Firefox 4 ‘Do Not Track’: How it works, what it really means

One of the most interesting new features in Firefox 4 is one of the most simple. Called “Do Not Track,” it’s a basic check-box in the settings that allows users to signal to websites and ad networks that they don’t want their activities to be tracked for purposes of targeting ads to them based on their online behavior.

It’s a small step toward addressing privacy issues associated with online advertising. Mozilla introduced the feature in February in the Firefox 4 Beta, and Microsoft later decided to use a similar approach as a “secondary method” to supplement the privacy protections that it was already planning for Internet Explorer 9.

Johnathan Nightingale, director of engineering for Firefox, spoke about this issue as part of our broader conversation last week. (Also see our earlier post with Nightingale’s explanation of Mozilla’s decision to support Windows XP.) Continue reading for excerpts from his comments on the “Do Not Track” issue.

Johnathan Nightingale, Firefox engineering director

The context for the Do Not Track feature: There’s a growing awareness that advertisers can assemble this information, and historically, if you wanted to opt out of it, the way you did it was with Adblock. You install an add-on into Firefox that just sledgehammered every ad off the Internet. That’s kind of a crappy solution. Yes, your privacy is protected, that’s great. But you’re going to a lot of content sites that are supported by advertising, and you’re shutting down their revenue model. If the privacy invasion gets big enough, and enough people start installing Adblock, then sites find it hard to stay open. You start to see more sites putting up paywalls, and that’s hard. I think if you talk to a lot of people who use ad block, they would tell you, I don’t mind ads. I would tolerate ads. I’m just really not OK with trading privacy in the exchange.

How Do Not Track works: The way we’ve built it into Firefox 4 is really simple. You can go into your options, and there’s a checkbox here that says, tell websites I do not want to be tracked. That’s it. One check-box, it’s off by default, we wanted people to make this choice on purpose. But when we make that choice, anytime we send a header it says, “Do Not Track = 1″. And that’s it. Technologically, there’s no way we can force the ad networks to respect this, because this isn’t actually a technological problem. This is a trust issue. This is a relationship between readers of a website, and the operators of that website, and the advertisers that website works with. And if they want to be unscrupulous, they can drive dump trucks of personal information back and forth in the middle of the night. You can’t stop that with a browser feature. What we wanted to do was start the conversation.

The reaction: So we put this into a beta, and we weren’t sure what kind of traction it would get. We thought it was the right choice, but we were interested to see what would happen. The phone started ringing off the hook. Advertisers in particular were calling and they weren’t saying, you’re going to ruin the web, or why are you trying to tell us how to do our jobs, they were saying, help us understand what a do-not-track policy would look like. Because they’re interested in responding to this, I think personally, before governments start forcing them to.

How much usage in the beta? Hard to say, because we don’t phone home with that information. It would be paradoxical if we tracked people who were asking not to be tracked. We’ve got 4 million beta users, so in a sense that’s a big number, but it may not be the case that a lot of websites are seeing many of these things. It’s a new feature in a new browser that hasn’t been released yet. But (on Tuesday) 400 million people are going to have this switch. I’ll be interested to see — I’d be interested to find out from you a month down the road, how often you guys are seeing it when people load your website. This doesn’t just go to ad networks, this goes on every load.

How sites should get involved: My hope is that the conversation involves sites in an important way. I don’t think this is just a dialogue between users and advertisers. If I go to Facebook and I’m sending a Do Not Track header, I want to know what Facebook’s response is to that, and how Facebook pushes that out to the people they partner with. If I’m reading a news site and sending Do Not Track headers, I want to see something in their privacy policy that says, we only work with advertisers that respect Do Not Track headers. I want people to be able to vote with their feet on this where the advertisers that are trying to be good citizens can view this as an opportunity to differentiate. I want content sites to feel pressure to work with advertisers who also respect privacy in that way.

