An Update on Microsoft’s Approach to Do Not Track

The actual positive form of the question, ignoring the politics and just thinking about user intent, would be something like "Do you want this computer to serve a unique fingerprint to websites, allowing companies to both reconstruct your identity between sites on their network, or to persist your identity after you have purged cookies and other session data? Companies tend to use this tracking ability to enhance your advertising experience, to collect statistics on the usage of their sites, and to ensure they don't double-count you. Malicious uses of this data are also possible, though currently rare."

The important bit of the question, when phrased this way, is that it doesn't just ask about a mechanism (the DNT header), but about the user's intent—and because of that, it's activation state could be made to control all sorts of things besides the DNT header. For example, saying "no" to the question should cause the browser to try to add some per-domain jitter to its answers to questions about what links are visited, what fonts are installed, what the User-Agent string is, etc., so that the browser can't be fingerprinted.

Advertisers don't need a case. They don't need to ever care about this bit.

Most advertisers that I read about who were also vocal against DNT said they would not honor it before Microsoft even made it a default. Quit kidding yourself that Microsoft's decision did anything but hasten its irrelevance.

>DNT is not a technology that will automatically restrict people from tracking you like adBlock for instance.

But turning the browser-side setting into that? Now there's an idea.

I think one of the reasons robots.txt is generally respected is that there's a stick behind that carrot; hypothetically (what with us all using so much cloud these days), a site administrator that noticed a traffic spike commensurate with something ignoring robots.txt can respond by treating the requests as attacker-originated, which most "legitimate" sites would want to avoid.

What's the stick behind the carrot for do not track?

I disagree. robots.txt is almost always used for hiding pages that shouldn't be exposed to the internet and are useless to expose. For example you don't need a robots.txt crawling the html document you're statically serving to prove domain ownership for Google Apps.

Everyone wants the most views on their content as possible so the incentive is to let as many things as possible be indexed therefore using robots.txt is limited as much as possible. It would not be good for search engines to crawl the things put into robots.txt.

But more importantly, this isn't a binary flag. People might want to be tracked, they might want not to be tracked, or — most likely in my opinion — they might not give two hoots. Similarly, when people walk into an physical place, they might want to be looked at, they might not want to be looked at, or they might not be particularly concerned with whether anyone in particular is looking at them.