Results 1 to 22 of 22

Thread: Anti-Online Tracking Bill

  1. #1

    Default Anti-Online Tracking Bill

    California Congresswoman Jackie Speiers introduced a bill Friday that would require online tracking firms to allow citizens to opt-out of tracking, or else face stiff fines.

    The bill, known as the Do-Not-Track-Me-Online Act, intends to let people choose a no-tracking setting in their browser and have companies obey that setting. The rules would only apply to companies whose primary business is collecting and analyzing data, and has loopholes for companies that collect data to improve their services, which would make the use of website analytics software legal.

    In December, the FTC asked browser makers to include a Do-Not-Track button in their browser and called on online advertising companies to agree to obey the settings. The setting is already available in beta builds of Firefox, and will soon be integrated into Chrome and IE, as well.

    But the legislation seems intended apply to behavioral tracking companies that track users around the web — usually without their knowledge — in order to create marketing profiles about users. That’s then used to serve targeted ads to users, which can be sold at a premium to advertisers.

    But as written, nearly anyone who has a mildly successful website — with more than 15,000 visitors per year — could face stiff fines for using even the most basic website analytics software, which generally records the IP address, browser, and operating system of a visitor’s computer.

    The proposed legislation (H.R. 264) (.pdf) does, however, exempt state, local and federal governments from having to obey the Do-Not-Track setting, and gives the FTC the authority to allow some exemptions for currently accepted business practices.

    Currently, if a company publicly agrees to obey the setting, but doesn’t, the FTC could fine the company for violating a promise to consumers.

    But with the legislation, the government would be able to force companies — and bloggers who break the 15,000 visitor mark — to obey the setting.

    The FTC has warned online advertising companies that they have one last chance to get self-regulation right, arguing that the industry has played fast and loose with customer data privacy for years, despite repeated pledges to self-regulate.

    Speiers bill also aims to require data collection entities to follow fair data collection practices:, namely giving people notice when data is collected, letting people opt-out, telling people what they do with the data, and allowing people to see the data that is collected about them.

    With a few notable exceptions, online advertising and tracking companies generally only follow one of these practices — allowing people to opt-out via the little known Network Advertising Initiative website.

    Oddly, the rules likely would not affect the profiling practices of Facebook, which is becoming the leader in online targeted ads. That’s because the company collects information from users when users are logged into their accounts, focussing on what users tell the company about themselves, rather than doing what Google’s DoubleClick ad system does — watching what people do around the web.

    Speiers, a second-term Democratic lawmaker, spent years in California’s legislature championing privacy rights for individuals.

    The bill was introduced Friday and will have to pass through committee before coming to a floor vote.
    Source

    I don't really expect much discussion of this. I didn't really have a problem with what was going on before - actual privacy concerns were usually overstated, but I don't have a problem with this legislation either. It should silence the more paranoid among us, at least.

  2. #2
    So this law mandates that companies respect a user's checkbox? They simply are trusted to obey that little button in browsers, or is there more on the technical side that I'm missing?

  3. #3
    It can be enforced against companies in the U.S. Don't see what they can do about companies outside the US though. Hmmm...does this just mean there's going to be yet another buisness type that's located offshore?

  4. #4
    Enforcement requires regulation, and the Feds have had a great record with that. Doesn't mean I don't like the ends, I just don't think the means will cut it.

  5. #5
    Let sleeping tigers lie Khendraja'aro's Avatar
    Join Date
    Jan 2010
    Location
    In the forests of the night
    Posts
    6,239
    Actually it shouldn't be too difficult. Since HTTP is a stateless protocol, for stateful requests either cookies or flash-cookies are used.

    The tracking done by normal cookies can be rendered inoperable by disabling third-party cookies. Tracking done by flash-cookies can be disabled by having Adobe build the same switches between 1st and 3rd party cookies into their plugin.

    And done we are.
    When the stars threw down their spears
    And watered heaven with their tears:
    Did he smile his work to see?
    Did he who made the lamb make thee?

