Do Not Track
The Future of Web Privacy

Nick DotyUC Berkeley, School of Information
World Wide Web Consortium
http://npdoty.name

who I am"future of" a clarification
not that Do Not Track is a solution to all Web privacy problems
or that derivations of this work are going to be the pattern for all future privacy issues
but the technical architecture provides hints at potential directions for Web privacy
and that the process we're going through (and its success/failure) will spellthese comments are my own, certainly not an official position of W3C or its members
therefore you can attribute all scatterbrained ideas to me and all the coherent brilliance to the WG andindustry members

Agenda• How we got here
• The current state of Do Not Track• Trends for Web privacy• Call for participation

to see how we got here, let's appropriately start with a few maps

From LUMA Partners, and slightly out of date, this is the 2010 version
the multi-faceted chains of online advertising provide a shocking list of companies involved

In a way this diagram, from the Future of Privacy Forum, gets at the key idea even more clearly, that the user is at
the center and while server-to-server communications happen too, the user and their browser is unknowingly incommunication with many of these players directly.

Personal Data Ecosystem
Marketers
Banks

DATA
USERS

Media
Affiliates

Information Brokers

DATA
BROKERS
Employers

List Brokers
Internet
examples:

DATA
COLLECTORS(sources)

Websites

E, SPECIALBUY ON
E! OFFER!
GET ONRETAIL &CONTENTWEBSITESSOCIAL
NETWORKINGSERVICES

PublicMedicalexamples:examples:Individual
MEDIA

Catalog Co-ops

GOVERNMENTAGENCIESHOSPITALSUTILITY
COMPANIES

RetailCREDIT CARDCOMPANIESPHARMACIES

Government

Financial & Insurace

examples:AIRLINES

DOCTORS& NURSES

examples:

INSURANCERETAILSTORESBANKSMedia Archives

STOCK
COMPANIES

Telecommunications&examples:
MobileMOBILEPROVIDERS

Product & Service
Delivery

CABLE
COMPANIESCARRIERSAd Networks &Analytics Companies

Credit Bureaus

Healthcare Analytics

Lawyers/
Private Investigators

Law Enforcement
Individuals

And this proliferation of data and its unclear transmission is of concern to policymakers, including the FTC who
presented this diagram in their 2010 report in which they endorsed the creation of a Do Not Track mechanism.

Not just advertising, social networking widgets are another key example (in that case often connected via log-incookies to your real name).
Diagram from WSJ article one year ago.
Might seem obvious to you all (loading of external resources, authentication cookies, potential logging, etc.) but
when I talked about this to a group of lawyers earlier this week at Stanford...

Flash Cookies and Privacy[A]

Ashkan Soltani , Shannon Canty[B][1], Quentin Mayo[B][2], Lauren Thomas[B][3] & Chris Jay Hoofnagle[C]School of Information[A]Summer Undergraduate Program in Engineering Research at Berkeley (SUPERB) 2009[B]UC Berkeley School of Law[C]University of California, Berkeley
Berkeley, USA
correspondence to: choofnagle@law.berkeley.edu
Abstract—This is a pilot study of the use of “Flash cookies” bypopular websites. We find that more than 50% of the sites inour sample are using Flash cookies to store information about
the user. Some are using it to “respawn” or re-instantiate
HTTP cookies deleted by the user. Flash cookies often sharethe same values as HTTP cookies, and are even used on
government websites to assign unique values to users. Privacy
policies rarely disclose the presence of Flash cookies, and user
controls for effectuating privacy preferences are lacking.
Privacy, tracking, flash, cookies, local stored objects,
usability, online advertising, behavioral targeting, self-help

I.

INTRODUCTION

Advertisers are increasingly concerned about uniquetracking of users online.[4] Several studies have found thatover 30% of users delete first party HTTP cookies once amonth, thus leading to overestimation of the number of true
unique visitors to websites, and attendant overpayment foradvertising impressions.[4]Mindful of this problem, online advertising companies
have attempted to increase the reliability of tracking
methods. In 2005, United Virtualities (UV), an online
advertising company, exclaimed, "All advertisers, websites
and networks use [HTTP] cookies for targeted advertising,but cookies are under attack.”[5] The company announced
that it had, “developed a backup ID system for cookies set by
web sites, ad networks and advertisers, but increasingly
deleted by users. UV's ‘Persistent Identification Element’(PIE) is tagged to the user's browser, providing each with aunique ID just like traditional cookie coding. However, PIEs
cannot be deleted by any commercially available antispyware, mal-ware, or adware removal program. They will
even function at the default security setting for InternetExplorer.”[5] (Since 2005, a Firefox plugin called“BetterPrivacy”, and more recently, a shareware program
called “Glary Utilities Pro” can assist users in deleting Flashcookies.)
United Virtualities’ PIE leveraged a feature in Adobe’s
Flash MX: the “local shared object,”[6] also known as the“flash cookie.” Flash cookies offer several advantages thatlead to more persistence than standard HTTP cookies. Flashcookies can contain up to 100KB of information by default(HTTP cookies only store 4KB).[7] Flash cookies do nothave expiration dates by default, whereas HTTP cookies
expire at the end of a session unless programmed to live
longer by the domain setting the cookie. Flash cookies are
stored in a different location than HTTP cookies,[7] thus

