Ad Men and Browser Geeks Collide Over Web Protocols

The advertising industry is brawling with some of the biggest names in technology: Microsoft, Mozilla, and the World Wide Web Consortium, the standards body for the Web.

The fight is taking place because the consortium, known as W3C, is developing a new “Do Not Track” standard so Web users can signal that online ad targeting companies should leave them alone. Advertising industry representatives say the standards-setting process has turned into an existential threat that could mean the end of free online content.

“The ad industry is being asked to honor something that could make the majority of Web users nonmonetizable and put it out of business,” says Mike Zaneis, head of the Office of the Interactive Advertising Bureau in Washington, D.C., which represents over 500 companies that together sell close to 90 percent of online ads in the United States.

Although few Web surfers have heard of it, the W3C has considerable power to shape online life. Founded by the Web’s inventor, Tim Berners-Lee, the international body sets the technology standards and protocols that companies adhere to so that the Web functions smoothly.

The W3C began looking at the idea of Do Not Track last year after two prominent members, Mozilla and Microsoft, implemented versions of the feature in their own Web browsers. In September, the W3C convened an 80-person Tracking Protection Working Group of industry, government, and academic experts to study the question, with the aim of thrashing out a single standard by mid-2012.

That goal now appears unlikely to be met, because the working group has run into major disagreements over how the technical standard could affect the $70-billion-a-year global online advertising market.

The technology of Do Not Track is relatively simple. When a browser accesses a Web page, it could send a signal—a 1 or a 0—to indicate whether the setting is enabled. What the working group hasn’t been able to agree on is precisely how the signal should change the behavior of a page and its advertising technology.

One of the biggest sticking points: what even counts as “tracking.” There’s general agreement that users should be able to block third-party ad companies that record browsing behavior, using that information to serve up so-called targeted ads. However, advertisers insist they must still gather data on how many people—and in some cases which people—have viewed a particular ad on a website.

Some privacy activists in the working group say that allowing such data collection could eviscerate the standard, turning it into a “Do Not Target” technology rather than a means of protection for consumers who don’t want their browsing monitored at all.

The result is a conflict that is pushing the standards body well beyond the nuts and bolts of the Web into hot-button economic and policy issues. “With Do Not Track, the technology issues are the least [of the] concerns,” says Lorrie Cranor, a professor at Carnegie Mellon University who studies privacy technology. “It’s about policy.”

No one seems very happy with the W3C’s progress so far, but the ad industry feels the most aggrieved. Zaneis describes the group’s weekly conference calls and occasional face-to-face meetings as having “a bit of a circus atmosphere.” He and others also say deliberations have been unduly influenced by Mozilla, the nonprofit foundation that markets the Firefox browser.

“Mozilla really runs the working group,” says Zaneis. “They probably see [Do Not Track] as a product differentiator.” Not only did a Mozilla privacy engineer help develop the first prototype for Do Not Track technology, but a foundation executive cochairs the W3C committee, and its CEO has been a vocal critic of online tracking. (The foundation makes money from search engines such as Google who pay to be featured in Firefox and doesn’t rely directly on targeted ads for revenue.)

Alex Fowler, who leads privacy policy for Mozilla, says the nonprofit has no more influence than any other member of the working group.  “In  the W3C, each member has the same standing as everyone else, from grad students to representatives of multimillion-dollar companies,” he says. Ian Jacobs, a spokesman for the W3C, says his organization is recognized as “a neutral forum where competitors build consensus.” Members “care deeply about the issues under discussion, some of which are controversial,” he says.

Whatever technical standard the W3C process produces, the arguing is unlikely to end. As Carnegie Mellon’s Cranor points out, although the W3C can specify how websites communicate, it’s not going to tell companies exactly how to present Do Not Track information to users. Microsoft showed how critical that issue could become when it announced it planned to ship the next version of its Internet Explorer browser with Do Not Track switched on by default.

The move provoked an outcry among advertisers, who complained that Microsoft broke a consensus among W3C members to let users freely choose whether to be tracked or not. Most users, advertisers fear, would never adjust the default setting. And since Microsoft has more than 25 percent of the browser market, that could mean half a billion users saying no to targeted ads. “The ad companies could have a valid concern that people were opting out without understanding what they are doing,” says Cranor.

Microsoft’s decision also shows the complexity of the business strategies at stake in the W3C deliberations. Although Microsoft is involved with online tracking of users for advertising, it also has much to gain by increasing the popularity of Internet Explorer, and might even find ways to insulate its own ad business from W3C controls.

Jeff Chester, who heads a privacy activist group called the Center for Digital Democracy and is one of the working group’s most vocal opponents of online ads, believes that industry has little to fear from the W3C. In fact, he says, companies may wield undue influence already. Google, Yahoo, and Microsoft all have representatives on the W3C, and they are also paying members of ad industry groups like the IAB.

“The online ad industry built a far-reaching global system of commercial surveillance, [and] the W3C process is largely dominated by online marketing companies,” says Chester. He predicts that whatever the final standard says, new tracking techniques will probably spring up that evade it.

Indeed, one point of consensus is that the largest Web companies have less to fear from Do Not Track than small ad networks and publishers. The working group has already agreed that activating a Do Not Track signal would not prevent companies like Microsoft, Google, or Facebook from tracking and targeting users within their own vast websites.

“Larger entities with a consumer presence will be able to manage,” predicts Marc Groman, head of the Network Advertising Initiative. “There’s a long tail of small publishers—and ad networks that serve them—who are concerned they will be disproportionately affected.” He says blocking such tracking will make it more difficult for smaller companies to pay for free Web content.

Not everyone agrees with such assessments. Fowler, Mozilla’s privacy policy chief, argues that there’s still no evidence Do Not Track would strangle advertising revenues on the Internet. “We’d love to see some hard data,” says Fowler, noting that several advertising companies have already agreed to honor Mozilla’s version of Do Not Track technology.

Others believe that the debate at the W3C could be overshadowing more serious privacy questions. “Users are moving to tablets and mobiles and apps that have no way to deal with Do Not Track,” says Jules Polonetsky, director of the Future of Privacy Forum and a member of the W3C working group. Major regulatory questions also surround the immense stores of personal data that are being accumulated by social networks.

“We’re squabbling over default browser settings,” Polonetsky says, “and it has swallowed up all other privacy issues.”