Do Not Track

~ the eulogy ~

The name was borrowed from something that worked. The telephone do-not-call registry was a list held by a regulator, and a company that called a number on that list could be fined for it. The web version kept the name and left the enforcement out.

What it kept was the mechanism, which was one line of text. Your browser could attach DNT: 1 to every request it sent, and that was the whole invention. The header traveled to a server under no obligation to read it and facing no penalty for lying about whether it had. Christopher Soghoian and Sid Stamm built the first version as a Firefox add-on in July 2009. The Federal Trade Commission put its weight behind the idea in a privacy report in December 2010, Mozilla announced browser support the following month and shipped it in Firefox 4 on 22 March 2011. Internet Explorer 9 had it the same month, Safari by April, Chrome by June 2012.

The W3C opened a Tracking Protection Working Group in September 2011 to write the thing down properly. It produced two documents. One described the syntax of the header, which nobody had much trouble agreeing on. The other described what a site receiving the signal actually owed you, and that document never finished, because the people in the room could not agree on what counted as tracking.

The checkbox sat in the privacy tab of every browser I installed from 2011 onward and I turned it on every time, on every machine I set up. I am an engineer. I knew exactly what the header did on the wire, which is to say I knew it did nothing by itself, and I ticked it anyway. That is not stupidity. It is what a person does with the only control on offer.

~ the dossier ~

~ what one header can and cannot do ~

A request is not a rule. The registry that gave Do Not Track its name had a government agency behind it with the power to fine people. The web version had no list and no agency. It put the entire burden on whoever received the signal, and the parties receiving it were the ones being asked to give up revenue.

That is why the compliance document mattered more than the syntax and why it never shipped. Publishers and ad networks wanted tracking defined narrowly, as following a person across unrelated sites for behavioral targeting, with carve-outs for measurement and fraud detection. Privacy people wanted it to mean do not collect. Eight years of meetings did not close that distance by one inch.

~ the year microsoft turned it on ~

In August 2012 Microsoft shipped Internet Explorer 10 with Windows 8 and set Do Not Track on by default. It read as a privacy win at the time. It was the end of the argument. The draft spec said the signal had to reflect a deliberate choice by a person, on the reasoning that a header sent by millions of machines whose owners never opened a settings page tells you nothing about what any of them want.

Roy Fielding, who co-wrote the spec and had written a large part of the Apache web server, committed a patch in September 2012 that made Apache strip the header when it came from IE10. The patch was contentious enough to be commented out within weeks, but the point had already landed. The industry now had a defensible reason to ignore every DNT signal from every browser, since no server could tell which ones came from a person. Microsoft dropped the default on 3 April 2015, three years too late for it to matter.

~ who was supposed to obey ~

Almost nobody, as it turned out. Google put the setting into Chrome in 2012 and never honored it on Google properties, which is the entire story in one sentence. A short list of sites did respect it, mostly the ones with no advertising business to lose. The trade groups negotiated inside the W3C for years and then walked away from the table.

The syntax document reached Candidate Recommendation and stalled there. The closing note in January 2019 is one of the flattest things the W3C has ever published: there had not been sufficient deployment to justify further advancement, and there were no indications of planned support. Eight years of meetings for a header nobody was ever required to read.

~ what replaced it ~

Apple took the setting out of Safari 12.1 in February 2019, one month after the group closed, and the stated reason is the grim kind of funny. So few people were sending the header that sending it had become a way to identify you. The protection had turned into a fingerprinting bit. Firefox kept its checkbox until version 135 on 4 February 2025 and then removed that too.

The replacement arrived in October 2020 as Global Privacy Control, and the only real difference is the part Do Not Track never had. California's privacy law treats it as a legally binding opt-out request. In August 2022 the state attorney general settled with Sephora for 1.2 million dollars, and one of the counts was ignoring GPC signals. The technology is the same idea it always was. What made it work was a fine.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »