3rd Party trackers and online privacy

Question

I don't feel the internet is respecting our individual right to privacy. Why are 3rd party trackers allowed to siphon data from us without our permission? We should selectively be able to reveal what we want to only to who we want.

how can we neglect 3rd party trackers and other similar kind of actors from getting our data without permission?

Answer 1

Legal Requirements

They are not allowed, in a lot of cases. As a result of the GDPR and similar legislation in other territories, companies are no longer allowed to siphon that data without permission even when it is just an anonymous identifier and websites are expected to give the user control over where data is sent. This has the problem that the onus is on those collecting the information to obey the rules and assumes that those rules apply to them, which they may not.

Technical Measures

Browsers can optionally include a 'Do Not Track' header which signals that the user does not want tracking data to be collected. There are growing calls for browser makers to abandon DNT as it is routinely ignored by apache servers for browsers where it is enabled by default.

P3P was another attempt to implement browser-side privacy processing. However development stopped on this some years ago due to a lack of support by browser makers.

Browser plug-in tools like Privacy Badger can block known tracking sites/links, but those only apply to browsers and puts those seeking privacy in a position where you need to know every URL that you need to block, and in some cases can degrade the user experience. Browser plug-ins do not affect Apps on mobile and embedded devices.

DNSBL tools like Pi-hole can currently be used to block sites at the network level but this is a less than ideal situation because it requires an exhaustive list of sites to block and again can interfere with the user experience. With moves towards encrypted DNS (via TLS and HTTP) this avenue is likely to become decreasingly viable in the future.

VPNs and similar tools like TOR may go some way towards hiding your personal/tracking information, but to be effective they require a significant amount of operational security for the user and again significantly degrade the user experience. Such methods require rigorous OPSEC and discipline in many cases.

Bad actors

All the measures listed are of limited value in the case of companies who act in bad faith.

A prime example of this is google; their CEO (Eric Schmidt) said in 2010, "We know where you are. We know where you've been. We can more or less know what you're thinking about." and the company has an established track record of committing (and getting away with) large privacy breaches including...

• slurping personal data from wireless routers
• bypassing P3P processing
• "forgetting" to mention that some nest products have built-in microphones

With a company like google acting in bad faith, it makes life particularly difficult to maintain privacy as blocking sites like googleapis and google fonts leaves users with a severely degraded experience on the web as a significant number of sites rely on their content and they are by no means alone.

tl;dr - privacy is not being respected and there aren't any silver-bullets to enforce our rights at present.

Answer 2

I'm thinking there's a lot of opinions presented as facts polluting the discussion here:

I don't feel the internet

The "internet" isn't doing this. Internet providers and commercial software and services companies are doing it.

They are collecting data to pay the bills and make a profit because that's why companies are ultimately in business -- to make money. Nothing more, nothing less.

is respecting our individual right to privacy.

There is NO such thing. Where is this "right" you speak of documented?

When you consent to TOSes, SLAs, EULAs, etc., you are giving the provider permission to use your data.

I think part of the problem here is GDPR is on a lot of people's minds these days. But that's the EU. Google, Apple, Facebook, et al., don't follow those laws for non-EU users. The last two in particular really aren't following the EU laws either (but I digress).

Why are 3rd party trackers allowed to siphon data from us without our permission?

Can you give a specific example? Otherwise the answer to your question is if you've Googled anything for example, you have given permission.

Do you work for free? Of course not. People in search and software services don't work for free either. They've found a way to monetize data.

Now, if you want GDPR-like laws here, and personally I kinda like the option to be forgotten if I want to, then you need to start reaching out to your elected officials and voicing your privacy concerns to them.

how can we neglect 3rd party trackers and other similar kind of actors from getting our data without permission?

• I use duck for search

• I use private mode on the browser by default

• I don't keep the location on with my phone

• I use a VPN, but that's not a fail safe now these days as Big Tech uses DNS to imply information about what you are doing -- as the VPN cannot encrypt the DNS else the server wouldn't know where you're going

• Don't use a free internet email

The solution you're comfortable with is ultimately up to you. Another thing not mentioned in the thread is the use of a proxy. Hide My Ass is such an option. But like with TOR, "your mileage may vary" so to speak.

My tl;dr is:

1. You have a misguided sense of what a "right" is. I mention this not to put you down but to give you a reality check so you can defend yourself better.

2. There's no one size fits all solution to protecting your data. Continue to do research on solutions which will work for your personal requirements.