Microsoft today said that the next major milestone of Internet Explorer 9 (IE9) will let users determine who tracks their movement and behavior online, its response to increasing calls for additional consumer control over the practice.
Privacy experts applauded Microsoft's move.
"This is a good development in the discussion of online tracking,' said Justin Brookman, director of consumer privacy at the Center for Democracy & Technology (CDT), a digital rights advocacy group based in Washington, D.C.
Dubbed "Tracking Protection," the feature will debut in the IE9 release candidate, slated to ship early next year, said Dean Hachamovitch, the Microsoft executive who heads IE development.
Tracking Protection will be opt-in -- it's off by default -- and will rely on published lists that selectively block third-party sites and content embedded in Web sites.
"Consumers have very little awareness of who tracks their online activities," said Hachamovitch in a Webcast with reporters early Tuesday. "We're taking another step today with this new privacy feature."
Tracking Protection Lists, the block lists that IE9 calls on to stymie unwanted tracking, can be created by anyone or any organization, said Hachamovitch. Consumers can subscribe to multiple lists and easily unsubscribe to any, he added, comparing the lists to RSS feeds. "Microsoft will not include any lists with IE9," Hachamovitch said.
"The browser will then block all third party content from the sites or addresses in a list," he continued. "This lets consumers chose which third party sites receive your information and see you online." Users will be able to add a list by clicking on a page, and lists can include exclusions to the blocked addresses.
The lists reside on the user's PC, and are updated weekly as the list maker modifies it.
"The first few lists will probably come from people enthusiastic about technology," Hachamovitch said, noting that early browser releases, such as IE9 beta and the upcoming release candidate, or RC build, are usually downloaded and used by early adopters interested in new technology.
"There are a lot of people who care about privacy on the Web," said Brookman of the CDT. "I expect that there will be a lot of people eager to jump into the space."
Among the candidates, Brookman added, could be organizations like the CDT and the Electronic Frontier Foundation (EFF), a consumer privacy and protection group.
Hachamovitch compared Tracking Protection's lists with the "Do Not Call" list that telephone solicitors are supposed to honor. "You can look at this as a translation of the "Do Not Call" list from the telephone to the browser and Web," he said in an accompanying blog post he wrote today. "It complements many of the other approaches being discussed for browser controls of Do Not Track."
That phrase has been used by the U.S. Federal Trade Commission (FTC), which last week proposed a no-track list as an answer for online privacy concerns.
Hachamovitch and Peter Cullen, the company's chief privacy strategist, who also took part in the Webcast, said that Microsoft has been in discussions with the FTC, as well as with European Union privacy advocates, prior to today. They said the feature was not a direct reaction to regulators' worries.
Instead, Microsoft has opted for an exclusively "opt-in" strategy that requires users to explicitly block selected tracking content.
Some experts said it was a good first step, but wanted more.
"IE9 Tracking Protection is a great privacy feature ... but as Microsoft itself notes, it is complementary to -- not a substitute for -- Do Not Track," said Jonathan Mayer, a graduate student in computer science and law at Stanford University, in a Twitter message Tuesday.
Mayer is one of two principal researchers at Stanford working on a Do Not Track technology that relies on an HTTP header to universally opt out of all online tracking.
Nor does Tracking Protection replace InPrivate Filtering, another privacy feature that first appeared in IE8. InPrivate Filtering also lets users block third-party content within sites, but is part of the browser's overall privacy mode, which doesn't log visited sites to the user's browsing history.
When asked how Tracking Protection will affect advertisers, which track users to serve targeted Web ads, Cullen sidestepped the question during the Webcast, saying, "This will be an enormous opportunity for the industry."
In a blog post of his own, however, Cullen fleshed out Microsoft's position. "We are hopeful that our efforts and those of others in the industry will further support consumer choice, while continuing to support a robust and vibrant Internet which serves consumers, advertisers and publisher interests."
Microsoft will collect feedback from IE9 users, advertisers and others after the feature debuts in the release candidate, and may modify Tracking Protection based on what it hears. "This is only the start of the discussion," said Cullen.
"There are a lot of questions about how Do Not Track [as proposed by the FTC] should and would work," observed Brookman of the CDT. "But Microsoft will be the first to take it live. And it's a good idea."
The CDT has called on Microsoft and others to implement anti-tracking technology for years, particularly in the run-up to the 2006 launch of IE8. Microsoft considered, but dropped the idea then, however, after company executives balked, according to a Wall Street Journal story last August.
"[The Wall Street Journal] is the source on the Hill," said Brookman, who credited the newspaper's series on online tracking for having prompted the recent moves by the FTC, Microsoft and others. "It had tremendous influence."
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer or subscribe to Gregg's RSS feed . His e-mail address is gkeizer@computerworld.com.