If the user installs a privacy-focused browser (NB: not sure if such things exist, marketing aside), one could argue that there is still user choice involved even though the browser sets DNT by default.

The original Internet Explorer situation was different because it came pre-installed with the operating system, and whether there is choice in operating systems for any given piece of consumer hardware is often rather dubious today (and was probably “no” in more cases back then).

> If the user installs a privacy-focused browser (NB: not sure if such things exist, marketing aside), one could argue that there is still user choice involved even though the browser sets DNT by default.

it doesn't need to be argued as the fact that the user did not disable the DNT option in such a browser is the action that matters.

Courts are not necessarily bound by such a spec, but it doesn't look as if that question was addressed here and in my view it would have to be established by another case because for sure the companies that ignore do not track right now will be more than happy to pretend that they have an excuse to continue to do so. This is a long drawn out rearguard fight.

> The spec itself (at the time, at least) said that it could be ignored if the header was always sent/not user-enabled.

Why?

IIRC the people who wrote the spec did it in co-operation with the larger ad networks and this was the only way they could get the ad networks to comply with it.

Then Microsoft enabled it by default in Explorer 10 and the ad networks took it as carte blanche to ignore the DNT header forever, claiming Microsoft had violated the agreement. Nowadays it's usually not set even by the overly privacy conscious out of fingerprinting concerns, since its another unique way to identify your traffic.

What didn't help was that the EFF was actively campaigning against it instead of lobbying to elevate the flag to legal status so it would become useful.

The same way they campaigned against adblockers but had their own petty little voluntary pledge thing.

That's what you get when your NGO gets so big your leaders end up playing on the same golf courses and waiting in the same netjets lounges as the enemy.

I have absolutely never set it because of how many bits of information it is in terms of fingerprinting me. Might as well send a header with half my SSN up along with it.

I suspect it was just the conservative choice, mirroring the behavior of the predecessor browser extension (which also required deliberate user action to activate): http://paranoia.dubfire.net/2011/01/history-of-do-not-track-...

I couldn't find any explicit discussion of that aspect of the spec (https://datatracker.ietf.org/doc/html/draft-mayer-do-not-tra... is an early version), but I suspect that as noirscape wrote, it made consensus-building easier. Not that it mattered in the end, of course.

Spec largely doesn't matter for what the courts think; DNT is considered by them to be a valid signal for not wanting to be tracked in the eyes of the court according to the ruling. (note: I am not a lawyer.)

You could argue that by using a browser where the DNT header is set by default, they are making that decision on their privacy by y'know, using those browsers over the ones where they're not set by default. Ad companies don't want that argument, they want you to opt out in every browser (and ideally they'd just ignore the header entirely, which they do after Microsoft enabled it by default in Explorer).

Discussing defaults is only a distraction. Browsers are, in their own words, a "user agent" and their requests are the user's requests.

If this were true, then wouldn't your browser sending out personal data constitute consent to have that data tracked? After all, the website asks you to give them the data and the browser complies.

The browser sending data doesn’t authorize the server to store it for tracking purposes.

To be fair, Chrome is basically doing everything it can to stop being the users agent and is instead Googles fun magic box you use to see what goes on on the internet (with the explicit long-term goal for Chrome to just be Googles freely downloadable OS overlaid onto your Windows/Mac/Linux, given how many system APIs Google keeps dumping into the browser).

I don't blame people for forgetting that part sometimes, given how 90% of the population uses a browser that doesn't serve their interests.

> The spec itself (at the time, at least) said that it could be ignored if the header was always sent/not user-enabled.

How would that work? Has the server a mechanism to check if DNT was set by default on the client/browser?

No, the idea was exactly do prevent browsers from enabling DNT as the default. The spec would expect the server to check the User Agent and ignore the DNT header entirely if it comes from a user agent which is known to default it to true.

Obviously, this was a ploy to gut the standard while still pretending to self-regulate.

>Would this include browsers which have the DNT header enabled by default

It's EU - the default is to require consent for using personal data (which in at least few of the jurisdictions IPs are included). The the 'default' should be out.

and what you do if the user gives consent and still send the DNT header?

You either have consent or you do not. Mixed signals do not permit you to err to your benefit.

EU courts have already ruled that "cookie banners" that are too-confusing aren't considered consent.

the latest date consent given (or taken away) takes precedence, consent requires an clear&affirmative action, so if that part can be recorded - do as you please.

I guess the person above you means what if someone clicks "accept" on the cookie banner but also has DNT turned on.

To which I'd say: they shouldn't even see the cookie banner in that case. DNT alone is enough.

Yup. If I'm going around my daily business wearing a shirt that says, "no sex for me, please!" Then please do not come up to me and say, "but, would you like to have sex with me?"

And if I say "yes, actually, even though it was very rude of you to ask, given the shirt that I am wearing...in fact, I would like to have sex with you," then you should at least have the decency to wait for me to take my shirt off before having sex with me.

If I decide it's really not worth the effort to take the shirt off, then it turns out, actually, no, I really did not want the sex after all.

This is the best analogy I've heard in a while, thank you.

Would be irrelevant, because the DNT-header will be sent with every request, so for all practical purposes will be later than any other kind of consent.