  6. #6
    Quote Originally Posted by Wraith View Post
    Source

    I don't really expect much discussion of this. I didn't really have a problem with what was going on before - actual privacy concerns were usually overstated, but I don't have a problem with this legislation either. It should silence the more paranoid among us, at least.
    We all know that "delete cookies" is this button. My concern is that this won't really assuage the spectrum of people who are obsessed with this issue beyond reason. They will soon conclude it's not enough and sell that story to the media, and we'll have to deal with more horror stories about how the evil AOL cookies is following you from techcrunch to engadget and that this is a major issue of personal privacy.

    And I think the crux of it is the deliberate inclusion of analytics software. I suspect that would be next on the "target" list.

    Though I readily admit I am leaving out the issues of Flash cookies, which are perhaps operating beyond the norms we're used to when it comes to being able to clear cookie data.

  7. #7
    It wouldn't silence the paranoid ones if this doesn't address the gov't.

  8. #8
    This will be about as useful as outlawing spam. A few big catches for the press, but hardly a dent in online activity.
    Again, when it comes to the internet, educating the public is the best move.

    Google and Mozilla both recently released add-ons that take care of this.


    ------------------

    Of course, this is completely seperate of your online fingerprint that we have discussed before. Sites are able to track those without leaving anything on your machine. Once you connect those with something personal, like a facebook page, it becomes far more alarming than a opt out tracking cookie.
    "In a field where an overlooked bug could cost millions, you want people who will speak their minds, even if they’re sometimes obnoxious about it."

  9. #9
    Q: When you are shopping and use a debit or credit card, do you answer the merchants questions like Zip Code or e-mail?

    I heard on NPR that CA is going to prohibit asking for zip codes.....

  10. #10
    How can you ban collecting a zipcode with ecommerce?

  11. #11
    You can't. You need the zip code to send the product. But, you don't have to store any data past the final transaction.

  12. #12
    Wouldn't that violate other regulations that effective require you to keep records of who you're selling and shipping stuff to?

  13. #13
    Not e-commerce. In the stores themselves. Some places have programmed their swipe machine to ask Zip Code before asking for PIN or signature. Some cash registers have a command asking zip code before concluding the sale, even for cash transactions.

  14. #14
    Let sleeping tigers lie Khendraja'aro's Avatar
    Join Date
    Jan 2010
    Location
    In the forests of the night
    Posts
    6,239
    Quote Originally Posted by Ominous Gamer View Post
    This will be about as useful as outlawing spam. A few big catches for the press, but hardly a dent in online activity.
    Again, when it comes to the internet, educating the public is the best move.

    Google and Mozilla both recently released add-ons that take care of this.


    ------------------

    Of course, this is completely seperate of your online fingerprint that we have discussed before. Sites are able to track those without leaving anything on your machine. Once you connect those with something personal, like a facebook page, it becomes far more alarming than a opt out tracking cookie.
    Uh, no. Again, HTTP is a stateless protocol. This means that every request you do is independent of the requests you made before - the state of the site you're currently at is not saved, that's why it's stateless. It "forgets" what you did before.

    The only workaround is to use cookies/sessions to "remember". As soon as you disable cookies, NO sites will be able to track you. Tracking needs cookies. Everything else is exaggeration.
    When the stars threw down their spears
    And watered heaven with their tears:
    Did he smile his work to see?
    Did he who made the lamb make thee?

  15. #15
    Quote Originally Posted by Khendraja'aro View Post
    Uh, no. Again, HTTP is a stateless protocol. This means that every request you do is independent of the requests you made before - the state of the site you're currently at is not saved, that's why it's stateless. It "forgets" what you did before.

    The only workaround is to use cookies/sessions to "remember". As soon as you disable cookies, NO sites will be able to track you. Tracking needs cookies. Everything else is exaggeration.
    I'm referring to the example at https://panopticlick.eff.org/
    web sites may be able to track you, even if you limit or disable cookies.
    Which we, again, have already covered.
    "In a field where an overlooked bug could cost millions, you want people who will speak their minds, even if they’re sometimes obnoxious about it."

