Analysis of Do Not Track (DNT) and Online User Privacy in BIT244

Desklib provides past papers and solved assignments for students. This report analyzes the effectiveness of 'Do Not Track' in protecting user privacy.

BIT244: IT and Business Fraud
Student Name:
Registration Number:

EXECUTIVE SUMMARY
This report will take the reader through what Do not track is and why is it important. It will
lay out when and how this was introduced and what was the need to introduce this at the first
place. It will show how the online advertising agencies track the user’s data to generate
custom and targeted advertisements. It will also tell about the laws that were framed
regarding protecting the privacy rights of the users and up to what extent they are being
followed by tech giants.

Table of Contents
EXECUTIVE SUMMARY........................................................................................................2
INTRODUCTION......................................................................................................................4
WHAT IS “DO NOT TRACK” (DNT)?...................................................................................5
HOW ADVERTISERS TRACK US.........................................................................................6
WHY DNT?...............................................................................................................................6
DNT Header field for HTTP Requests and protocols for DNT.................................................6
LAWS AND POLICIES FRAMED AROUND THIS ISSUE..................................................7
CONTROVERSIES & CONFLICTS........................................................................................7
HOW TO USE DNT / TECHNICAL IMPLEMENTATION....................................................9
PROBLEMS WITH DNT & WHY IT WAS NOT A BIG SUCCESS...................................11
CONCLUSION & ALTERNATIVE.......................................................................................12
REFERENCES.........................................................................................................................13

INTRODUCTION
With advancements and improvements in web technology, a massive number of
organizations, businesses and people are communicating. For instance, social media
applications such as Instagram allow people to connect, share and socialize while Yahoo
provides e-mail services, news and other services for entertainment. The users either pay for
these services or are either shown via advertisements. While all this communication is
established, the user plans to leave a trace regarding their information like IP addresses or
location. This personal kind of information has become one of the valuable asset as
advertising agencies use this data to create targeted advertisements or promotions. Many
people worry about how this data is actually stored and used by the agencies to generate
tailored advertisements.
Do not track for the web is something similar to the Do not call lists which block advertisers
from calling customers. The DNT service if enabled disables the websites from tracking the
user’s online behaviour which would then disable the generation of personalized web
experiences and tailored advertisements.

WHAT IS “DO NOT TRACK” (DNT)?
In 2010, the US Federal Trade Commission issued a privacy report asking the web browsers
to provide an option called “do not track” which would allow the users to disable their web
activities being monitored.
Do not track or DNT is a setting on our web browsers and phones which extends the
hypertext transfer protocol by producing a DNT request header file which has a value telling
our tracking preference. Let us see what we mean by this tracking.
Tracking: We might not even notice this tracking or behavioural targeting if we do not look
closely or pay any much heed to how websites we visit keep a track of what we are surfing
about. If we haven’t changed the settings on our browsers, each time we visit a website and
look for something we are allowing those websites to learn about us and our behaviour. Now
let’s take an example to show how behavioural targeting works.
Some days back, I searched Bing for how much food should I be giving to my dog as I
wanted to know what quantity would be the best for him. Later that day, while I was
researching about my project I noticed an odd ad at the bottom of my web page about dog
collars and chew sticks. Could it be a coincidence? Maybe, maybe not.
This is the most common cookie-based browser tracking, I searched for some terms on Bing
and Bing is also responsible for running advertising on its audience. It swiftly pushes the
audience towards the same terms they searched for or terms related to the things they
searched for by showing them advertisements about the same. Another kind of tracking also
runs within these websites which tracks how the user arrived at the webpage. They track the
user as they click images, links and hyperlinks to finally arrive at a webpage; this gives the
site owners and the advertising agencies information about the flow of traffic which in turn is
used to produce specific and targeted advertisements. This also helps them to measure the
effectiveness of the ads they produce or to generate a profile that used to create personalized
ads. (Stockley, 2019)

