Steelie Neelie: Settle your Do-No-Track squabbles or else
I will call in the politicians
Regulators may impose a Do-Not-Track standard on squabbling tech vendors and web businesses after they missed a deadline to develop their own proposal.
EU member states are looking at how to enforce DNT under ePrivacy rules, the vice president responsible for the Digital Agenda Neelie Kroes said Wednesday.
Kroes also hinted at action in the US, too, pointing to the Federal Trade Commission's growing frustration with the ongoing lack of agreement and watering down of proposals.
Kroes said techies and businessmen have one last opportunity to agree something that suits users, business and the internet.
“Let me be frank: standardisation work is not going according to plan. In fact, I am increasingly concerned,” she said.
She pointed to the current mess over whether or not DNT should be switched on "by default" in the browser – Microsoft’s Internet Explorer 10 for Windows 8 is by default whereas Mozilla Firefox's DNT must be switched on by the user. She also spoke of the ad-hoc code change by Apache daddy Roy Fielding to make Apache web servers disable DNT setting in IE10, and growing “concern” about delay and deadlock at the World Wide Web Consortium (W3C) Tracking Protection Working Group.
Topping her concerns was the watering down of DNT proposals by all concerned in the process. She said it was crucial to settle how users are informed about their default settings, that websites shouldn’t “second guess” or disregard users’ choices, and added that the rules of what could be done without consent should be limited and made clear.
If the industry doesn’t nail these subjects quickly, then the politicians will come up with their own answer, she warned. “To all of those taking part in these discussions I say today: you need to find a good consensus – and fast,” she said.
Kroes said she’d now raise DNT as a topic for the next meeting of the EU Article 29 working party on protection of personal data before the year’s end. Speaking in June 2011 and January this year Kroes had given the industry until June 2012 to agree a DNT standard.
“I am worried about the soundness of what we are getting – and about the slow speed. Failing to deliver would mean everyone loses. Users miss out on an easy way to protect their privacy, websites miss out on a simple and user-friendly way to comply with consent requirements. And, ultimately, advertisers lose out, too,” she said Wednesday.
She called a DNT standard a “valuable and useful” means of giving users a web they can trust, avoiding expensive ad-hoc solutions and companies or individuals being sued for "illegal tracking".
“We need, as far as possible, a simple and uniform way of addressing e-privacy – across different providers and different types of tracking. You shouldn't have every provider reinventing the wheel on this one,” she said.
“If DNT only goes halfway, providers will need to ensure legal compliance beyond that. There will be a delta, things providers need to do to get valid cookie consent, on top of or beyond implementing DNT.
“There should be a discussion about what that delta looks like in the EU Member States given the legal requirements and given the state of the standard. With the providers who will need to know the answer and with the authorities enforcing ePrivacy, who will need to set out their position.”
It is unclear how an EU solution would be. The original EU ePrivacy Directive was passed in 2002 and the cookie law was only implemented in 2012 in the UK, and following much apathy and foot-dragging.
After delaying implementation for a year, the UK’s Information Commissioner changed the cookie law - already revised - by watering it down.
The law said companies must gain the consent of web users before serving them cookies. The IC change, though, said “implied consent” was “a valid form of consent” in order for operators to comply with the EU law.
The UK wasn’t alone in going slow on cookies. Just two of the 27 bloc states initially delivering proposals to the Commission went on to implement the cookie rules under a revised e-Privacy Directive in 2011.
Post-law, adoption of the new cookie rules seems patchy. The law said companies must gain the consent of web users before serving them cookies.
A KMPG study of UK websites in June – 10 days after the law came into force – found that less than one in five sites had complied with the law. ®
Go for the throat
Good on her I say, I don't like the idea of ploititions resolving this but with petty reactions like Roy Fielding's this is just turning into a playground fight.
Sort the kids out, privacy should be on by default in my book why do the marketeers and advertisers belive that information is their right to have. While they silently enable the option but never tell the users it is there.
Less technical people would never know about it unless they were told as in IE10 (well done MS), everyone I have talked to has said they would turn the privacy on if they knew about it which none of them did before I talked to them.
"She also spoke of the ad-hoc code change by Apache daddy Roy Fielding to make Apache web servers disable DNT setting in IE10, "
That one item there shows an arrogant tech industry that is out of control and needs bringing sharply to heel.
Surely altering a setting in that manner is illegal in many territories? If not it should be.
Its MY machine. I will set it as I want it, not how some Ad man requires. Ad men are welcome to bid for MY web data direct from me - Im not saying I would sell, but they can ask.
Coat - without the cookies in the pocket - they get dropped at the door
@h3, I think that you may be conf[(lat)|u]sing two related, but separate concepts.
The downloading and storage of third-party cookies, script, graphics, frames, etc. can be controlled by the browser (perhaps with the aid of extensions/plug-ins).
To block data from the second party (primary web-site) would somewhat defeat the purpose of a web browser. Information in the request header from th browser cannot be controlled by the user once it is sent, and is under the control of the recipient web-ite.
The intention (but not necessarily the actualité) of the EU legislation seems to be to prevent both second and third parties from collecting, collating and sharing data that would infringe the user's expectation of privacy without the user's explicit informed consent.
The use of "Do Not Track" makes the intentions of the subject clear, and firmly places the onus on the web-site to comply. Failure to respect the "Do Not Track"s could be construed as wilful, and
invite legal action against the data harvester.
Companies that seek to profit from collecting and selling personal data (really just an extension of the credit-rating and employment blacklist agencies) would rather use covert methods for fear of their product source drying up.