  16. #16
    Quote Originally Posted by Dreadnaught View Post
    How can you ban collecting a zipcode with ecommerce?
    The rules would only apply to companies whose primary business is collecting and analyzing data

  17. #17
    Let sleeping tigers lie Khendraja'aro's Avatar
    Join Date
    Jan 2010
    Location
    In the forests of the night
    Posts
    6,239
    Quote Originally Posted by Ominous Gamer View Post
    I'm referring to the example at https://panopticlick.eff.org/


    Which we, again, have already covered.
    This site makes some points - however, I don't quite believe it.

    When you enter the "Test me" page, it lists the available information. And then promptly tells me that the User Agent can be used as an identifying measure. With "1 in 16159" browsers having my User Agent string.

    Sadly enough, it's Chrome. Which includes the version number in its agent string. Which means, that this string changes upon every update of the browser - which is often. Which means that this fingerprint is rendered useless in regular intervals. Besides, 1 in 16159 would be a really small market percentage for Chrome...

    The rest, system fonts and plugin details can be easily hidden as well. Non-issue, really.

    Oh, by the way, the plugins also include version numbers. Which means that every update of a plugin will also destroy the "unique" signature.
    When the stars threw down their spears
    And watered heaven with their tears:
    Did he smile his work to see?
    Did he who made the lamb make thee?

  18. #18
    Quote Originally Posted by Khendraja'aro View Post
    This site makes some points - however, I don't quite believe it.

    When you enter the "Test me" page, it lists the available information. And then promptly tells me that the User Agent can be used as an identifying measure. With "1 in 16159" browsers having my User Agent string.

    Sadly enough, it's Chrome. Which includes the version number in its agent string. Which means, that this string changes upon every update of the browser - which is often. Which means that this fingerprint is rendered useless in regular intervals. Besides, 1 in 16159 would be a really small market percentage for Chrome...

    The rest, system fonts and plugin details can be easily hidden as well. Non-issue, really.

    Oh, by the way, the plugins also include version numbers. Which means that every update of a plugin will also destroy the "unique" signature.
    The main concern is tracking during sessions, something like this that remembers your information betweem sites, could be extremely alarming when combined with advertising rings. Following you from facebook, to reebok, to your college site, etc.

    but now I'm just repeating myself
    "In a field where an overlooked bug could cost millions, you want people who will speak their minds, even if they’re sometimes obnoxious about it."

  19. #19
    Let sleeping tigers lie Khendraja'aro's Avatar
    Join Date
    Jan 2010
    Location
    In the forests of the night
    Posts
    6,239
    Quote Originally Posted by Ominous Gamer View Post
    The main concern is tracking during sessions, something like this that remembers your information betweem sites, could be extremely alarming when combined with advertising rings. Following you from facebook, to reebok, to your college site, etc.

    but now I'm just repeating myself
    That would require that your college site exchanges data with facebook. Hard to believe.

    And again, this sort of profiling is easily disabled, my dear. I'm also repeating myself.
    When the stars threw down their spears
    And watered heaven with their tears:
    Did he smile his work to see?
    Did he who made the lamb make thee?

  20. #20
    Quote Originally Posted by Khendraja'aro View Post
    That would require that your college site exchanges data with facebook. Hard to believe.
    No, it would require they use the same ad source. Not at all hard to believe, but hey, everyone from my old college to Harvard have facebook social plugins on their site anyway.
    "In a field where an overlooked bug could cost millions, you want people who will speak their minds, even if they’re sometimes obnoxious about it."

  21. #21
    One of many reasons I refuse to "Login with Facebook". No need to connect my online data with me any more than I already do.

  22. #22
    Quote Originally Posted by GGT View Post
    Not e-commerce. In the stores themselves. Some places have programmed their swipe machine to ask Zip Code before asking for PIN or signature. Some cash registers have a command asking zip code before concluding the sale, even for cash transactions.
    Post Code is a security detail here for remote transactions, you can't normally use a card remotely without it. If the store is delivering anything to your house etc then they need it too.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •