Privacy Advocate Jonathan Mayer Has Had It With ‘Do Not Track’

Jonathan-MayerThe Tracking Protection Working Group is meeting this week in Sunnyvale, Calif. in its latest attempt to create a tech spec for the Do Not Track browser feature. Progress has been excruciatingly slow for the group, which operates under the aegis of the World Wide Web Consortium (W3C). Disparate interests have been unable to agree on even basic issues such as the definition of “tracking.”

Jonathan Mayer, a graduate student at Stanford, is among the most visible and technology-fluent members of the privacy constituent within the working group. And he is losing faith in the negotiations.

Mayer spoke with AdExchanger recently.

AdExchanger: What do you hope will come from this meeting?

JONATHAN MAYER: I hope the group will come to some kind of a consensus, but I’m not very optimistic that’s going to happen. The leverage used to be on the advertising industry’s side, but it has become clear by virtue of the technologies at the browsers’ disposal that the leverage is now on the consumer’s side.

The advertising side would be expected to reevaluate their hardline “We’re not going to negotiate” stance and rethink their strategy. Unfortunately, that hasn’t happened. So I’m not too optimistic on negotiated terms for Do Not Track, but I’m increasingly optimistic that by virtue of the browsers’ efforts, consumers will get the choices they want. It looks like consumers will get some pretty good privacy in the near term. If the W3C’s process is unsuccessful in developing a consensus on what the standards are, companies could be in a difficult spot, but consumers may be okay because of the technical countermeasures that are starting to be drawn over browsers.

What will it take for the W3C to come to an agreement on the Do Not Track standards?

One thing advocates long stood by is if a user says “Do not track me,” that should mean you’ll get rid of the unique ID identifier cookie if you’re a third party in the business of advertising or collecting user data. The advertising industry has said no, we need to keep these cookies for certain users like market research, product improvement, etc. It’s hard to come up with something that doesn’t count as market research or product improvement.

So you get one part of the group saying “We can’t live with X” and another group saying “We can’t live without it.” It’s unclear, after a few years of those positions remaining where they are, how in the span of just a few short days things will be resolved.

What would be the ideal solution?

Consumers don’t have a great handle on what’s going on in terms of how their data is being collected and what it is being used for. Therefore it makes sense to shift the burden of explaining to the user what is going on to those who are in the best position to do it. Advertising companies have an incentive to convince users that they’re trustworthy and that users should allow them to collect data.

By setting those default settings to Do Not Track, we give interested parties the incentive to educate consumers about the impacts of those choices. We allocate to them [those parties] the responsibility of getting consumers to give them access.

What are your thoughts on technology that uses data like IP addresses, timestamps and geo-location information to target ads, which is supposedly less invasive?

I have no objection to privacy-preserving advertising. I have done research in this topic and have designed systems that will enable privacy-preserving advertising. The concern isn’t that websites are ad-supported or many forms of ad targeting – like we see you seem to be coming from the New York area, so we’ll show you an ad for events in New York, or we see you’re on a site for fancy wristwatches so we’ll show you an ad for fancy cars. All of that is very much welcome.

The ads depend on relevant browsing history that draw the most privacy concerns. It’s fair to say that advocates differ on how to handle this. Personally I don’t have a lot of trouble seeing ads based on my browsing history; I actually prefer to see relevant ads. My objection is that my data is being seen by companies I’ve never heard of. Privacy-preserving advertising, I think, would be great. Many forms of it are to be welcomed.

What projects are you working on now?

I’m finishing up some research and countermeasures [for consumer privacy], but it’s very difficult to see a long-term consensus approach. Personally, I’m starting to shift away from privacy. Part of it is because I’ve grown frustrated with the space. A lot of what there was to be said has been said. We now have a pretty good understanding of what consumers expect and want, and an okay understanding of the economics of the space. Compound that with years of negotiation and unfortunate episodes of vitriol, and so I’m ready to move on.

This is partly why I started focusing on technical solutions, like working on the Firefox cookie-blocking feature. Here’s something we can use that doesn’t require everyone to agree on it. It doesn’t have the same negotiating flip-flops of Do Not Track that have gone on for years. And hopefully it’s good for consumers.

My personal research has started to move into the Computer Fraud and Abuse Act, which is a federal hacking statute that is quite overrun. In essence, using a computer in a clever way that someone doesn’t like is a federal crime. That seems excessive. I’ve been working on understanding what can be done about it, doing more law-oriented research. On the technical side, I’ve been doing some work on browser security but still casting around for the next issue I’d like to work on.

Privacy was tantalizing a few years back because it was clear there was a lot of interest on the horizon and an opportunity to provide input. I hope I’ve done some measure of good, but at this point it seems stuck. The space is sufficiently crowded with enough vested interests that make it difficult for one grad student to make a difference.

