Web Tracking Protection: Minimum Standards and Opportunities to Innovate

March 15th, 2011

In this blog post, we discuss why Microsoft strongly supports self-regulation, how the final version of IE9 will implement the Do Not Track User Preference as a secondary method, and why we will continue to provide features well beyond the minimum standards to keep consumers in control of their safety and privacy.

Industry Complexity and Self-Regulation

Microsoft has worked diligently in the area of online privacy and Web tracking protection to propose industry solutions and to adopt the proposals of others to further the ability of industry self-regulation.

We strongly favor industry self-regulation given the complexities of online privacy and advertising. The industry diagram, below, shows some of the third parties involved when a consumer visits a Web site with advertising—including ad agencies, ad networks, ad servers, data aggregators and suppliers, ad exchanges, demand side platforms, supply side platforms, verification, and analytics companies:

Display Advertising Technology Landscape

Helping Protect Consumers from Tracking: Primary and Secondary Methods

Helping protect consumers from tracking and other online privacy issues involves both technical as well as non-technical methods. We have submitted to the W3C our technical approach to the problem, Tracking Protection, and the W3C is preparing a workshop in April to discuss next steps on Web standards work in this area.

Tracking Protection is the primary technical method in IE9 to help protect users from tracking. The final release of IE9 will also implement the broadly discussed Do Not Track User Preference (via both a DOM property and an HTTP header, as described in the W3C submission) as a secondary method.

Tracking Protection provides a way for consumers to enforce their privacy choices by blocking content that can be used for tracking. Tracking Protection helps consumers (who opt-in) without any regulatory or legislative intervention today. Consumers can choose Tracking Protection Lists from organizations and individuals they trust. You can find some examples of Tracking Protection Lists here. Greater transparency in the online industry – something that regulatory actions can encourage – can help improve Tracking Protection for consumers; when Tracking Protection List authors can more easily identify which content on a site performs tracking that is objectionable to consumers, they can more easily target that content on behalf of consumers.

Many in the industry have pointed out that the meaning of the Do Not Track User Preference is ambiguous. For example, the Wall Street Journal reported:

The Interactive Advertising Bureau, which represents online advertisers, said “there is currently no definition” of what advertisers should do when receiving the do-not-track notification. “It’s like sending a smoke signal in the middle of Manhattan; it might draw a lot of attention, but no one knows how to read the message,” said Mike Zaneis, senior vice president of the organization.

These two methods are complementary. As the meaning of the user preference becomes less ambiguous, and government works through what process and funds will be necessary to make enforcement and verification work, we will continue to work with a broad set of industry partners to bring both these proposals to completion as high-quality Web standards through the W3C process. As more and divergent proposals emerge, an established, working forum for consensus, like the W3C, becomes even more important.

It is important to note that while tracking and advertising and profiling overlap, they are not the same. A consensus definition of tracking is an important outcome of the broader industry and government discussion. Nothing about Tracking Protection or the broadly discussed Do Not Track User Preference is specific to ads or ad content.

Minimum Standards & Innovation

We believe that there is always room to do more than the minimum, and that a Do Not Track User Preference alone will not be sufficient for many consumers worldwide today.

We will continue to differentiate Internet Explorer by making available high levels of online privacy protection that consumers can control and take advantage of as they see fit.

—Dean Hachamovitch, Corporate Vice President, Internet Explorer