Browser Privacy Scorecard

The Scorecard

Explanation of topics

Cookie control

Since some sites do require cookies and you may want to allow them for sites you trust, you do not want to just block all cookies, but allow them on a site-by-site basis. The browsers are evaluated here based on how well they allow the user to block untrusted sites (should be the default) and allow trusted sites (should be an easily modifiable list).

Third-party Cookies

Cookies are required whenever you login to a website (technically, you can create a login session without cookies, but not very securely). However, most all websites also transmit cookies from third parties that are used to track your clicks and behavior across many websites. There is no legitimate use for third party cookies — their only use is to keep you under surveillance. Third party cookies should be blocked by default in all browsers.

Tracking Opt-out

There are three methods of opting out of behavioral tracking:

• Do Not Track HTTP header: The “Do Not Track” header tells websites that you don’t want to be tracked. It is a good idea, but is not supported yet by any advertisers, and my never be. Currently, Firefox 4 and Internet Explorer 9 have optional support for the Do Not Track header.
• Tracking Protection Lists: Browsers with “Tracking Protection Lists” allow you to subscribe to a list of companies that will be blocked. This is a great method, because it works today and allows you to effectively block almost all tracking. Support for Tracking Protection Lists is built into Internet Explorer 9 and can be added to Firefox and Chrome by using the Adblock Plus extension.
• Opt-out cookies: Opt-out cookies are a system pushed by the advertising industry. This method has many flaws, and has been shown by researchers to be only marginally respected by advertisers. Advertisers allow you to set special cookies to tell them you don’t want to be tracked. These cookies can be easily deleted, however. So some browser extensions will allow you to keep these cookies once set (as with Chrome) or to automatically set them (as with Beef TACO for Firefox).

Scorecard Notes

Firefox

• Tracking Opt-out: Announced in early 2011, Firefox will support an optional ability to tell a web site you want to “opt-out” of tracking. This opt-out is disabled by default and few websites support it. Technologically, Firefox is doing this the “right way” and the EFF has applauded Firefox’s move. However, we still give Firefox a failing grade because this blocking does not actually do much of anything currently and will only be effective if trackers are required by law to honor it, which seems extremely unlikely — especially since it is very difficult to enforce national privacy law on the global internet.

Internet Explorer

• Tracking Opt-out: Originally, the engineers at Microsoft built the best anti-tracking technology in existence: The browser would automatically detect when your behavior was being tracked across different websites and would block this tracking. This was also enabled by default! Once the advertising executives got wind of this, a battle ensued withing Microsoft. Eventually, the engineers lost and the advertisers won: Internet Explorer is distributed with this feature, but is only available while InPrivate browsing is on. This makes it useless, because it must be enabled manually for each browser window and doesn’t work with the normal browsing mode (this is important, because only in normal browsing mode do you have many handy features, like bookmarks, your history and form completion).

Internet Explorer 9

Version 9 of Internet Explorer is much better than all the previous versions.

• Tracking Opt-out: IE9 was the first browser to support the Do Not Track header and Tracking Protection Lists.

Chrome

• Tracking Opt-out: Announced in early 2011, Chrome will allow users to set a special “opt-out” cookie that is recognized by members of Network Advertising Initiative. This method is nearly useless. One report found that the NAI cookie did not work consistently, ignored new ways of profiling and tracking, does not include a majority of industry groups, and lacks transparency. The report concludes that “the only success of the NAI has been lulling regulators into thinking that self-regulation fairly and effectively addresses the interests of consumers who are the targets of behavioral advertising.”
• Cookie tracking: the way that Chromium allows users to control cookies is fairly advanced. You can block all cookies and selectively (through a context-menu that pops up in the URL) enable certain domains as you see it. You can also directly see which cookies are set for the site you are visiting in that dialog. Also, when you set your config to “ask first”, you get the confirmation dialogs one at a time instead of all at once as it is in Firefox.
• Flash cookies: Chrome does the right thing and cleans up flash cookies whenever you clear cookies.

Safari

• Third-party cookies: Safari wins as the only browser to disable third-party cookies by default.
• Other: Safari deserves bonus points for being the only browser immune to history harvesting.
• Tracking Opt-out: At this time, I don’t think there is any planned.

How to get an “A+”

What would a browser need to do in order to score “A+” on the scorecard?

• Third-Party Cookies: There is no legitimate use for third party cookies. They should always be blocked.
• Tracking Opt-out: The ideal would be…
  • enabled by default: At a minimum, the user should be presented with a choice the first time you use the browser.
  • do-not-track header: The browser should send the “do-not-track” header like Firefox, in case anyone ever actually honors it.
  • detected tracking: The browser can, and should, detect when tracking is happening and shut it down. You should not need to rely on the voluntary compliance of the tracker to honor your settings. This is what IE was going to do, until the executives killed it.
  • block lists: Allow the user to subscribe to lists of trackers that will get blocked.
  • on for normal browsing: tracking opt-out is useless if it is only enabled while in a special “Secure Browsing” mode.