I think the group would be responsible to set some firm deadlines, in particular to say if we can’t agree on X by Y time, let’s agree that we can at least disagree and move on. The group leadership has resisted that approach so far. The path of least resistance is to say “Let’s have another conversation,” and it’s a lot harder to say goodbye but that may be what’s necessary.

Enjoying this content?

Sign up to be an AdExchanger Member today and get unlimited access to articles like this, plus proprietary data and research, conference discounts, on-demand access to event content, and more!

Join Today!


  1. Firstly, he is equating “consumer choice” with browser choice. This is disingenuous.

    Second, no one is considering the backlash where websites will start rejecting visitors with certain browser choices. “This site is not available for Firefox”, etc.

    Finally, the rationale that “my data is being seen by companies I’ve never heard of” is implying that Google, Facebook, Twitter, etc will be more responsible than those he has never heard of. This is quite naiive, not because those companies are not trustworthy, but because those companies have vastly greater breadth of data about the consumers than stand-along ad networks and thus the risk to privacy of blocking third-party cookies is far higher, in realistic terms, than not doing so. Quick example: which company’s data is more likely to be subpoenaed by a hostile government agency, and which set of data is more likely to be privacy invasive: Google, which can combine site visits with searches, email, etc, or some random ad network who’s only context is site visitation?

  2. Websites will not start to reject individuals based on a cookie policy. That’s a scare tactic. Most don’t even have the technical teams to build or enforce such a restriction.

    For years in offline publishing we were able to sell and monetize content without a cookie. It’s true Ari. Go get a newspaper or a magazine. Maybe look at a billboard or a taxi cab. Still not convinced? Turn on your television.

    I am rather confident that given large advertising budgets and eyeballs people will, shockingly, figure out a way to go forward. The advertisers aren’t going to stop advertising. The publishers aren’t going to stop publishing.

    Google & Facebook provide a free service of which one aspect is an OPT IT (I don’t have to use either of these products) to tracking. The crappy ad networks, hundreds of them, provide no value add. They provide ads.

    People hate ads.

    • Publishers need to make money on their content. If they don’t have the technical expertise to enforce a cookie policy (I believe just about anyone with a small amount of research could do this) they will sure as hell get one as their ad revenues begin to drop. Which is what will happen when targeted ads start going away.

      When the value of an ad goes down, as does with untargeted ads, the only way the publishers will be able to make the money they need on their content will be to display more of these low-value ads per page.

      The amount of advertising people will see will increase, and each individual ad will become less successful, so the value of the ads will go down further, and publishers will have to display even more advertising, use interstitials and other intrusive advertising methods. It will mean a much worse and more intrusive advertising experience for users, and some publishers will resort to blocking/going subscriber based at some point because the model begins to make more sense to them.

      So yeah, we can look at magazines, local newspapers, etc. and see what has happened to them as the values of their ads have gone down. Pages and pages of closely-spaced ads and very little and low value content provided.

      Seeing a couple of ads on a page that have been targeted at them and are relevant and that allow publishers to cover their nut is a lot better than seeing 20 ads for mostly irrelevant products and services, or not being able to go from one page to the next without having to stop and watch a video ad.

      People may hate ads, but by blocking tracking cookies by default, the browsers are only insuring people will see more and more of them.

      • Maybe the reality here is that the banner ad since it’s inception has been broken as a method of advertising on the internet.

  3. John, your response uses the typical rhetorical technique of switching the argument from one of base principles to one of tactics, as is convenient to you. Essentially you’re saying this isn’t about user choice, it is about YOUR choice to eliminate this form of advertising because you find it distasteful.

    Further, your continued denial of the disproportionate power of Google, Facebook, etc. to use this data and to expose this data to government requests reinforces the fact that you aren’t advocating any kind of coherent intellectual framework for realistically protecting consumers but rather a Silicon Valley idealism where any consumer can just opt-out of using the cornerstones of the web. What’s the *point* of privacy if not to protect people against likely abuse?

  4. I have asked this question of IAB members, Linkedin members, Facebook, Twitter and here at Adexchanger which is simply this: ”

    Why SHOULD the default setting for consumers in browser be to accept online ads?”

    NOT ONE MEMBER of any of these communities either care to or thought to respond with a positive reason. THEN both the IAB and the DAA do these campaign(s) with open letters and talks of the internet dying and the small publisher being hurt, the consumer experience being taken away and every other reason under the sun.

    When in fact people we are in the business of selling and so tell me me why we can not sell the consumer on accepting ads that relevant to their needs? AFTER all if major brands count on us to sell product we better darn well be able to sell ourselves and that something in which I have not seen nor do I think I will see it because of current mindsets.

    As far the privacy issue, its time we really start to think about this and all the data we have and can store up and if it justified and right? I know for a fact I do not like my surfing behavior being track simply because of the full on embrace of retargeting without restriction or with a cap, I get tired of seeing Colon Cleanse, Lose weight with the pill, or products which I took a look at because it was on a site I went to. THINK about it, I am in the business and I love it to death! IF I don’t want to see stuff that is not what I am looking for so why should the average consumer have to? Can I get an answer please.

