1/ This news about Firefox blocking third-party trackers by default has brought back some memories of my time at Mozilla and what we were considering back in 2012. Quick thread:
2/ as a friend of the privacy engineering team there, I spent a good bit of time thinking about this issue of third party trackers, and what browsers should do about it.
3/ ultimately, this whole idea of third-party trackers is bonkers, but somehow we've gotten used to it. A lot of what you do on the web is connected by way of these trackers. It is a side effect of the way cookies were designed, and one I'm pretty confident was never intended.
4/ in 2012, at Mozilla, we simply couldn't imagine "breaking the web" by actually blocking third-party trackers by default. That felt like going nuclear.
5/ we did have an awesome team thinking hard about "Do Not Track." The idea was that users could opt into sending a signal to web sites asking that they not be tracked from site to site. We felt that if it reflected user intent, sites should really engage.
6/ maybe a news site would say, "hey, you don't want to be tracked, cool, but then can you pay $5/month instead?" We felt this would be a healthy conversation about making the web viable without tracking.
7/ one idea I pushed for was this: request from the server an acknowledgement of the DNT signal. I imagined a gradual ratcheting up over time from "please acknowledge the DNT signal" all the way up to "block third parties that don't acknowledge the DNT signal."
8/ I did not make a sufficiently convincing case for this: ultimately my colleagues thought this was too close to the nuclear option. They were probably right at the time that this was unfathomable.
9/ then of course, the ad industry decided to make a mockery of DNT. They scuffled the standardization effort.
10/ in response, consumers have adopted ad blockers. And those have started the conversation, with some news sites prompting users "hey, we see you're using an ad blocker, how about paying us some money then?" Except it's way more technically complex than simple DNT.
11/ and with tracking continuing to be a privacy and security scourge, browsers are now moving to default third party blocking.
12/ in a funny way, we've arrived at the negotiation I sort of imagined: the ad industry refused to acknowledge DNT as a real consumer need. So browsers are going nuclear.
13/ it could have been done the nice friendly way with an honest conversation between users and sites. But ad networks couldn't fathom jeopardizing revenue even a little. So now we have a legitimate arms race, and Firefox dropped a massive bomb. It's gonna be interesting.
