Privacy professor to try to break Do Not Track logjam

Peter Swire, an Ohio State law professor and privacy expert who has worked with the Obama administration, is stepping into a contentious process to create a standard way to let people stop Web sites from tracking their online behavior.

Aleecia M. McDonald announced today she's stepping down as co-chair of the Do Not Track standardization effort at the World Wide Web Consortium. She previously worked for Firefox maker Mozilla, which launched the current DNT technology after the U.S. Federal Trade Commission sought a mechanism to block online tracking, but she currently works for a program within Stanford University's law school.

"Stanford's Center for Internet and Society has had endless patience with DNT taking time far in excess of what I anticipated," McDonald said in a mailing list post announcing Swire that is replacing her. The other co-chair remains Matthias Schunter, an Intel employee.

The Wall Street Journal reported the change today, characterizing Swire's involvement as an attempt to salvage the DNT process.

The proposal has indeed been very contentious, with advertisers and privacy advocates rarely seeing the issue eye to eye in the W3C's Tracking Protection Working Group. One major issue is whether DNT should be enabled by default in browsers.

Mozilla sees Swire's appointment as constructive.

"Peter Swire brings considerable expertise and insight in law, technology and policy to this new role as co-chair of the W3C Tracking Protection Working Group," Mozilla Chief Privacy Officer Alex Fowler said in a statement. "I've seen how Peter works over the years and have always been impressed with his ability to bring stakeholders together, break through political quagmires, and move forward in a balanced manner."

Swire has monitored DNT closely and testified before the U.S. Senate about DNT in June.

In that testimony, Swire took issue with the Digital Advertising Alliance request for an exception to DNT restrictions "for market research or product development." Swire testified:

These exceptions are so open-ended that I have not been able to discern any limits on collection under them. Market research includes "research about consumers." That would seem to include keeping track of every click made by a consumer. Market research also includes analysis of "consumer preferences and behaviors." Again, if I were an FTC enforcer, I don't know what lies outside the scope of the exception. The definition of product development is similarly broad. It includes analysis of "the characteristics of a market or group of consumers." To analyze a "group of consumers" would seemingly permit collecting each click made by those consumers. Similarly, product development includes analysis of "the performance of a product, service, or feature."

Swire also said calls for industry self-regulation are only effective when a real threat of governmental regulation motivates meaningful change. And he concluded with a pro-privacy statement.

"I personally would not like to have an Internet where I believed that each moment of my browsing might easily be breached and shown to the entire world," he told the Senate. "For you and your families, it would reduce the quality of the Internet if you thought that any page you visited needed to be treated like something that might be released to the public."

Regarding the issue of default DNT settings, Mozilla and Google follow the original standard drafted by Adobe Systems' Roy Fielding of leaving DNT disabled unless a person explicitly turns on the tracking protection. But Microsoft, saying it thinks a stronger privacy stance is required, enables DNT by default in IE10 on Windows 8 if a person accepts the default settings Microsoft suggests. Advertising industry representatives, however, say they'll ignore DNT preferences altogether if it's enabled by default.

Fielding, a founder of the Apache Web server project, wrote a patch that ignores IE10's DNT setting. Yahoo will also ignore IE10's DNT setting, the company said in October. But Paul Cotton, leader of Microsoft's Web standards work, said in an interview he believes Microsoft's DNT stance is the right one.

If advertisers don't budge, there's the prospect they'd have to submit to regulation or a law requiring them to do something. But the FTC stopped short of regulation before, and some in Congress have come to advertisers' defense.

The Electronic Frontier Foundation said Swire oversees the matter of DNT compliance and Schunter oversees the technical functioning of the DNT specification itself.

"We look forward to working with Swire on hammering out powerful standards for protecting online privacy," the EFF said in a statement.

Updated at 12:12 a.m. PT November 28 with Swire's 2012 Senate testimony and comments from the EFF.