  5. The online display industry had years to prove that 3rd party data would do ANY of these things:

    1) Improve CPM to publishers
    2) Improve performance for advertisers
    3) Bring brand dollars to the web
    4) Improve User Experience with Advertising

    They couldn’t even do a single on of these. In fact in all cases the opposite has happened.

    1) CPMs are falling 8 years in a row (IAB)
    2) CTRs have leveled at less than .1% for years
    3) Brand dollars never arrived (and are now headed to Social)
    4) The ads are creepy or irrelevant

    The 3rd party data game is over. The industry killed it. Don’t go putting blame anywhere else. Look in the mirror.

    • Jonathan, on your points:

      1) Casale and Appnexus have both publicly cited a 2:1 payout to publishers when a cookie is involved in targeting the impression compared to when no data is involved. Even if it’s “first party” (i.e. retargeting) it’s still a 3P cookie. While CPMs may still be falling, this seems to suggest they would have fallen more drastically if not for 3P cookies.
      2) Agreed – no real performance improvement.
      3) I wouldn’t say they’ve “never” arrived. There are some brands using display intelligently and with good results. Bob Arnold of Kellogg’s is an example of a brand advocate. However, you’re correct in that “the dollars we expected” have not arrived. I think this is more of an issue of ad formats and sizes than data, though.
      4) I agree the creep factor needs to go away, but the irrelevant adjective is debatable.

      For all here, this debate seems as polarized as the current government. That is surely a system that works for no one!

  6. Alejandro Correa

    I’m surprised as to how this conversation continues to revolve around 3rd party data targeting, when it seems to me that the largest impact of blocking 3rd party cookies will be on conversion attribution. To be clear, I’m not endorsing view-through attribution, or even saying that 3rd party cookies should be allowed by default; but as more browsers continue to block 3rd party calls, publishers, agencies and marketing departments will have to explain to whoever they’re accountable that the old benchmarks for effective costs are blown out of the water. In short, I think its time to move on, and discuss how media efficiency metrics are going to look like in a post-3rd party cookie ecosystem.

  7. The assumption that tracking, profiling and data mining does either the publisher or the consumer any good is false. It costs the publisher more and undermines the trust with the consumer. The only folks who win in this equation are the very companies doing the tracking and mining… That is the problem.

    Its not the consumers fault or the publishers fault that an entire industry was built on a poor foundation. 1st party cookies are very do-able and they will happen at those companies that make their living off of creating content.

    The argument that the web will fall into oblivion when publishers cannot sell their audience to several hundred tracking companies…is so ridiculous its laughable. I cannot believe how many really smart people use this as their main argument… 95% of the mid to long tail sites that make up the majority of traffic and ad views are content thieves. They do not create anything, they game the system for their own benefit. They steal others work, links, slides how link bait, SEO trickery, etc. etc. etc. and they make a living on the work of the middlemen ho take, they do not add value to the equation. And they’re the ones you’re worried about??

    Jonathan Mendez is absolutely correct. These practices have very little actual merit and produce virtually no improvement in value to the people that matter – publishers, consumers and the advertisers themselves are all losing out …

    This move will push us in the right direction and help to regain the trust of the consumer instead of continuing to treat them as a commodity ripe for exploitation. Trust is the key word missing from the 3rd party cookie argument, and the one thing that needs to be reestablished in order for advertising efficacy to grow.

  8. Ari: “Finally, the rationale that “my data is being seen by companies I’ve never heard of” is implying that Google, Facebook, Twitter, etc will be more responsible than those he has never heard of.” I don’t think it is. I interpreted his point as being that he is worried about his personal information being used by people he is unaware of, in ways he is unaware of. (ie. his information is dealt with opaquely instead of transparently) It’s still possible to point that out without ignoring the problem of the vast breadth of data that the larger companies have.

    • Adam S

      Mer, if that is indeed his point, then it conveys paranoia more than it does an understanding of third party cookies, or what you/he defines as “personal information”. In terms of his “personally identifiable information” never mind “personal information”, being used by people that he is unaware of… that is on him to understand the privacy implications of his actions online. These implications are most often posted in plain English (or one’s chosen language) by the first party marketer and/or publisher. Are there unscrupulous marketers out there? Sure, but is that any different than the offline world?

      I appreciate Mayer’s choice, but it’s no more important than yours, mine, or anyone else’s here. So I’ll just go ahead and share my personal choice … I prefer not to share my personally identifiable information unless I’m making a purchase, in which case I share my home address. I do choose to allow third party cookies in all browsers. I’m glad they have a unique id for my browser. I like that they know that my browser has seen that ad once today, and that it does not need to see it five more times. I like that they know when my browser visited a particular marketer in the last two weeks to look at a product, and there is a similar product that is on sale. Mayer may simply prefer weight loss, car insurance and viagra ads… it’s all about choice.