HOW ADVERTISERS TRACK US
At the lowest level, it is not difficult to understand. Our browser accepts a cookie which is
nothing but a chunk of data sent by the website and stored on the user’s system, this cookie
may store our preferences, login information, sites we visit etc. Like these cookies, there are
third party cookies which are produced by the ad suppliers which do not know anything about
us, but over time create a web profile of our behaviour over the web and use these profiles to
guess what we might be interested in buying.
This is the part where DNT steps in, when we choose to enable the DNT service on our
browsers, we actually are telling websites, ad companies and plug-in providers to stop
tracking our activity.
WHY DNT?
International laws are getting strict regarding privacy protections for consumers and
governments are concerned about how user’s data is collected and used by organizations.
Online behavioural data can be used for theft and misuse of information which can create
significant problems and this is the reason why jurisdictions all over the globe are concerned.
DNT is a way which would provide the users with a choice on whether they want to share
their personal data which would keep the data sharing to a minimum if enabled and prevent
the misuse and theft of information.
Back in 2003, CalOPPA was introduced as the first US law to have imposed protocols for
generation of and adherence to privacy policies for online businesses. These laws are
applicable to all websites which collect data during browsing sessions. CalOPPA requires
websites to tell customers about how their data is being collected and how this data will be
used by third parties which would further use this information. (Melicher et.al, 2016)
DNT Header field for HTTP Requests and protocols for DNT
The DNT header field is a mechanism which expresses the tracking preference of a user in an
HTTP request. Only one DNT header file is allowed to be present in a valid request.
DNT-field-name = "DNT"
DNT-field-value = ( "0" / "1" ) *DNT-extension

It is mandatory for the browsers to provide the users with at least two alternatives for DNT
preference i.e. unset or DNT:1. They can provide them with other alternatives as well such as
DNT:0.
The user’s preference for tracking is expressed as-
DNT Meaning
0 Preference set for tracking allowed for the
target site
1 Preference set for tracking disabled on the
target site
By default, a proxy or a browser should not be sending preferences for users if it has not been
set by them. That means the default tracking preference should be unset if it has not explicitly
been set by users and the services of HTTP not under the control of users should not be
adding or modifying the tracking preference. These protocols are also valid for the HTTP
intermediaries such as the Internet service providers. (PrivacyPolicies, 2019)
LAWS AND POLICIES FRAMED AROUND THIS ISSUE
A number of bills and drafts were framed around this issue in 2011 and 2012, a few of them
are:
 "Do Not Track Me Online Act of 2011" by Rep. Jackie Speier
 "California Senate Bill 761" by Sen. Alan Lowenthal
 "Consumer Privacy Protection Act of 2011" by Rep. Stearns and Rep. Matheson
 "A new Commercial Privacy Bill of Rights" by Sen. John Kerry and Sen. John
McCain
 "Do Not Track Online Act of 2011" by Sen. Jay Rockefeller
 "Do Not Track Kids Act of 2011" by Rep. Ed Markey
CONTROVERSIES & CONFLICTS
When the US Federal Trade Commission issued the privacy report, conflicting thoughts arose
between the users and the advertising agencies. The users wanted better privacy controls
while the analytics organisations and advertisers were willing to generate more ways to fetch

data from online users. The web browser companies had to establish individual policies in
context to do not track controls (Hoofnagle, Urban and Li, 2012).
MICROSOFT IE10: Using the “Express” settings for installation of IE10, the DNT option
is enabled and this was the reason Microsoft had to face criticism from the advertising
agencies as this setting deprived them of their business in a way. They said that the DNT
feature must be an option for the users to choose and should not be enabled by default. They
also claimed that this decision of Microsoft violates the Digital Advertising Alliance’s
agreement with US government to honour a DNT system as it was said in the collation that it
would honour a system only if was not enabled by default by web browsers. Microsoft,
however, responded by saying that the users would want their privacy to be respected and
that is why the DNT setting was enabled by default.
WINDOWS 8: As Windows 8 were released in 2012, Microsoft set the default value of DNT
to “on” and allowed users to turn this off with the provided tools. It created a controversy as
this put the advertisers at a disadvantage. In 2015, when Windows 10 was released, Microsoft
issued an online statement explaining that it will continue to protect the personal information
of its users and made clear that it will provide tools for the users to have better control about
their information and online behaviour.
It seems genuine to set DNT to “enabled” by default as it safeguards the rights to privacy and
protects the user from sending their personal data to online advertisers, however, the users
with these settings turned on were beginning to miss out on features and benefits that they
would get with settings which would allow their data to be collected. Personalised browsing
experience, customised ads and web experience were some of the features that they were
missing out on (Tene and Polenetsky, 2012).
HOW TO USE DNT / TECHNICAL IMPLEMENTATION
MICROSOFT: As Microsoft was facing issues because of their default off DNT setting,
they looked for alternative solutions to meet their requirements while keeping the advertising
agencies happy. They introduced features which would allow websites to send requests
asking the users if they want to disable or enable DNT for their session in the form of popups.
This allowed the default setting to stay in place while allowing the users to turn DNT off in
case they wanted a personalized web experience.

