Comment by clarkevans | Hacker News Reader

Comment by clarkevans | Hacker News Reader

Mozilla uses Google Analytics Premium Service ($150k/year) which includes a contractual option to prevent secondary use of the visitor data. Therefore, they see it as legally in the spirit of Do-Not-Track -- Google is a contractor collecting the visitation data solely for the pleasure of Mozilla.

https://bugzilla.mozilla.org/show_bug.cgi?id=858839#c21 https://groups.google.com/forum/?hl=en&fromgroups=#!search/m...

From the latter thread, Stacy Martin at Mozilla represents "Google Analytics will not correlate or report on any customer data with any other data, they will use Mozilla data only to provide and maintain the service for Mozilla, and they will not share or use it for any other purpose."

EDIT: The contractual arrangement is relevant. Section 9.3 item 2 of the IETF do-not-track draft draws has an exception for this very situation, "data obtained by a third party exclusively on behalf of and for the use of a first party".

http://tools.ietf.org/html/draft-mayer-do-not-track-00#secti...

See comment 16.

The bug report is not about the legal contractual agreement between Google and Mozilla, but rather about user expectation from a "do not track me" option. Some users, maybe faulty or silly, consider a "do not track me" option to simply mean, do not track me.

It doesn't mater if Google sign a service contract that Mozilla pays $150k/year. "Do not track me" means, do not track me. It doesn't matter if Google promise to not be evil. Do not track me still means, do not send tracking data to Google. It doesn't even matter how extremely useful or good intention Mozilla or Google has with the tracking data. "Do not track me" really do mean, do not track me.

Something to consider. In Firefox, the DNT options have a Learn More link that answers the question:

"Do Not Track is a feature in Firefox that allows you to let a website know you would like to opt-out of third-party tracking for purposes including behavioral advertising. It does this by transmitting a Do Not Track HTTP header every time your data is requested from the Web."

While you can debate whether that's the appropriate place for that information, it's not as if Mozilla is hiding this information. It's easily reached, and not at all intentionally hidden away. Nothing devious. Just a question of how to appropriately display the information.

A very good point, as I never clicked on their help site. Thank you.

It's interesting that the summery text on their Do Not Track FAQ has zero mentioning that tracking is redefined as "third-party tracking", but the FAQ question "What is Do Not Track" does. The summery is more in line with common expectation of the word tracking, while the FAQ question is more in line with the definition scope found in the standard.

An easy fix, would be to add "third-party" next to the word tracking in the option menu.

Then rather than call it "Do not track," it should be called something like "Do not allow third party tracking."

When in doubt about naming something, name it what it is.

The problem is, DNT isn't just a Firefox thing, but something that the industry is attempting to adopt. So, DNT as a whole means something specific. It's a shame that there is that disconnect, but it's not a Mozilla specific problem.

Safari says even less about DNT (Ask websites not to track me) and the help isn't much better, though they have a separate section for blocking 3rd party cookies. But that's different from DNT.

This is a case where DNT as an industry standard means one thing to the industry, and one thing to the uneducated public. Damned if they do, damned if they don't.

Should a distinction be made between "Do not track me" and "Do not track anonymous/aggregate user's paths".

Serious question. I think that's what's being suggested here?

The language used is an important part when determining user expectations. its like the old "free phone" advertisement, but which wrote in tiny print in the service contract a monthly fee. That practice is now mostly banned as false advertisement, and good riddance as "free" has a clear definition.

So yes, I think there is a clear distinction between "do not track me" and one that is limited to any specific tracking techniques.

These obligations are meaningless unless there is a way to verify compliance.

This has shades of a comparison between security by architecture vs security by agreement/trust:

https://groups.google.com/d/msg/mozilla.governance/tMt7-amcK...

Real people are not reading the RFC.

Reply on news.ycombinator.com