The benefit of the DNT scheme was to kill the lie that most users don't care. If 99% of users take positive action to change a default and say "Don't track me", it's believable. If a browser vendor says this, it's not.

Bear in mind that Do Not Track has _zero_ technical merit; it's equivalent to the "evil bit" prank RFC. Any merit it has must be political.

The value in DNT was going to be that we could convince advertisers that normal users do, in fact, care, and do, in fact, not want to be tracked. IE's decision is squandering what DNT attempts to communicate, and squandering that value. And so when you see advertisers _and_ web server developers rejecting IE 10's DNT indicator, that doesn't mean that the advertisers or web server developers are bad people -- that just means that you lost the politics.

In their shoes I would have done some focus groups, spending an afternoon with people and really educating them on the details of tracking, and what the pros and cons are for them. If at the end of it most typical users would have turned it on, then this would have been the right default.

After all, if places like Yahoo don't like it, they could ask people to turn it off. If Yahoo's right, then presumably most people would turn DNT off, or make an exception for them. But I suspect Yahoo knows that people don't want to be tracked, and that a lot of their profit comes from keeping their users in the dark.

That is a good general rule. In the case of DNT, the header was formulated specifically with the intent that the default would be off, regardless of what you expect the user to want, so that turning it on communicates individual user intent. This is a reason to ignore the general rule in this specific case.

A good related example would be license agreements. Most users want to ignore them entirely. Focus groups would indicate skipping them. But if you make a click-through license agreement invisible, while that's a better UX, the agreement is now completely legally invalid. In order for the agreement to be valid, you need the user to have an opportunity to read it (even if focus groups indicate nobody does).

And while you expect 100% of your users to accept the agreement, the default needs to be "No, I do not accept".

Nope, there are other reasons why one wouldn't turn it off: confusion, ignorance, laziness, etc. Everyone in tech support knows how hard it is to get users to perform simple tasks even with step-by-step guidance.

Exactly. Do Not Track is unenforceable. We need Cannot Track.

There's no sense in relying in any of the large companies to voluntarily give up ad revenue, you need to take matters in to your own hands.

NoScript however makes the web completely unusable for large majority of regular people and frustrating for almost everyone else.

But that does fuck all, apart from making me guess which third-party requests are instrumental to making a page I'm visiting for the first time properly, until it's some sort of concerted effort at a default behavior for browsers so that websites are coerced to adapt to it to stay competitive. So it's up to those with browser marketshare.

The concept of Do Not Track, despite the emotional appeal of the name, essentially seems to be a compromise between privacy and advertising, keeping the advertising-based model intact while also allowing the extremely privacy focused (minority set of) individuals to have things their way.

Turning DNT on by default is a hardline approach and violates the spirit of this compromise. Instead, there needs to be more effort to constructively work with content providers, privacy advocates and advertisers to come up with a more explicit protocol that satisfies everyone's interests.

When I talk with non-technical relatives about their internet use, privacy is a major issue for them.

They know, for example, that Facebook knows a lot about them, which scares them. They don't know how much ad providers track them, but if you tell them they're more scared. Facebook is at least a known entity that provides them some benefit. Shadowy private companies profiling them is a lot harder to get comfortable with.

Again, there are good and bad players on all sides, but my point was simply that ignoring reality and making a complete swing to no monetization for content seems to assume all players on one side are bad. A more open standard that allows clear knowledge is probably a better direction for Microsoft to pursue.

I don't. In my limited experience, most users don't care nor mind unless they can see the immediate downsides to that.

In that it's fairly straightforward to track a user across multiple sites and sessions with a cookie, almost as easy as if the browser was already sending a user-specific identification number along on its own.

I didn't want to present Microsoft as the good guys here either, they're playing their own game and I have no illusion that they really care about their users' privacy.

1) They can often be used to identify you, especially when combined with other HTTP headers or information scraped from the client via JS[0].

2) They are abused by web developers who wish to lock out web browsers that they do not support. This is generally considered to be against the spirit of the web, though is sometimes useful for optimising page load times (for example, not sending IE conditional comments to all browsers).

[0]: https://panopticlick.eff.org/