Image: bradleypjohnson/Flickr.

The World Wide Web Consortium is currently working to standardize a “Do Not Track” mechanism to stop advertisers from following your every move around the web. Unfortunately, while the DNT tools are already supported in most web browsers, hardly any advertisers actually honor it. In fact, some advertisers seriously proposed an exception be made to DNT to allow web tracking.

If you’re serious about online privacy you’re going to have to do more than hope that advertisers voluntarily stop tracking you, you’re going to have to actively block them.

There are several tools that make it easy to stop the tracking. One of the best, DoNotTrackPlus, was recently renamed DoNotTrackMe (DNTMe). The new name arrives alongside a major upgrade that blocks more trackers, adds some nice analytics and offers per-site tracking reports.

The DNTMe add-on is available for Chrome, IE, Firefox and Safari. You can grab a copy for your browser from Abine’s download page. Once installed you’ll see a new “cross hairs” icon in your browser’s menu bar, which you can use to access DNTMe’s settings and any blocking info about the current page.

The DoNotTrackMe add-on for Chrome. Image: Screenshot/Webmonkey

DNTMe is easy to set up and defaults to blocking nearly everything. You can customize that by going through and allowing sites you don’t mind setting cookies. For example, I generally allow analytics packages like Mint or Piwik. You can also customize tracking on a per-site basis, allowing, for example, a site you trust to run analytics packages, but not every site you visit.

I currently use Ghostery to block online tracking, and it stacks up well next to DNTMe, though DNTMe does have one feature that might be an advantage for some users — blocking suggestions. That is, DNTMe suggests not blocking certain sites if blocking them has a high probability of breaking something on the page — say, Brightcove for example, which sets tracking cookies, but without which the site’s videos won’t work.

If you don’t mind enabling sites by hand and troubleshooting any potential problems yourself then either add-on will work. But if you’re installing a tracking blocker in someone else’s browser (who may not realize why a video suddenly doesn’t work) then DNTMe might be the better choice.

Image: Footprints by Kimba Howard/Flickr

Peter Swire will now co-chair the Tracking Protection Working Group alongside Intel’s Matthias Schunter.

The Do Not Track header is a proposed web standard for browsers to tell servers that the user does not want to be tracked by advertisers.

This isn’t Swire’s first foray into the controversial waters of the Do Not Track standard. The Ohio State law professor previously testified about DNT before the U.S. Senate and has been critical of the advertising industry’s attempts to derail DNT.

“I personally would not like to have an internet where I believed that each moment of my browsing might easily be breached and shown to the entire world,” Swire testified to the Senate. He also called out the Digital Advertising Alliance’s proposed exceptions for “market research or product development,” as “so open-ended that I have not been able to discern any limits on collection under them.”

While Swire has a good track record supporting user privacy, he clearly has his work cut out for him. All the major web browsers now support Do Not Track, but some of the biggest advertisers on the web — notably Google — are not, thus far, paying any attention to users that actually broadcast a DNT signal as they browse.

Swire’s new job will be a potentially Herculean task — to get advertisers to actually comply with the DNT header. (Co-chair Schunter is in charge of the specification.) As I’ve written before, asking advertisers not to set tracking cookies is like asking Cookie Monster not to eat them.

Microsoft recently further muddied the DNT waters by shipping IE 10 with DNT effectively enabled by default. Critics argue that having DNT on by default means it’s no longer a user-controlled setting and does not comply with the intent of the standard — which is to make DNT something users explicitly opt into. The Apache web server and Yahoo have both already announced they plan to ignore DNT when it comes from IE 10.

Chrome 23′s new cookie and permissions menu. Image: Screenshot/Webmonkey

For existing users Chrome 23 will arrive via auto-update. Anyone wanting to take the latest stable release for a spin can grab a copy from Google.

Chrome 23′s new GPU-accelerated video decoding promises to use less power than previous releases — which tap your PC’s CPU to display web video — but is thus far only available with the Windows release. According to the Chrome blog, Google’s test showed that a laptop’s battery lasts 25 percent longer when watching GPU-accelerated video. So far there’s no word on when GPU video acceleration will be coming to either the Mac or Linux versions of Chrome.

