W3C Proposes Do Not Track Privacy Standard

Firefox 8 Beta: Visual Tour

The World Wide Web Consortium (W3C), the standards body that develops the protocols and guidelines for the Web, Monday released the first draft of its proposed standard for implementing "Do Not Track" online.

Do Not Track refers to giving consumers the ability to opt out of having their personal information and online browsing habits tracked by advertisers, marketers, and websites in general. The final W3C Do Not Track standard--due out by the summer of 2012--will detail both how consumers can express their tracking preferences, as well as how websites and their affiliates will acknowledge those preferences.

"We know there are many types of users. Some eagerly welcome the benefits of personalized Web services, while others value their privacy above all else," said Aleecia M. McDonald, a privacy researcher for the Mozilla Foundation, and co-chair of the Tracking Protection working group developing the standard, in a statement. "Do Not Track puts users in control, so they can choose the tradeoffs that are right for them.

[Privacy experts worry that Amazon's Kindle Fire tablet will stockpile your browsing habits. See Amazon Addresses Silk Tablet 'Optimized Browsing' Privacy Concerns.]

How will the W3C working group balance the needs of privacy-conscious consumers with the data-collection demands of online advertising, which provides the revenue that many websites require to stay in business? "The overall goal is to match the expectations of the users. On average, users have expectations for if they turn tracking off, and what this means, and we try to get as close as possible to these expectations," said Matthias Schunter, who's part of IBM Research and a co-chair of the W3C Tracking Protection working group.

But adding more anonymity to the Web creates challenges. "From a technology perspective, I think a big challenge will be research and statistics," said Schunter. "Advertisers, even if they don't show targeted ads, it's important for them to know how many people viewed and clicked, what your conversion rate is. Currently, many mechanisms used for these statistics are not so privacy-friendly."

The working group's mission will be to find the right checks and balances among these various requirements. "I wouldn't want to come up with a lame compromise that falls apart in a year," he said.

Accordingly, the group includes representatives from many organizations with a stake in both sides of the online advertising and tracking debate. "The working group has just started, but the big achievement at this point isn't the documents that we've put out, but that we've gathered all of the big players in the space together--Google, Facebook, IBM, Mozilla, Microsoft, Mozilla--as well as the big privacy organizations--the Center for Democracy and Technology, the Electronic Frontier Foundation--and also the interactive advertising organizations, which are usually umbrella organizations for advertising agencies," he said. The Federal Trade Commission and German Independent Center for Privacy Protection are also advising the group.

The working group is crafting two standards. The first is Tracking Preference Expression, "to define a standard for a how a browser can tell a website that a user wants more privacy," said Schunter, so browser makers can implement Do Not Track consistently. "So you send a signal, and you get a response from the website which tells you that the request has been honored." The second standard, meanwhile, is the Tracking Compliance and Scope Specification, which details how websites should comply with Do Not Track preferences.

Once finalized, these standards won't be enforced by the W3C. Rather, enforcement would likely involve advertising industry associations, who could require their members to comply with Do Not Track. In addition, any U.S. advertiser that said it complied would be held to account by the FTC, as well as by privacy monitoring organizations, such as TRUSTe--also part of the Tracking Protection working group--and the Better Business Bureau.

Do Not Track will likely not be active by default. "Simply speaking, if all browsers would ship with Do Not Track on, then you'd offer too much privacy to the people who don't care. So the agreement that I do see happening is that the browser should only transmit preferences that the user has expressed," said Schunter.