AP's Do-Not-Track Program Shows Challenges of Browser Privacy Tools

An Associated Press privacy initiative illustrates the challenges involved in developing a pervasive do-not-track system. Around 800 sites belonging to the AP’s News Registry will now stop tracking users who have enabled the do-not-track headers in Mozilla’s Firefox and Microsoft’s IE9. But the devil is in the details.

It’s only the AP, which enables direct audience measurement of publisher sites in its News Registry, that will disable that tracking for people using the DNT browser headers. As for the countless other third party analytics and ad tracking systems that those AP-related sites might implement, expect business as usual.

“Our policy to honor the do-not-track header does not apply to other services on the site,” said Todd Martin, VP and CTO of AP. The AP’s measurement system tracks “each time a story is read, on what site that story is read and some general information on the reader,” according to the AP site.

Also, while AP will no longer track users enabling the DNT headers in a uniquely identifiable way, other usage data – such as whether a story page has been read, still will be tracked. “When you browse and hit a site that has the News Registry services embedded, the News Registry service will not track your use as attributable to a unique user,” Martin said.

In other words, if a DNT header user visits one of AP’s associate sites, any number of cookies dropped by other analytics services, ad networks, or behavioral ad targeting firms that those sites work with will continue to track as they always have. That is, unless at some point in the future those third party tracking and targeting companies also decide to acknowledge the browser-based headers and disable tracking.

The DNT header approach has been lauded by some privacy advocates, and appears to align with the Federal Trade Commission’s suggestion that a universal tracking opt-out be browser-based. However, the limited impact of the AP’s decision to honor the headers could give pause to those who believe the approach is the most feasible one.

Most likely, unless federal legislation requires that all online data trackers acknowledge such headers, their effect will be incremental at best.

“It’s very early in the process,” said Martin. “A lot of change is to be required for this to become a comprehensive way for users to manage their privacy.”