EU chief warns against “watering down” Do Not Track

Europe’s digital tsar Neelie Kroes has launched a scathing attack on the way online commercial interests are watering down the proposed Do Not Track (DNT) standard and circumventing privacy controls.

Regulators on both sides of the Atlantic are keeping a close eye on the DNT standard proposals being negotiated through the web standards body, the W3C, with calls for a technological solution to allow users to stop cookies and other tracking tools from logging their internet activity. That data is used and traded by advertising networks to improve ad relevance.

The current debate centres on whether networks should be allowed to collect such data for “market research purposes” even if users have opted into DNT. The W3C has admitted such “compromises” may need to happen to get industry to sign onto the standard, but a report earlier this week called such a clause “a loophole to Do Not Track that you could drive a virtual truck through”.

I am increasingly concerned – about the delay, and about the turn taken by the discussions… the watering down of the standard

“Standardisation work is not going according to plan,” Kroes said. “In fact, I am increasingly concerned – about the delay, and about the turn taken by the discussions. What is the problem? Top of my list comes the watering down of the standard.

“Take the exception discussed for ‘market research’,” she added. “We need to be clearer, much clearer, about what that means, and how far it goes. Anonymisation, or privacy safeguards like retention limits, could mitigate here. But this cannot be an open-ended get-out clause.”

Another issue is how users are asked to make a choice about DNT. IE10 will have it on by default, which has some concerned that ad networks won’t consider it an active choice.

According to Kroes, browsers must make the decision clear to users. “At installation or first use, users must be informed about the importance of their DNT choice,” she said. “They must be told about any default setting, and prompted to keep or to change it. Because without that, most users aren’t making an informed choice.”

Kroes’ concerns were echoed by consumer groups, who agree that commercial interests could damage the concept.

“Do Not Track is a great idea, but could easily be meaningless,” said Jim Killock, chief executive of the Open Rights Group. “If it fails to protect our privacy, then advertising profiling companies are likely to come under renewed attack from legislators. We have seen attempts by advertisers to stall, water down and even exclude ad tracking from the new standard.”

Cookie fallout

The EU’s tough stance on the issue follows its previous directive for dealing with cookies, which suggested they should only be dropped onto a user’s PC with consent – but browser settings such as DNT were not considered to be a strong enough option at the time.

By the time the cookie control legislation actually arrived in the UK, it was significantly more industry friendly. Rather than stop using tracking cookies, many sites have opted for banners warning users that if they continue to use a site they may have cookies dropped on their machines.

Kroes tougher stance on DNT could be a second try at stricter privacy controls for online tracking.

“The DNT standard should not let websites ‘second-guess”‘ or disregard user choices… it must be designed to let people choose to not be tracked,” she added. “The clue is in the name: do NOT track.”