Friday, May 17, 2013

Why blocking 3rd party cookies could be a bad thing

3rd party Cookies are used to facilitate targeted advertising and can be used to track your browsing across multiple Web sites.

I am not comfortable with being tracked across the web by Cookies, and Cookies were specifically designed to try and prevent this sort of behavior, so why would I be against disabling the major mechanism that is used for web tracking?   

The answer is pretty simple:
  • The evil you know is better than the one you don't.
  • This is probably a race we can't win.

The evil you know is better than the one you don't

Right now we know that advertising companies use 3rd party cookies to track behaviors and serve custom ads.  The companies that use these methods are well known to us and use similar methods.  They almost exclusively use 3rd party cookies.    With this knowledge it is very easy to disable tracking:  Go into your browser preferences and disable 3rd party cookies.    For those who care there is a simple and reliable method to disable tracking.   

Now lets suppose that someone decides to turn off 3rd party cookies by default in most browsers.   What do you think will happen?    Will the advertising industry just close up shop and move on to other businesses?    Will web tracking just cease to happen?    Of course not!   Advertising companies will move to other technical methods for user tracking.    They exist already, they are just a bit less convenient than 3rd party cookies to use.     The new situation is one that will be much harder for an individual user to disable tracking.  

This is probably a race we can't win

Think of this battle similar to the challenges of DRM.   Companies spend lots of time and money to design a super secure system to protect their digital content and within a week or two the DRM is broken and the content is all over the internet.    DRM is typically broken by small groups of unpaid hackers who do it for a hobby and they win just about every time.     Now think about how difficult it will be to stop a multi-billion dollar industry from winning a similar war.     If you are a browser company how are you going to stop well funded companies from coming up with technical ways to serve targeted ads?     There are already multiple ways to do tracking without 3rd party cookies and countless others could be created if enough effort is put into it.

What can we do?

My suggestion is to handle this politically not technically.   Keep working on Do-Not-Track and other mechanisms.    Keep working on legislative methods to restrict the policies.    Those are wars that we can win and those policies can have real teeth to them.     One of the benefits of the 3rd party cookie tracking techniques is that it is really easy to see who is doing the tracking.    If we make the societal choice to prohibit tracking then it will be easy to track down offenders.   

User tracking is a hot issue and should continue to be discussed and debated.    It is important to keep in mind that targeted ads are paying for almost all of the things that are on the Internet today.    If we make a wholesale decision to stop serving ads are we all prepared to start paying for all of the services that we are getting for free now?      Perhaps many people would agree to some level of targeted advertising if they saw the reasons and cost benefits clearly enough.     What I don't think will be useful is to start a technical war that disables the current working methods for disabling tracking and replaces them with poorly understood and less visible techniques.