Anyone who likes to micromanage their cookies will like Chrome 23′s new interface for controlling a site’s permissions. While it was always possible to manage cookies on a per-site basis, the controls for doing so were buried three levels deep in Chrome’s preferences. Now you can just click the page icon (next to the URL) and a new drop-down menu will reveal how many cookies a page has set and how many (if any) Chrome has blocked. There’s also a link to change the cookie settings, delete existing cookies and block any domains you don’t want tracking you.

The new drop-down menu also has options to control a website’s permissions for features like geolocation, pop-ups, plugins, fullscreen mode, camera/microphone access and more. There’s technically nothing new about these permissions — they’ve all been available through Chrome’s preferences page for some time — but the new user interface for accessing them is the best I’ve seen in any browser (and one I hope other browsers copy).

The new cookie control UI arrives alongside Google’s first official support for the nascent (and possibly very flawed) Do Not Track privacy header. Chrome is the last browser to add support for Do Not Track and, like every other browser except IE 10, Chrome’s Do Not Track support is disabled by default. To turn it on just head to Chrome’s preferences page, click the “Advanced” link and check the box next to the new option to “Send a ‘Do Not Track’ request with your browsing traffic.”

People who walked in snow also bought jackets, would you like a value proposition jacket? Image: rabiem22/Flickr.

Microsoft continues to take a beating for its decision to enable the Do Not Track privacy setting by default in the company’s brand-new Internet Explorer 10.

IE 10 has only been on the web for a few days (see Webmonkey’s IE 10 review), but Yahoo has already released a statement saying that the company will ignore the Do Not Track header when broadcast by IE 10 users. Yahoo is not the first to take exception to Microsoft’s decision to turn Do Not Track on by default — the Apache web server may ignore IE 10′s DNT header as well — but it’s the biggest site so far to square off against Microsoft.

This most recent squabble comes despite the fact that Microsoft and Yahoo are partners and that Yahoo has previously said it would support Do Not Track.

The Do Not Track header is a proposed web standard for browsers to tell servers that the user does not want to be tracked by advertisers. DNT is supported by all the major web browsers, but only Microsoft has elected to make DNT part of the browser’s default setup. That means that all IE 10 users will be telling advertisers to back off, which some argue is not what DNT was intended to do.

The problem for Yahoo is that it risks ignoring not just a coming web standard, but the wishes of those users who would have opted in to Do Not Track even if it were off by default. Brad Smith, Microsoft’s VP of Legal & Corporate Affairs, recently said that turning on Do Not Track “reflects what our customers want: 75 percent of the consumers we surveyed in the U.S. and Europe said they wanted DNT on by default.”

On the first count Yahoo’s jargon-laden policy announcement seems to be saying that the company believes Microsoft is violating the W3C draft of Do Not Track. “Recently, Microsoft unilaterally decided to turn on DNT in Internet Explorer 10 by default, rather than at users’ direction,” says the Yahoo Policy blog. “In our view, this degrades the experience for the majority of users and makes it hard to deliver on our value proposition to them.”

The latter statement seems to be a blanket argument against DNT existing at all — a common argument from companies that make the majority of their money from advertising — rather than anything specific about IE 10, especially given that Microsoft appears to be conforming to the current draft of the spec. I contacted Yahoo asking for clarification about the company’s position on web standards support, but the company did not respond before this story was published. [Update: Yahoo's Sara Gorman tells Webmonkey that "Yahoo does not consider the current Microsoft Internet Explorer 10 or Windows 8 install flows to represent explicit user consent with respect to Do Not Track."]

Yahoo’s complaint, along with similar complaints from Apache and others comes down to this: Is Microsoft violating the DNT spec by turning it on by default?

Here’s what the spec says: “The goal of this protocol is to allow a user to express their personal preference regarding tracking … key to that notion of expression is that it must reflect the user’s preference, not the preference of some institutional or network-imposed mechanism outside the user’s control.”

That certainly sounds like it backs up Yahoo’s decision, and puts Microsoft in the wrong. But the spec continues:

We do not specify how that preference is enabled: each implementation is responsible for determining the user experience by which this preference is enabled.