There can be a case where the end user (person), logs on the site - then sets a permission/consent to be 'tracked' (whatever), then a cookie/localstore persists - so the DNT is not relevant.

Consent/tracking doesn't mean solely 'cookie' banners.

No. Ambiguous consent is no consent. And continuing to send DNT is ambiguous, because the tracker can not distinguish between intent and accident.

Does it become harder to figure out when your salary depends on not understanding it or something?

I guess it is. This conversation reminds me of the classic Tea Consent video, explaining the concept of consensual sex: https://www.youtube.com/watch?v=oQbei5JGiT8

On the other hand, I recall a discussion about how GDPR requires active and informed consent, and how a blanket refusal would not be in line with the regulation.

Quoting the (Google Translated) article:

> According to the General Data Protection Regulation, the right to object to the processing of personal data can also be exercised using automated procedures. A DNT signal represents an effective contradiction.

I assume automated procedures include default settings. Not a lawyer and not from the EU though

Not a lawyer, but basically the website cannot distinguish whether a DNT setting was enabled by default or whether the user intended to set it so it really does not matter. It must be assumed that the user enabled the DNT setting.

Let's assume Aunt Agatha reads about the DNT setting in one of her magazines, goes to the browser settings, sees that it's enabled, takes no further action. That is no different from Uncle Ulysses who has a different browser with a DNT-disabled default who goes to the settings and enables its.

My letterbox has a sticker on it that I don't want to receive unsolicited ads. I don't need anyone to try to presume that it wasn't me who put that sticker onto my letterbox.

It gets better than that. Once, I've seen / caught in the act / one ads-distributee who damaged the sticker on my box' lid. He was scratching it with a key. Then, suddenly vanished after seeing me.

After that, I got ads put into my box again. Once I asked one distributee if he can't see the sticker.. "it's damaged. So I thought you wanted to remove that, but it made problems so yo left it striken through"

I have trouble believing that's real. Why would these workers bother?

If you are paid by ad distributed wouldn’t you want to try to maximize the number of ads delivered in to the same apartment building?

Not through vandalism and scammyness, but maybe that's why I don't work in advertising.

The same reason we put 2-3 of them in the same letterbox or we trashed some packs at the end of a street (yeah I did that back in the '90s as a teenager). To work less and earn the same.

I mean at that point you could just put the entire stack in the nearest recycle bin and call it a day. Much more efficient! Much less of an annoyance to people.

But that would be easily discovered. It had to be "good enough".

I have no idea why they bother but the sticker on my post box and those of some neighbors were removed the third time now in the last 2 years. I know that they didn't remove them themselves because I talked with them and gave them new stickers. The kids in the house are either too small or to old to remove them so I can only assume it's the people distributing flyers. It sure is not the postman, he actually wrote a note asking everyone to put up those stickers because he didn't want to carry stuff that ends up in the trash anyway.

I've had door to door solicitors argue with me, after I pointed to my quite prominent "no soliciting" sign, that they weren't really "soliciting" but, rather, "marketing" and therefore the sign didn't apply to them.

¯\_(ツ)_/¯

This is fascinating. We have no such system in the US as far as I am aware. First, I think it’s against the law for anyone other than postal employees to put stuff in mailboxes. So we get flyers shoved under doors, in cracks around letterboxes, etc. Second, no one would respect those stickers. And third, because our postal service has to be self-sustaining and legit mail has declined, the only mail you get these days is advertisements.

I don't remember the beginnings of such stickers, but it had something to do with the litter produced by the unwanted mail. We have to pay for our litter here. And no one wants to pay for others :)

Just like the same reason for you can get fined for throwing away litter. If it's not your litter box.. :)

I wish that the free willy said "I don't want" is binding for all people over the world.

Sounds like it's epoxy time.

But the website can perfectly reliably determine whether the browser's vendor string matches a browser version that has DNT enabled by default.

You've missed the point. Knowing the browser sets it by default says nothing about whether the user consciously decided to keep it that way, so claiming that it's just the browser default and therefore to be ignored was always just wordplay.

True. I probably misread the first sentence completely. My bad.

> Not a lawyer, but basically the website cannot distinguish whether a DNT setting was enabled by default or whether the user intended to set it so it really does not matter. It must be assumed that the user enabled the DNT setting.

In Firefox you can't even turn it off, except maybe via some about:config thingy, so that's not really an entirely valid assumption.

Of course you can turn it off. Edit -> Settings -> search for "track" -> select "Only when Firefox is set to block known trackers". Job done.

Yes exactly, you can't turn it off.

Why cannot we expect people wanting to tracking to be smart enough and go disable it? Sounds even more reasonable way to think about it.

GDPR specifies tracking to be necessarily default-off and opt-in anyways. Therefore the browser sending DNT:1 by default would just repeat the legal status quo. A tracker could not successfully argue that this is to be ignored, because the technical default that the browser sends is the legal default anyways.

letzt assume i install TailsOS. just because it's privacy by default it does not mean it was not my choice!

The choice just happens on a other level.

Of course it should. In europe tracking is supposed to be Opt-In so enabling by default is exactly how it should work.