Figure 1: Microsoft's information on Do Not Track
MOZILLA FIREFOX: The DNT settings in for Mozilla Firefox are opposite to that of
Microsoft. The default settings for DNT are set to “off” and firefox provide a set of
instructions for turning them on.
To change the DNT settings in Firefox:
 Choose options from the menu tab.
 To find the tracking protection section, click on the Privacy and security panel
 Below Send websites a “Do not track” signal that you won’t be tracked, choose the
Always setting.
Figure 2: Firefox's settings to turn DNT on
GOOGLE CHROME & ANDROID: The protocol for DNT on chrome and Android is
almost the same. To enable DNT service on chrome,
 Click the three dots and navigate to the settings panel.

 Find advanced settings at the bottom and under the “Privacy” section check or
uncheck Send a “Do not track” request with your browsing traffic.
Figure 3: DNT settings on chrome
SAFARI: Find the preferences option under which head on to privacy and check the “Ask
website not to track me” box.
TWITTER: Twitter supports DNT, however, the users may want to opt out of some other
things as well which can be found under the account settings page. Uncheck the boxes saying
“Tailor Twitter based on my recent website visits,” & “Tailor ads based on information
shared by ad partners.” (Lifehacker.com, 2019)
We might not be able to completely get rid of websites trying to track us but implementing
the above steps may help to keep the data collection to a minimum and if someone likes
tailor-made ads and experiences, it is better not to turn do not track on (Fairfield, 2011).
PROBLEMS WITH DNT & WHY IT WAS NOT A BIG SUCCESS
 Without any surprise, Do not track does not do as much as it should and is not
something which changes how the users are behaving online. This does not mean

nothing at all is happening, it’s just that it is so slow, that it is hard to tell the
difference. It has not completely failed but we cannot say that it was a huge success.
 Due to the pressure from the US and European legislators, tech giants like Microsoft,
Google, Mozilla had to frame guidelines on how their browsers would communicate
to a server telling them not to track the user’s information. Instead what actually
happened was that all the companies were stuck in some kinds of disagreements and
did their own thing rather than doing something which was the same across all
browsers.
 Most of these tech giants including Yahoo and Twitter initially agreed and said that
they would respect it, but later on, abandoned. Others such as Google and Facebook
never paid much heed to it in the first place. Facebook says it doesn’t support DNT
instead it provides multiple ways for people to control how we use their data for
advertising which is not completely true as the users themselves do not have access to
the data being collected. (W3.org, 2019)
 The governments have refused to step in and provide any legal authorities in the
context of DNT. If a telemarketer ignores a Do not call list, they may be liable to pay
a huge sum as a penalty while there is no penalty for ignoring a Do Not Track request.
 Although in 2010, the US government and W3C web technical standards organization
designed the DNT:1 signal to address tracking concerns, it was never fully
implemented or a globally adopted standard due to online advertisers posing issues
regarding this service (Moaddab, Haghparast and Hassanpour-Ezatti, 2009).

CONCLUSION & ALTERNATIVE
By the end of the research for this report, we learnt that it is not completely possible to
disable tracking of our data online however proper steps can be taken to keep the data sharing
to a minimum. All the modern browsers come with incognito modes or private browsing
modes which enable DNT service by default. We can also install powerful plugins such as no
script and ghostery to stop sharing our online behaviour with advertising agencies. However,
reports show that the DNT policies are not respected by all and enabling or disabling it does
not make much of a difference and even if there is some difference, it is so slow that we
might not even notice it and for those who like personalized web browsing experiences, it
won’t hurt to keep DNT service off.