Today we are releasing the implementation guide for EFF’s Do Not Track (DNT) policy. For years users have been able to set a Do Not Track signal in their browser, but there has been little guidance for websites as to how to honor that request. EFF’s DNT policy sets out a meaningful response for servers to follow, and this guide provides details about how to apply it in practice.
At its core, DNT protects user privacy by excluding the use of unique identifiers for cross-site tracking, and by limiting the retention period of log data to ten days. This short retention period gives sites the time they need for debugging and security purposes, and to generate aggregate statistical data. From this baseline, the policy then allows exceptions when the user's interactions with the site—e.g., to post comments, make a purchase, or click on an ad—necessitates collecting more information. The site is then free to retain any data necessary to complete the transaction. We believe this approach balances users’ privacy expectations with the ability of websites to deliver the functionality users want.
Websites often integrate third-party content and rely on third-party services (like content delivery networks or analytics), and this creates the potential for user data to be leaked despite the best intentions of the site operator. The guide identifies potential pitfalls and catalogs providers of compliant services. It is common, for example, to embed media from platforms like You Tube, Sound Cloud, and Twitter, all of which track users whenever their widgets are loaded. Fortunately, Embedly, which offers control over the appearance of embeds, also supports DNT via its API, displaying a poster instead and loading the widget only if the user clicks on it knowingly.
Gary Edwards on 31 Oct 10transclusion of hypertext documents. Transclusion is technically defined as "when you put that one thing in that other thing". In its current implementation, Twitter has declared that media which is shown within the Twitter interface comes from selected partners. But actually, the technology to allow embedding of rich media from almost any site already exists, using a system called OEmbed. Geeky stuff, but it's made by nice people who are pretty smart, and it lets any site say, "Hey, if you want to put our thing in your thing, do it like this". It works. Lots of sites do it. Nobody's getting rich off of it, but nobody's getting sued, and in between those two extremes lies most of what makes the Web great.
