User tracking only exists because it generates money. We should ban the entire practice. No more targeted ads (with very little exceptions).

how you can ban the practice??? in what way ?

You ban it by making it illegal.

how can you make it illegal??

>make a new law

>they just move elsewhere

how??? tell me

The EU was pretty successful with mandating cookie banners and GDPR.

On the other hand, I think a great firewall would be useful to the US and especially the EU, to be able to enforce their laws even better.

"mandating cookie banners and GDPR."

this is only works if your business located in EU, no one stop EU people visit US site and still get tracked

I'm not pretty sure about that. I get cookie banners from US companies all the time and choose to reject them.

Just visited www.vmware.com. Site is located in the US. Company is located in USA, and OneTrust's cookie banner welcomed me, and allows me to make choices.

VMware wants to sell to European clients. If they didn’t they wouldn’t have cookie banners.

Basically, if you have any tracking on your site, you either

a) Show the cookie banners if somebody is coming from a GPDR or GDPR-compliant country, since it's required by EU law and these GPDR-compliant laws.

b) You geofence your site and prevent access.

So, in practice regardless you whether sell anything or not, if your site, proverbially, touches European soil, you have to show these choices.

What’s the EU going to do to you if you don’t have operations in the EU?

That's option c, ignore EU law and forever give up the possibility of doing business there. The larger a company is the less likely it is to find that route palatable.

Why would the EU fine you for something you did before you had operations in the EU? I don’t think it works that way.

If you are taking EU citizens' data when they access your website from within the EU, then of course the EU will prosecute you for that.

Just like they will prosecute you for scamming EU citizens, for hacking EU citizens, for impersonating EU citizens, and anything else you can do to EU citizens while being located somewhere else.

Because they explicitly worded the law to threaten exactly that. It's the exact same thing the US does with the financial system. They intentionally claim extraterritorial jurisdiction; it is doubtful you would want to try calling that as a bluff.

If you market your services to EU residents, the EU will hold you subject to the GDPR (and many other EU Regulations) irrespective of your location.

You just tell Congress that the data brokers have all the rights to sell our data to Chinese data brokers. Maybe that will change their mind.

Is tiktok still up and running?

yeah.. with any frontier or frontier tech it's the same story.. the folks that made it to the frontier.. they make all the calls.. they establish all the rules.. they do all the abusive things they want cus...

we plebs, who buy their frontier stuff?, just don't know any better.. and then one day, after living in the frontier/futureland sufficiently, it clicks, we recognize we are being had..

then we organize, we get politicians to fight back the tide of abuse..

and it's our time to correct things, make the abuse illegal..

good luck fellow plebs..

knowing how the system is rigged in so many dimensions, i don't have much hope..

but we can dream right?

In the US maybe, in the EU it's a different story.

Rolling through stop signs is illegal, but people do it all the time without penalty. It's not enough to simply make something illegal. You also have to have groups empowered to enforce the law and dole out punishments heavy enough to act as a deterrent.

You picked an example at the extreme end, so let me choose another example at the opposite end. Breaking into people's homes and taking their stuff is illegal. It would happen a lot more if there were no laws against it.

You've completely missed the point. I'll break it down.

When you break a law, it doesn't magically summon an LEO and judge to catch you in the act and give you the proper penalty, so words in a code is not a deterrent. The deterrent is knowing someone will hunt you down, getting thrown in jail, it's fines that hurt your bottom line.

Yes, our society places a premium on policing break ins very harshly. Police have huge budgets for street crime & judges have harsh penalties available to them. White collar crime, like financial crime or breaking what little privacy protections is on the books? Not so much... So, again, you can't just make a law. You also have to have groups empowered to enforce the law and dole out punishments heavy enough to act as a deterrent.

So you are saying we should not have laws because who is going to enforce them?

No.

Ok, let's make this law and enforce it then.

That could be remedied by installing cameras with AI on the edge, coupled with autonomous RPGs, or drones starting and dropping a fragmentation grenade on the offender.

This boils down to difficulty of enforcement. Enforcing the law regarding stop signs is very difficult because it's hard to detect all the violations at scale. Tracking, though, is much easier to detect even automatically by its very nature.

Tracking arguably isn't much of an issue until data sale and aggregation gets involved. That requires a functioning marketplace which tends to leave a lot of evidence behind.

The hyperscalers are a notable exception to that but the larger a company is the more likely systemic illegal practices are to get exposed.

Then something else will replace it. To make the same amount of money.

You mean old timey wimey marketing pre-internet? Just target people instead of Bob at 17th Rosewood St.

How about this, I set a preference for some stuff I am interested in and that’s what they can show me.

They don’t track Bob at 17th Rosewood St. They put him into groups of things they think he is likely to buy. Which is close to targeting people.

Multiple groups. And if you take the intersection of those groups you end up on 17th Rosewood St.

Could we make that thing perhaps Being Very Nice?

Ok,what about all browsers should play John Lennon's Imagine on loop?

> User tracking only exists because it generates money.

3-letter-agencies.gif

Ironically these agencies buy user information from third parties because it cost less and is legal.

How is the MAC collected?

MAC is easily spoofed, most smartphones do it already by default - although only per session

The WLAN AP collects that. They really track you (they being the AP and Google).

You may assume that they collude, or not.

It isn't, parent is making stuff up. Browsers do not offer an interface that is exposing that information.

And remote servers are outside of your local network and thus cannot see these values, either.

That's true for browsers, but Google controls both the Android OS and Google Play Services, giving them access to hardware identifiers on Android smartphones. Given the broad adoption of Android devices and the potential to correlate data, this is not a case of "making stuff up." Even if your MAC address is spoofed/randomized, the remaining data points are still sufficient to track you.

Doesn't make sense to track and correlate the mutable MAC address when you have access to the burnt-in device serial number and IMEI.

Depending on your network configuration I could imagine abuse of EDNS(0). This is used for example by NextDNS to identify which device (MAC) on your local network sent the request in order to apply specific filters and log the request. A not-so-friendly DNS could sell such information.

I use dnscrypt with a supposedly secure configuration, is that not enough to counteract this?

Ask your friendly local CIA agent, not us. We don't have access to that intel.

How do you know? Someone might!

To me just posting this long list is spreading FUD.

It mixes voluntary user actions, like submitting forms and “query parameters”, with things like “WebGL fingerprint” which we agree is evil sneaky fingerprinting.

I agree tracking is a serious problem, but this list isn’t contributing to any discussion.

People complain about google logging their search queries when they are in "incognito mode" and logged into their google account - we need a lot more education.

What I would like is effective solutions against most fingerprinting.

Tor Browser?

Besides that? I want more (if they exist). :P

Whonix (which still relies on Tor Browser).

Tails and Qube OS, for example

Query parameters are hardly voluntary, just about every linked acquired via "share" button on various platform includes tracking query parameters, including google search results. Combined with the fact that query parameters are has legitimate uses, the distinction complexity becomes indistinguishable from "legitimate WebGL usage" vs "WebGL fingerprint".

It is scary where we are, but you can't solve it by dismissing it as FUD.

This list manages to be mostly correct while still spreading FUD. These can all be tracked, but the threat actors are very much uncoordinated in exploiting this info, and much of it (especially things like keystroke and mouse fingerprinting) is expensive to track en masse.

Just using Firefox with uBlock, no history, and privacy settings on max, through a somewhat trustworthy VPN like Mullvad will make your data mostly useless. Yeah, "they" could still catch you in a million ways, but if your threat model revolves mostly around surveillance capitalism you'll just be too much of a hassle to matter