users may not know what files to delete in order to eliminate
them. Additionally, they are stored so that different browsers
and stand-alone Flash widgets installed on a given computer
access the same persistent Flash cookies. Flash cookies are
not controlled by the browser. Thus erasing HTTP cookies,
clearing history, erasing the cache, or choosing a delete
private data option within the browser does not affect Flashcookies. Even the ‘Private Browsing’ mode recently added
to most browsers such as Internet Explorer 8 and Firefox 3
still allows Flash cookies to operate fully and track the user.
These differences make Flash cookies a more resilient
technology for tracking than HTTP cookies, and creates anarea for uncertainty for user privacy control.
It is important to differentiate between the varying usesof Flash cookies. These files (and any local storage ingeneral) provides the benefit of allowing a given application
to 'save state' on the users computer and provide better
functionality to the user. Examples of such could be storing
the volume level of a Flash video or caching a music file forbetter performance over an unreliable network connection.
These uses are different than using Flash cookies as
secondary, redundant unique identifiers that enable
advertisers to circumvent user preferences and self-help.
With rising concern over “behavioral advertising,” theUS Congress and federal regulators are considering newrules to address online consumer privacy. A key focus
surrounds users’ ability to avoid tracking, but the privacy
implications of Flash cookies has not entered the discourse.
Additionally, any consumer protection debate will
include discourse on self-help. Thus, consumers’ ability to
be aware of and control unwanted tracking will be a key partof the legislative debate.
To inform this debate, we surveyed the top 100 websites
to determine which were using Flash cookies, and exploredthe privacy implications. We examined these sites’ privacy
policies to see whether they discussed Flash cookies.
We also studied the privacy settings provided by Adobe
for Flash cookies, in an effort to better understand thepractical effects of using self-help to control Flash cookies.
Because some sites rely so heavily on the use of Flashcontent, users may encounter functionality difficulties as aresult of enabling these privacy settings.
We found that Flash cookies are a popular mechanism forstoring data on the top 100 sites.
From a privacy
perspective, this is problematic, because in addition tostoring user settings, many sites stored the same values inboth HTTP and Flash cookies, usually with telling variablenames indicating they were user ids or computer guids

1

is this just a question of cookie management?
flash cookies
every other local storage techniquebrowser fingerprinting
an escalating list of management techniques and tracking techniques -- do we expect users to keep up withthese?
and in a way, this is worse for all parties -- companies doing legitimate tracking may lose out on data while users
never have the comfort of knowing that they won’t be tracked (chilling)in fact, this has been characterized as an “arms race”

mutually assured destruction

A brief history
headers proposed inbrowser extensions(2009)“Do Not Track” registry(2007)

W3C Working
Group formed(August 2011)

FTC report(2010)

Neelie Kroes’
challenge (June)

IE & Firefox
implementations(2010-11)

Starting with the popular name/idea from advocacy groups in 2007. (Not to scale, but you get the picture.)
Note that this is starting more with “running code” and then getting to “rough consensus”.

Agenda• How we got here• The current state of Do Not Track• Trends for Web privacy• Call for participation

DNT: 1How does Do Not Track work? Well, most of it comes down to this.
Divided into technical mechanism and compliance policy documents, but let’s start with the technical side, which
may be more accessible to this audience.
In some ways this is a pretty straightforward bits on the wire...

Request and response• DNT: 1• Tk: {0,1,3,u}•• /.well-known/dnt/• DNT: 0• navigator.doNotTrack

A little more complicated, we’re looking at a request and response model.
The value of that response is transparency for the user (as the CMU study pointed out, the biggest usability issue
may be the doubt that this is being respected) and a “regulatory hook”.

Exceptions• navigator.doNotTrack.
requestSiteSpecificTrackingException()• requestWebWideTrackingException()• removeSiteSpecificTrackingException()• removeWebWideTrackingException()user-agent-managed exceptions via JavaScript API
let sites have an explicit negotiation over whether they wish to allow tracking in exchange for a service... and then manage those exceptions in a single place where they can be monitored and changed

Compliance• What does it mean to comply with a user’s
expressed tracking preference?