His reaction to Microsoft’s decision to implement Do Not Track: When you talk about uptake, we got uptake from a place we didn’t expect. While we were talking about this “Do Not Track” header, Microsoft was talking about IE9, and they were using a block-list approach. It looked a lot like Adblock. You could choose which list you wanted to subscribe to, and block those sites. We were happy to see Microsoft in the privacy game, but it was a little bit disappointing, because that’s sort of the 2008 version of this solution. What really surprised us was IE9 came out, and if you turn on that block-listing feature, it also sends a “Do Not Track” header just like ours. Our privacy guys were all quite surprised by it. I think they’re still taking it apart, and understanding, is the header identical to ours, is it based on ours, but I didn’t know it was coming, ad there it is. I think in terms of uptake, starting this discussion the way we did has had even broader effects more quickly than we thought it would.

How Mozilla approaches advertising issues: One of the privileges of being Mozilla is that we don’t have to answer to anyone but the users. We don’t have to worry about whether a decision like this hurts the advertising portion of our business, because we don’t have an advertising portion of our business. It’s interesting to see other companies, companies who maybe are involved in advertising, involved in this.

Where it’s headed from here: I really think over the next year, every browser vendor is going to have to figure out how they respond to this, and if they want to get on board, and my hope is that you’re going to see a lot of websites talking about it, too. It’s been a long time coming. We need to see the web get better here. We’re happy to take this first step, but I think our implementation is going to evolve, as well. Right now, it’s just a simple yes or no, do I want to be tracked. Once peopl have had some time to think about it, they’re probably going to want more nuance there — these sites are OK, these sites aren’t. Or, I don’t want to be tracked on this account, but I don’t mind on my throwaway account. There’s nuance to find there, but first things first — we’re just really happy to be moving the conversation forward.

Firefox 4 is due out on Tuesday as a finished release.

Previously on GeekWire: Inside IE9: How Microsoft rewrote its browser from scratch

 

  • J Zwart

    Tx, clears up a few quastions. Goog going forward , led by Mozilla. :)

  • jackie the whackie

    Websites with advertisers are going to respect the do not track header? Probably not.

  • Will

    Nothing annoys me more than seeing items I just bought being advertised to me for less than I just paid. But I do like the vendors being there, offering. I would use a Do Not Track, jus so I can still see vendors related to the page I’m visiting.

  • David C.

    I’m not so concerned with tracking as I am with ads that interfere with what I’m doing. Ads that use Flash/Java (burning CPU cycles and draining my battery), ads that use sound, ads that open new windows/tabs, ads that float things over the content I’m trying to read, etc.

    I use popup blockers and flash blockers, but sadly, that isn’t enough to get rid of the in-your-face ads that I try so hard to avoid. So adblock remains installed on my system. I make a point of permitting ads from sources that are known to be well-behaved (like Google), but block everything else.

    If the advertisers don’t like it, then they can clean up their industry and stop acting as if they own me and my computer.

    • Celchlepp

      You said it perfect David.  Thanks, Chuck.

  • Anonymous

    I never mind of their Ads Revenues,since they are selling my personal data…..My Personal data is more important than any thing else in the internet.

    I use AdBlock Plus, Disconnect.me, No script Firefox Addons and also configure the Firefox Cookie settings to accept only trusted cookies.The only thing that I want to make next is use of Proxy server or Fake IP software to keep completely Anonymous.

    Now I am not seeing any advertisements and not even been tracked by any websites.

  • Drift Away

    Any way to send the “Do Not Track = 1″ header as a pop-up? (:

  • sad_genavive

    I use AdBlock Plus because ads cause page load times to skyrocket due to the absurd number of additional requests that have to be made to serve up each ad. What would have been a 2 second page load is now a good minute or so. “Do Not Track” does not solve this issue. The worst offenders are news outlets that use multiple third-party ad servers.

    By the way, if your business can’t survive without web advertising revenue from suspicious websites (“one easy way to remove belly fat” ads…anyone?), then you probably shouldn’t be in business.