioner of Canada, European Commission, and Article 29 Working Party. Standards discussions were hosted by the World Wide Web Consortium with participation from stakeholders including Mozilla Foundation, Apple Inc., Opera Software, AOL, Comcast, Verizon Communications, AT&T, IAB (Interactive Advertising Bureau), and Network Advertising Initiative. Key events influencing conception included regulatory reports like the FTC report on consumer privacy and policy debates in legislatures such as the United States Congress and bodies like the European Parliament.

Technical Specification

The specification work took place in the W3C Privacy Interest Group and later the W3C Tracking Protection Working Group. The mechanism used an HTTP header field sent by browsers — aligned with existing protocol constructs such as HTTP/1.1, User-Agent, and Cookie (HTTP). Browser vendors implemented UI controls similar to preferences in Mozilla Firefox, Google Chrome, Internet Explorer, Safari (web browser), and Opera (web browser), with user-agents toggling a header akin to an oAuth style consent signal. Interoperability discussions referenced standards like RFC 7231 and concepts from SameSite cookie attribute and Content Security Policy techniques. Specification drafts debated semantics for server-side recognition, machine-readable policy expressions, and links to legal frameworks such as General Data Protection Regulation and California Consumer Privacy Act.

Implementation and Adoption

Deployment varied across platforms: Mozilla Corporation and Apple Inc. included toggles in Firefox for Android, Safari (web browser), and desktop releases, while Google LLC provided browser flags in Chrome (web browser). Industry implementers such as DoubleClick, AppNexus, Criteo, PubMatic, Rubicon Project, The Trade Desk, and Microsoft Advertising responded with mixed support. Advertising associations including Interactive Advertising Bureau and Network Advertising Initiative proposed parallel mechanisms like opt-out cookies and centralized preference APIs; companies such as Lotame and Quantcast used preference signals in consent management platforms. Major publishers like The New York Times Company, The Guardian, BBC, The Washington Post, and The Wall Street Journal adjusted advertising stacks, and technology firms like Akamai Technologies and Cloudflare integrated header-aware routing. Adoption tensions involved content networks like AOL and ad exchanges like OpenX, leading to pilot programs and interoperability tests coordinated at forums such as IETF meetings and W3C workshops.

Privacy and Legal Implications

Privacy advocates argued the signal strengthened rights discussed under frameworks including GDPR and national laws such as the California Consumer Privacy Act and enforcement bodies like the Federal Trade Commission (United States). Regulatory briefs from entities like the European Data Protection Board and national regulators in United Kingdom and Australia considered whether a browser-expressed preference should create legal obligations for processors such as Oracle Corporation and SAP SE. Courts and lawmakers referenced precedent from cases involving Google LLC and Facebook, Inc. concerning tracking and profiling. Debates intersected with consumer protection statutes and litigation handled by firms like Skadden, Arps, Slate, Meagher & Flom and Covington & Burling in privacy class actions. International negotiations involved multilateral institutions such as the Organisation for Economic Co-operation and Development and trade agreements influencing cross-border data flows.

Criticism and Limitations

Critiques came from academic researchers at institutions like Stanford University, Massachusetts Institute of Technology, Carnegie Mellon University, University of California, Berkeley, and University of Cambridge, documenting technical circumvention through fingerprinting methods published in venues such as USENIX, ACM SIGCOMM, IEEE Symposium on Security and Privacy, and WWW Conference. Industry analyses from Gartner and Forrester Research noted low compliance rates and misalignment with business models of firms like Facebook, Inc. and Google LLC. Legal scholars at Harvard Law School and Yale Law School questioned enforceability absent statutory mandates. Behavioral researchers referenced studies from Pew Research Center and RAND Corporation showing user confusion and limited meaningful choice. Critics also cited practical limitations involving intermediaries like content delivery networks and browser extensions developed by entities such as Ghostery and Disconnect.

Alternatives and Complementary Technologies

Complementary approaches included consent frameworks like IAB Transparency and Consent Framework, technical protections such as Browser Fingerprinting defenses, tracker-blocking lists used by EasyList and EasyPrivacy, and privacy-preserving advertising proposals from research labs at Microsoft Research, Google Research, IBM Research, and Mozilla Research. Privacy-enhancing technologies encompassed Tor (anonymity network), HTTPS, SameSite cookie attribute, Subresource Integrity, differential privacy pioneered by teams at Apple Inc. and Google, and proposals like Federated Learning of Cohorts explored by Google LLC. Standards initiatives and open-source projects from organizations such as Electronic Frontier Foundation, OpenID Foundation, and Kantara Initiative offered complementary governance and technical tooling.

Category:Internet privacy