From Wired News, available online at: http://www.wired.com/news/print/0,1294,37703,00.html Applause for IE's Cookie Catcher by Chris Oakes 3:00 a.m. Jul. 21, 2000 PDT Microsoft made user privacy into a browser feature for the first time, and just about everyone -- even those who profit from gathering user information -- seemed pleased. "Microsoft has started an important correction ... (in) its decision to make its Web browser stop and ask users before reporting data about them," said Richard Smith, a prominent security expert who has exposed several Internet privacy bugs. Microsoft announced Thursday it is developing a set of features for its Web browser to provide privacy controls for users. Advocates like Smith, who have been warning of the dangers of the often-invisible user tracking that takes place on the Web, immediately applauded the move. The additions for Microsoft's Internet Explorer browser will describe cookies to the user and differentiate between first- and third-party cookies, Microsoft said. The browser will then let the user refuse third-party cookies. A cookie is placed on a user's hard drive to identify that person upon subsequent visits. Additional cookies are often simultaneously placed by a third, less-apparent party. The most common third-party cookies are placed by the various companies that serve the banner ads that appear across many websites. When a third-party cookie remains on a user's hard drive, the enhanced version of Explorer will alert the user. At that point, the user can decide whether to refuse the cookie. A public beta of the enhancement, which will require Microsoft's Internet Explorer 5.5 for Windows, is due by the end of August. Privacy-oriented software products and services are already available -- from anonymizing and "pseudononymizing" services such as Zero Knowledge's Freedom service. Software programs like Guidescope let users turn off ads, while others enable users to control cookies. But Thursday's news was particularly notable because the company taking the action is Microsoft, which has the No. 1 browser on the market. Chief operating officer Bob Herbold said that in researching the plan, Microsoft found that the use of third-party cookies, even though anonymous, was a matter of great consumer concern. Consumers were primarily alarmed by the idea that a third-party ad-serving network was capable of tracking their movements across different sites. The most omnipresent third-party cookies are those placed by Internet advertising networks, which manage the ads that appear at many websites. Top companies in this business category include DoubleClick and Engage. Those two companies offered tempered support for Microsoft's decision. They made statements that applauded the move but cautioned that the details of any such feature should not hurt anyone's advertising-based business model. DoubleClick, the biggest ad-serving network on the Web, deferred questions about the news to the Network Advertising Initiative, a coalition representing 90 percent of third-party Internet advertisers. "The Network Advertising Initiative (NAI) supports efforts to develop appropriate technology solutions to enhance user management over privacy preferences," spokesman Jeff Connaughton replied in a statement. He qualified the group's enthusiasm for the concept, however, by cautioning that such features cannot be "over-broad" -- "so as to hurt small- and medium-sized websites and undermine the Internet business model that allows websites to remain free." The NAI is working with the Federal Trade Commission and Commerce Department to come up with ideas for a "self-regulatory regime" for Internet privacy. Some advocates, such as the Electronic Privacy Information Center, fear these discussions could lead to the FTC reversing its recent recommendation that laws are needed to establish baseline privacy standards on the Internet. Microsoft's Herbold said his company generally believes it is better to regulate privacy with technology features like the one Microsoft announced Thursday than to pass privacy legislation. Like the NAI, ad-serving firm Engage issued a similarly tempered statement of support for Microsoft's software plan. "Our own efforts in this field have been ongoing for several years, but this represents an important first step for Microsoft and the Internet community in the evolution of the browser," Engage CEO Paul Schaut said. "We welcome the opportunity to participate in the process of testing, discussing, and ultimately determining the most appropriate technologies to provide consumers meaningful data protection while allowing the Internet to continue to grow and thrive as a free, advertiser-supported medium." Third-party cookie placement has been a hot target for electronic privacy advocates because it is a mechanism through which the third party may build a cookie-based profile of the sites a user visits. DoubleClick came under fire last year when a planned acquisition would have made it possible for the company to identify Web users by name. Privacy advocates like Smith questioned whether third-party cookie placement is even essential to the Internet advertising business model. "Third-party cookies are actually not being used that much, and advertising companies can do very well with their current scheme," Smith said. Plans to use anonymous profiles based on third-party cookies are relatively new business plans among Net ad firms, he added. "Engage just started putting their profiling system in the last six months or so, and DoubleClick won't be doing it for at least a couple more months. So these companies can still very much run an advertising network." Herbold said the plan to implement features to control these cookies met with some raised eyebrows when the company talked the plan over with Web companies. Microsoft's own MSN series of websites were among the services the company consulted as it plotted the software's design. Herbold said many websites agreed that a more comfortable Web user was a good thing for all parties. Microsoft has previously stated plans to support the Platform for Privacy Preferences (P3P), a recently finalized specification that will let Internet software inform users when a website's privacy policy doesn't mesh with their personal privacy preferences. Copyright 1994-2000 Wired Digital Inc. All rights reserved. ---------------------------------- Send mail for the 'huridocs-tech' list to <huridocs-tech@hrea.org>. Mail administrative requests to <majordomo@hrea.org>. For additional assistance, send mail to: <owner-huridocs-tech@hrea.org>. Archives of previous messages posted to the list can be found at: http://www.hrea.org/lists/huridocs-tech/markup/maillist.html
[Reply to this message] [Start a new topic] [Date Index] [Thread Index] [Author Index] [Subject Index] [List Home Page] [HREA Home Page]