Internet Explorer 10's Do Not Track default: flouting web standards in the name of privacy

Microsoft was warned that its decision to enable Do Not Track (DNT) by default in Windows 8's Internet Explorer 10 would encourage web content providers to ignore the request to keep advertisers from following user's movements around the web, and those predictions are becoming very true. Yahoo has just published its thoughts on the matter, and in the blog post says that it "will not recognize IE10’s default DNT signal on Yahoo! properties at this time." The company cites that the DNT standard has not been finalized, and that Microsoft's decision "degrades the experience for the majority of users and makes it hard to deliver on our value proposition to them."

Yahoo is quick to point out that 'In principle, we support "Do Not Track,'" but ultimately, the fact remains that DNT is being flatly ignored. The move closely mimics a much more significant decision made by Apache's co-founder in reaction to Microsoft's move, which patched the open source server software behind about 60 percent of websites to ignore the DNT setting in Internet Explorer 10. Much like the reasoning behind the Apache co-founder's decision to patch the software, Yahoo says that "we believe that DNT must map to user intent — not to the intent of one browser creator, plug-in writer, or third-party software service." We'll be keeping an eye on how this continues to develop; now the Windows 8 is officially released, we expect the debate over DNT to only intensify, and more may join in Yahoo's decision to look past Internet Explorer 10's defaults.

Following months of relative quiet on the subject of Do Not Track — an HTTP header that tells advertisers and other third parties not to follow you around the internet — the controversial browser signal is being thrust back into the limelight. After the W3C's recent face-to-face meeting in Amsterdam, the the Digital Advertising Alliance plainly said that it "does not require companies to honor DNT," effectively saying it intends to stick to its own self-regulatory approach to user privacy. Much of the renewed interest stems from Microsoft's controversial decision to turn Do Not Track on by default in Windows 8's Internet Explorer 10, and Adobe engineer Roy Fielding's subsequent decision to take a sledgehammer to the Apache web server, patching it in a way that explicitly overwrites the DNT signal coming from Microsoft's newest browser.

With the fate of our beloved internet economy allegedly at stake, perhaps it's a good time to examine what Do Not Track is. How did the standard come to be, what does it do, and how does it stand to change online advertising? Is it as innocuous as privacy advocates make it sound, or does it stand to jeopardize the free, ad-supported internet we've all come to rely on?

During the Windows 8 installation process, users are presented with a choice between default system settings (called Express) and a more customized setup. At issue is whether showing users the phrase "turn on Do Not Track in Internet Explorer" in the Express settings description (before having them click through) is truly an expression of preference, and not "the choice of some vendor, institution, or network-imposed mechanism outside the user’s control."

Roy Fielding, author of the patch, co-founder of Apache, and contributor to the DNT specification, believes the case falls squarely under the latter, saying "the only reason DNT exists is to express a non-default option… It does not protect anyone’s privacy unless the recipients believe it was set by a real human being, with a real preference for privacy over personalization."

The last we heard about Microsoft's intention to enable Do Not Track flags in Internet Explorer 10 by default, the W3C, the authority behind the entire DNT spec, was advising the Redmond company to make it a user option rather than a preset. This was mostly down to the fear that many websites may choose to disregard Do Not Track instructions from a browser that is automatically set to send them out — web content providers are more willing to respect user preferences when a user performs some action to express them. Such has been the W3C's reasoning, however Microsoft's consumer research has corroborated its expectation that most people prefer to have an aggressive set of privacy controls enabled in their browser by default.

Microsoft is today disclosing a little more information about how it will enable Do Not Track in IE10, with a specific view on how it works as you set up your fresh copy of Windows 8. Two setup choices will be provided to users, you'll be able to elect between the automatic Express Settings or Customize your own. If you opt for the former, you'll see "prominent notice" that DNT has been enabled on your computer, while the latter will naturally let you toggle DNT on or off. Additional Learn More and Privacy Statement links will furnish the user with yet more information about the choices presented.

Microsoft's plans to enable Do Not Track flags in Internet Explorer 10 by default have taken a setback this week as the latest draft of the DNT specification explicitly states that the user must be given the choice. You might recall that the original W3C proposal for Do Not Track was actually titled "Tracking Preference Expression," and this latest revision to its wording is reflecting the importance placed on those words — the sending of Do Not Track signals to websites from your browser must only happen as a direct expression of your will. Thus, any browser that defaults to either enabling or disabling DNT without asking the user to choose which she prefers is in breach of the spec as it currently stands.

Microsoft is still free to continue with its plans, however it would not be able to say it adheres to the proper Do Not Track specification if it does, and many websites and advertisers may opt to ignore its flags as a result. Their argument would be that it's up to users to signal they do not want to have their web browsing tracked — which, ironically, Microsoft's stated plans for IE 10 do not allow.