Will Do Not Track cripple the tech industry?

OK, I admit that this article has a pretty inflammatory headline but there’s a good reason: my title features the words (or at least a fair paraphrasing) of Eric Wheeler and he’s been writing inflammatory things.

Eric’s recently written an article for CNET that spells out the terrible future that awaits if we don’t stop Do Not Track:

Taken as a whole, the potentially dire impact of Do Not Track is clear: the end of a free Internet and a crippling blow to the technology industry … We are headed for what feels like an anti-Internet, not a privacy movement.

Anti-Internet? Technology industry crippled? Sounds like we’re in trouble.

Just in case you don’t already know let me explain that Do Not Track and DNT are colloquial titles for a set of browser and website standards that will give users a way to opt-in or opt-out of being tracked online.

The standards are being produced by the W3C’s Tracking Protection Working Group, a body that counts web heavyweights like Google, Microsoft and Mozilla amongst its members.

The group is working in response to a 2010 recommendation by the Federal Trade Commission (a part of the US federal government tasked with consumer protection).

The Tracking Protection Working Group know that if they don’t come up with something that looks like robust, enforceable self-regulation and show that the industry can govern itself then there are legislators ready to write laws to do it for them.

Right now the standards are unfinished. Support for DNT is patchy amongst browsers and virtually non-existent amongst websites. If it works at all it will take years to have any impact and in the meantime the credibility of DNT will be on a knife edge; users will have Do Not Track settings in their browsers that look useful but that will in reality do nothing most of the time. Oh and the standard is already in trouble.

It’s exactly this parlous state of affairs that concerns Wheeler, CEO and co-founder of marketing technology company 33across.

His fear, set out in a his article How ‘Do Not Track’ is poised to kill online growth, is that the W3C working group will fail and the FTC will step in and legislate instead.

He assumes that any Do Not Track law will go further than the industry-agreed standard, insisting that DNT is on by default or that nobody is ever anonymously tracked at all.

…the online advertising ecosystem now accounts for $300 billion of economic activity and 3.1 million jobs within the U.S … take away ad targeting, and the anonymous data collection that makes it possible, and the bottom drops out virtually overnight. Goodbye, relevant and effective ads, healthy rates, and healthy growth; welcome back, paywalls, jumping monkey ads, static tech growth, opt-in consent mechanisms and deep profiles tied to your personal information to replace anonymous, cookie-based behavioral advertising.

So is Wheeler right? Will the working group fail to deliver a standard and if it does will the FTC bring in suffocating privacy laws to defend consumers?

Let’s start with the working group.

Yes, it’s certainly true that their standard is in trouble. Microsoft has decided to enable Do Not Track by default in their upcoming IE10 browser, a move which directly contradicts the draft DNT standard.

Key to that notion of expression is that it MUST reflect the user’s preference, not the choice of some vendor, institution, or network-imposed mechanism outside the user’s control.

Like it or not, Microsoft’s pro-privacy stance has left IE10’s Do Not Track signals meaningless because the standard says they must be ignored.

Add into the mix the almost glacial rate of progress and the conspicuous absence of Facebook from any DNT activity or commentary and the signs are not good.

Perhaps most worryingly of all though is that there is virtually no way to tell if your DNT preferences are being honoured and no legal responsibility to honour them.

But it’s not all bad news.

Whilst it’s true that progress has been slow when has the W3C (come to think of it any standards body) not been slow. In fact slow might be exactly what’s required if there’s to be any chance of healing the rift with Microsoft.

Consider as well that Google, who might have more to lose than anyone else if they can’t track users, are still on board and that Twitter has already rolled out DNT for their tailored suggestions.

But what of the FTC? Let’s assume that the industry proves unable to regulate itself and the lawmakers step in. Should we expect the kind of  laws that Eric Wheeler anticipates whereby companies like his are prevented from collecting any user data at all?

Perhaps we should take our lead from the testimony given by the FTC themselves.

[Do Not Track] should not undermine the benefits online behavioral advertising provides consumers, including funding content and services;

[Do Not Track] should consider an option that lets consumers choose to opt out completely or to choose certain types of advertising they wish to receive or data they are willing to have collected about them;

That doesn’t read much like Wheeler’s assertion that the FTC is likely to … advocate companies stop collecting anonymous user data entirely to me.

However it doesn’t rule out his fear that the FTC will advocate that Do Not Track be on by default and there are certainly politicians with that in mind.

When Microsoft announced their decision to enable Do Not Track by default the Republican and Democratic co-chairs of the Congressional Bi-Partisan Privacy Caucus wrote to the W3C to endorse a default do not track setting.

If the Privacy Caucus got its way would it deal the tech industry a crippling blow? Or would it simply force the bits of the industry that depend on online tracking (and are governed by US law) to make a better case for why you should share what you’re doing with them?

I have no trouble believing that Amazon or Netflix, both companies that Wheeler mentions in his article, would be able to persuade their users to allow tracking. Both companies use tracking to create things (recommendations) that are of obvious value to to their users.

Nope, I’m not buying Eric Wheeler’s doom-laden future. I suspect that Naked Security’s own Paul Ducklin has a more considered vision of what the future holds.

Do Not Track is sort of like IPv6. A great idea which will eventually happen, years after some people thought the world would end if we didn’t do it within weeks, in a completely different form, and probably for completely different reasons. And at the end we’ll say the same thing as we often do. Plus ça change, plus c’est la même chose.