• What does “tracking” mean?

separation of mechanism and policy... separate documents, but otherwise Do Not Track is confronting this ratherdirectlyCompliance• Few limitations for first-party interactions• Restrictions on both collection and use• Permitted uses under heated debate• Service providers (collector vs. processor)• “Unlinkable” dataProcess• Tracking ProtectionWorking Group• Art of Consensus• Multistakeholderism"rough consensus and running code"
Tracking Protection Working Group charter, what the W3C is and a Working Group ispolitical context (Berlaymont, but also US gov, industry trade associations)Process• “freedom is anendless meeting”• 3,122 emails• 75 participants from41 organizations• Four face-to-facemeetings

public list, and pretty substantial emails at that
not without its frustrations
10 full days of meeting time so far, next meeting scheduled for next month in Seattle
fast, aggressive timeline to attempt this in under a year
graduating maturity of drafts (not yet at Last Call)Skepticism
Example #1:
P5P: NO-TRACK, PINKY-SWEAR...specifies that the server should not track the user. The
PINKY-SWEAR token is described in the Policy Tokens
section below.
...
NO-ADS-IM-SURE-YOU-WILL-FIGURE-OUTANOTHER-BUSINESS-MODEL
Indicates that the user does not wish to be shown any
form of advertising content, and expresses their earnest
belief that the web publisher will find some way toremain in business without an income stream.
some objections to the system that we’ve heard
http://pastebin.com/ijjRKvUB

Skepticism“The "Do Not Track" HTTP header is useless, equivalent
to a "Do not Steal from Me" T-shirt.”— some commenter on Hacker News

Skepticism
3. Setting the Evil Bit
There are a number of ways in which the evil bit may beset. Attack applications may use a suitable API torequest that it be set. Systems that do not have othermechanisms MUST provide such an API; attack
programs MUST use it.
— RFC 3514

Skepticism
Privacy in an open society also requires cryptography.
[...]
We cannot expect governments, corporations, or otherlarge, faceless organizations to grant us privacy out of
their beneficence.
— Cypherpunk Manifesto

Engineers like solutions that are self-enforcing and Do Not Track is affirmatively not.
To answer some of the common questions, enforcement is done through legal means, or through market means,or even through social norms and ethics. (Regulatory hook, economics of large trackers, etc.)

Agenda• How we got here
• The current state of Do Not Track• Trends for Web privacy• Call for participation

Capabilities, not resources
ee8f6e1260fd5a80cf5f5fb5546beff6c2a01cab

given that users struggle to understand the mechanisms and privacy implications, we should be managing privacy
concerns based on the capability rather than the particular tool
"don't track me" not "don't set a cookie for this domain pair"
the Apple UDID controversy
potentially the Android manifest categorization, or research work in that area

Machine-readable policy

DNT is in essence the simplest form of machine-readable policy, a single bit. Hints at the possibility of othermachine-readable policy systems.
Anecdote about keeping count of mentions of “creative commons for privacy” at privacy events.

Privacy Icons,Aza Raskin,Mozilla
2011

KnowPrivacy
UC Berkeley
2009Privacy Label
CMU
2009-2010

TRUSTe Privacy
Short Notice
2011

built on top of XML policy database
Travis worked on the KnowPrivacy example as wellPrivacy Bird
AT&T
2002

At least 2002, maybe earlier.
Based on the site’s P3P policy, P3P standardized between 1996 and 2002

Machine-readable policy
Rehashing P3P?
An idea whose time has come?
Technology facilitating policy?

Creative Commons
more generically, the Policy Aware Web idea, a dream of the Semantic Web"policy description with late binding of rules for accountability""avoid legal system the way we do in the rest of life"

Multistakeholderism"Internet policy like the internet itself is best built through collaboration."
both W3C and I personally would like to make the case that the Tracking Protection Working Group is a promising attempt for multistakeholderism in addressing
Internet privacy
but you’ll hear this term used often enough (if you haven’t already) that we may need to be skeptical of itlike “democracy” something that you can’t be against?
debate over a potential ITU role in Internet governancethe conditions of multistakeholderism
really what we mean is procedural and substantive legitimacy, some normative democratic weight behind decisions that are madein our case consensus and multistakeholderism has the pragmatic aim of needing everyone to agree to find adoption
we’ve tried to make the process as open and involved multiple viewpoints BOTH to get a technically better result and to get a result that will fairly
satisfy the community goal
like democracy, the worst form except for all the alternatives
government regulation, industry-only self-regulation, standards that aren’t implemented
this is a lot of theory, but concretely: MSH is something you’ll hear about directly from USG
NTIA wants to host MSH processes to develop privacy codes of conductAgenda• How we got here
• The current state of Do Not Track• Trends for Web privacy• Call for participation

CfP

optimism
we can build technologies that translate privacy implications into human terms and communicate human privacy
preferencesbuilding these tools correctly requires understanding both the technology and the human privacy concern
get involved!
NTIA, W3C, IETF, ITU, etc.
and if the available specific work items aren’t of interest, we also have the question of considering privacy whilebuilding other Web standards...
W3C Privacy Interest Group and IAB privacy programs

Nick Doty
http://npdoty.name
npdoty@ischool.berkeley.edu
npdoty@w3.org