Whatever technical standard the W3C process produces, the arguing is unlikely to end. As Carnegie Mellon’s Cranor points out, although the W3C can specify how websites communicate, it’s not going to tell companies exactly how to present Do Not Track information to users. Microsoft showed how critical that issue could become when it announced it planned to ship the next version of its Internet Explorer browser with Do Not Track switched on by default.
The move provoked an outcry among advertisers, who complained that Microsoft broke a consensus among W3C members to let users freely choose whether to be tracked or not. Most users, advertisers fear, would never adjust the default setting. And since Microsoft has more than 25 percent of the browser market, that could mean half a billion users saying no to targeted ads. “The ad companies could have a valid concern that people were opting out without understanding what they are doing,” says Cranor.
Microsoft’s decision also shows the complexity of the business strategies at stake in the W3C deliberations. Although Microsoft is involved with online tracking of users for advertising, it also has much to gain by increasing the popularity of Internet Explorer, and might even find ways to insulate its own ad business from W3C controls.
Jeff Chester, who heads a privacy activist group called the Center for Digital Democracy and is one of the working group’s most vocal opponents of online ads, believes that industry has little to fear from the W3C. In fact, he says, companies may wield undue influence already. Google, Yahoo, and Microsoft all have representatives on the W3C, and they are also paying members of ad industry groups like the IAB.
“The online ad industry built a far-reaching global system of commercial surveillance, [and] the W3C process is largely dominated by online marketing companies,” says Chester. He predicts that whatever the final standard says, new tracking techniques will probably spring up that evade it.
Indeed, one point of consensus is that the largest Web companies have less to fear from Do Not Track than small ad networks and publishers. The working group has already agreed that activating a Do Not Track signal would not prevent companies like Microsoft, Google, or Facebook from tracking and targeting users within their own vast websites.
“Larger entities with a consumer presence will be able to manage,” predicts Marc Groman, head of the Network Advertising Initiative. “There’s a long tail of small publishers—and ad networks that serve them—who are concerned they will be disproportionately affected.” He says blocking such tracking will make it more difficult for smaller companies to pay for free Web content.
Others believe that the debate at the W3C could be overshadowing more serious privacy questions. “Users are moving to tablets and mobiles and apps that have no way to deal with Do Not Track,” says Jules Polonetsky, director of the Future of Privacy Forum and a member of the W3C working group. Major regulatory questions also surround the immense stores of personal data that are being accumulated by social networks.
“We’re squabbling over default browser settings,” Polonetsky says, “and it has swallowed up all other privacy issues.”