For example, a user might select a check-box in their user agent’s configuration, install a plug-in or extension that is specifically designed to add a tracking preference expression, or make a choice for privacy that then implicitly includes a tracking preference (e.g., Privacy settings: high) (emphasis mine).

For Internet Explorer 10 Microsoft’s setup dialog offers the user two choices: Express settings and Customize. Choosing the Express option clearly states that it turns on the DNT header and would appear to comply with the wording of the current spec since it gives users a choice.

The cynical might be tempted to say Yahoo and other ad companies are nervous that DNT is actually going to catch on and may well hurt their bottom line, but to be fair Yahoo isn’t alone in saying that Microsoft is violating the proposed spec. Mozilla, which originally created Do Not Track, has argued in the past that Microsoft is abusing DNT with IE 10.

In the end it might not matter. The DNT specification has become a joke. It has seriously been proposed that one of the “Permitted Uses for Third Parties and Service Providers” be “marketing.” So one of the permitted uses for Do Not Track might be to allow advertisers to track you.

If that’s not crazy enough for you consider that most online ad companies are not planning to interpret the “Do Not Track” header to mean “stop collecting data.” Instead most advertisers plan stop showing you targeted ads, but continue to collect data and track what you’re doing on the web.

If that sounds insane, well, it is. But the reality is you are being tracked and you will continue to be tracked unless you do something about it.

If you’d like to be in charge of which data is collected about you and you’d like to actually stop advertisers from tracking you, you’re going to have to do it yourself using add-ons like Ghostery or Do Not Track Plus. See our earlier post, Secure Your Browser: Add-Ons to Stop Web Tracking, for more details on how to stop tracking without worrying about who supports or doesn’t support a still unfinished, potentially heavily compromised web standards proposal.

Photo: Only Sequel/Flickr

Apache, the most common server on the web, is giving Microsoft’s Internet Explorer 10 a privacy smackdown. A newly submitted patch tells Apache to ignore IE 10′s controversial Do Not Track (DNT) settings.

The Do Not Track header is a proposed web standard for browsers to tell servers that the user does not want to be tracked by advertisers. When IE 10 is officially released, DNT will be supported by all the major web browsers (except Google Chrome), but only Microsoft has elected to turn on DNT by default. That means that all IE 10 users will be telling advertisers to back off, which some argue is not what DNT was intended to do.

The changes to Apache mean the server will ignore any DNT header sent if it’s sent by IE 10. That means IE users won’t be able to stop advertisers from tracking them around the web.

The changes to the Apache web server were written by Adobe’s Roy Fielding, one of the authors of the Do Not Track standard. Here’s Fielding’s reasoning for the patch:

The only reason DNT exists is to express a non-default option. That’s all it does. It does not protect anyone’s privacy unless the recipients believe it was set by a real human being, with a real preference for privacy over personalization.

Microsoft deliberately violates the standard. They made a big deal about announcing that very fact. Microsoft are members of the Tracking Protection working group and are fully informed of these facts. They are fully capable of requesting a change to the standard, but have chosen not to do so. The decision to set DNT by default in IE10 has nothing to do with the user’s privacy. Microsoft knows full well that the false signal will be ignored, and thus prevent their own users from having an effective option for DNT even if their users want one. You can figure out why they want that. If you have a problem with it, choose a better browser.

It sounds like a conspiracy theory, but then Microsoft’s track record on the web means conspiracy theories have a ring of truth to them. The comments on GitHub point out any number of counter conspiracy theories as well — that Apache is doing this to protect advertisers, that DNT itself will only be supported as long as it’s off by default, and so on.

The only thing that really matters is this: Is Microsoft violating the DNT spec by turning it on by default?

Here’s what the spec says: “The goal of this protocol is to allow a user to express their personal preference regarding tracking … key to that notion of expression is that it must reflect the user’s preference, not the preference of some institutional or network-imposed mechanism outside the user’s control.”

That sounds like making “on” the default setting would be a no-no, since the user would not be making a choice to turn it on. But the spec continues:

We do not specify how that preference is enabled: each implementation is responsible for determining the user experience by which this preference is enabled.

For example, a user might select a check-box in their user agent’s configuration, install a plug-in or extension that is specifically designed to add a tracking preference expression, or make a choice for privacy that then implicitly includes a tracking preference (e.g., “Privacy settings: high”) (emphasis mine).

ComputerWorld has a screenshot of what the Internet Explorer 10 setup dialogs show regarding DNT. The user has two choices: Express settings and Customize. Choosing the Express option clearly states that it turns on the DNT header and would appear to comply with the wording of the current spec.

Mozilla has argued in the past that it doesn’t. Fielding obviously feels likewise.

Our take is that the whole thing is smoke and mirrors; DNT itself is highly flawed and who supports it and how is a moot point.

Asking advertisers not to set tracking cookies is like asking Cookie Monster not to eat them. It might work for a while, but it’s not a sound long-term strategy. In fact relying on anyone else to protect your privacy is, at this stage of the web, not a sound strategy. If you really want to stop advertisers from tracking you you’re going to have to do it yourself using add-ons like Ghostery or Do Not Track Plus. See our earlier post Secure Your Browser: Add-Ons to Stop Web Tracking, for more details on how to stop tracking without worrying about DNT.

Photo: Only Sequel/Flickr

Twitter has jumped on the “Do Not Track” privacy bandwagon.

The company recently confirmed that it supports the Do Not Track header, a user privacy tool originally created by Mozilla that is in the process of becoming a web standard. That means if you visit Twitter in any web browser that supports the Do Not Track header, you can opt out of the cookies Twitter uses to gather personal information, as well as any cookies set by third-party advertisers.

Behavioral tracking, as such practices are often called, is a common on the web. Advertisers use cookies to track your clicks, watching which sites you visit, what you buy and even, in the case of mobile browsers, where you go. Often the sites tracking you are not just the sites you’ve actually visited, but third-party sites running ads on those pages.

And it’s not just advertisers tracking your movements, social networks like Facebook and Twitter also follow you around the web. You may not realize it, but Twitter has been tracking your every move for some time. The company doesn’t make a secret of it either. In a blog post announcing Twitter’s new “tailored suggestions system” Twitters Othman Laraki writes, “we receive visit information when sites have integrated Twitter buttons or widgets.”

To be clear, not only is Twitter able to set cookies any time you visit its own domain, whenever you visit a website (like this one) with a “Tweet This” or similar button Twitter can see you there as well. This practice is hardly unique to Twitter; Facebook, Google+ and others are doing the same thing.

Most of the time the information gathered is used to create a better experience for users. In the case of Twitter’s new “tailored suggestions” feature the information is used to build a profile of what you like and then Twitter makes suggestions based on that profile. You can read about exactly what Twitter does with your info and how long it keeps it in the company’s privacy policy.

The problem with such tracking is that it’s necessary for features we want, like smart, targeted suggestions — new users to follow, music you’ll likely enjoy, books you might want to read and so on — but it can also be used for decidedly less friendly purposes. As awareness of the downsides to such tracking become more well known a growing number of people are opting out of the tracking. The Mozilla Privacy blog reports that “current adoption rates of Do Not Track are 8.6 percent for desktop users of Firefox and 19 percent for Firefox Mobile users.”

To take advantage of Twitter’s new Do Not Track feature you’ll need to be using a web browser that supports the header. Currently that means Firefox, Opera 12+, Internet Explorer 9+ or Safari 5.1+. Chrome has pledged to add support for Do Not Track, but doesn’t just yet. For more information on protecting your online privacy, including tools like Ghostery, which go even further, blocking all tracking cookies, see our earlier post, Secure Your Browser: Add-Ons to Stop Web Tracking.

Photo: Only Sequel/Flickr

Behavioral advertising, as such tracking is known, is a common practice on the web. Advertisers use cookies to track your clicks, watching which sites you visit, what you buy and even, in the case of mobile browsers, where you go. Often the sites tracking you are not just the sites you’ve actually visited, but third-party sites running ads on those pages.

Much like the Do Not Call registry, the Do Not Track system offers a way to opt out of this third-party web tracking.

The Do Not Track header began life at Mozilla, but has since moved to the W3C where it was converted into a web standard by the Tracking Protection Working Group.

The Do Not Track header now works in every major desktop browser except Google Chrome, though none of them turn it on by default. Still, for privacy-concerned users savvy enough to enable Do Not Track, the header offers a quick and easy way to tell advertisers that you don’t want to be followed while you browse the web.

Numerous online advertising groups already respect the Do Not Track header and refrain from tracking users that enable it. Today’s announcement means that, starting this summer, you can add Yahoo to the list of companies that will stop tracking you if you’ve enabled Do Not Track in your web browser.

Of course, there are still many advertisers and websites that don’t yet support Do Not Track. If you’re concerned about your online privacy and don’t want to rely on the goodwill of advertisers, there are other, more aggressive steps you can take to limit how your tracked on the web. See our earlier post on browser add-ons that help stop web tracking for more details.

Photo: Vinoth Chandar/Flickr/CC

Ever wonder who’s tracking your online movements — watching the sites you visit, the links you click and the items you buy? Unless you’ve already taken active steps to stop the tracking, the answer is just about everyone.

Privacy advocates have been working to help raise awareness of the extent to which we are all tracked online. Browser makers like Mozilla have also been working to make consumers aware of what’s happening behind the scenes on the web. Mozilla created and popularized the Do Not Track header, which has now been adopted by all the major browsers. Firefox’s parent company also recently showed off its Collusion add-on as part of the TED 2012 conference.

Collusion is a Firefox add-on that helps you see exactly who is tracking your movements online. It doesn’t stop sites from tracking you, but after Collusion shows you what happens when you browse the web without any tracking protection, you’ll probably want to find something that can stop sites from tracking you.

Not all web tracking is bad. Some services rely on user data to function. For example, if you use Facebook and want to use the company’s ubiquitous Like buttons, Facebook needs to set cookies and keep track of who you are. The problem Mozilla wants to address with Collusion is the fact that most tracking happens without users’ knowledge or consent.

The screenshot below shows the number of websites Collusion found tracking me after I visited the top five most tracker-filled websites according to Privacy Score, namely The Drudge Report, El Paso Times, ReadWriteWeb, TwitPic and Merriam Webster. As a result of visiting just those five sites, according to Collusion, a total of 21 sites were made aware of my visit.

Collusion visualizes who's tracking your web browsing.

That sounds bad, and it is, but it may not even be the full picture. For comparison’s sake I loaded the same five sites and used the Do Not Track Plus add-on, which counted 47 sites with tracking bugs. Want another number? I repeated the test using the Ghostery add-on, which blocked 37 unique sites looking to track me. The variation in number of tracking elements detected is due to several factors, including what each system considers tracking. (Collusion for example, does not seem to count analytics or social buttons, while the others do.)

Even at the low end the numbers remain startling. Visiting five websites means somewhere between 21 and 47 other websites learn about your visit to those five.

If the extent of tracking bothers you there are some steps you can take to stop the tracking. The first would be to head to your browser preferences and turn off third-party cookies. Unfortunately, while that’s a step in the right direction (and you won’t lose any functionality the way you might with the rest of these solutions), some less scrupulous advertisers, including Google, have been caught circumventing this measure.

For a more complete solution you’ll need to use an add-on like Ghostery or Do Not Track Plus, both of which are available for most web browsers. The chief drawback to both of these solutions is that you may lose some functionality. To stick with the Facebook example used earlier, if Ghostery is blocking Facebook scripts then you won’t be able to use Like buttons. Fortunately both Ghostery and Do Not Track Plus allow you to customize which sites are blocked. I recommend blocking everything and then when you encounter something that isn’t working, click the Do Not Track Plus icon and edit the blocking options to allow, for example, Facebook so that Like buttons work (or Disqus so that comments work, etc.). That way you remain protected from the vast majority of invisible tracking, but can still enjoy the web services you choose to trust.

One final note about Webmonkey.com: There are 11 external scripts on this page. Four of them are for the social network buttons at the bottom of most posts. A fifth is for the Disqus comments system. There are also two analytics scripts, one from Google and one from Omniture. In addition to those seven functional scripts there are four ad network scripts from Brightcove, DoubleClick, Omniture and Lotame. (I can’t actually tell for sure what Lotame does, but it definitely collects data.) If you install the add-ons above Webmonkey will not be able to track you. If you don’t, it, like the rest of the web, will.