Add DNT header (Do Not Track)

[ahunt]

I think this is in the "expanded" potential feature list. I believe iOS already does this, and as a privacy focused browser I'm naively assuming we should probably be doing this - I'm therefore filing this now just to make sure we don't forget to make a decision.

[pocmo]

From the feedback we got DNT is basically useless and we won't add it.

[batisteo]

I thought it was a Mozilla initiative. I haven't seen anywhere it's deprecated.

[Rudloff]

DNT is supported by several analytics tools like Piwik, it totally makes sense to enable it in Focus.

[comzeradd]

Many websites respect DNT, including our own (Mozilla) web properties. It makes sense for a browser like Focus to have this enabled by default.

[pocmo]

Re-opening and flagging for triage.

[pocmo]

I want to bring this up for two reasons:

1. Some websites honor DNT and do not add tracking code if the browser adds those (e.g. mozilla.org, theverge.com). Without the header Focus sees and blocks the trackers and counts them. This makes it look like those websites try to track the user ("mozilla has trackers too!!") even though they honor the user's decision.

2. In theory trackers will get de-listed from Disconnect when they start complying with DNT. This means after updating our lists we'd suddenly not block those trackers AND do not tell them that we do not want to be tracked. Firefox always enables DNT in private browsing mode with tracking protection.

Also note that:

• We do not store any data. So traditional "cookie" tracking doesn't work across sessions regardless.

• It seems to be impossible to add DNT headers to all requests WebView makes.

[pocmo]

Should be done when we update the block lists (#856)

[bbinto]

I wanted to resurface this and #856.

This means after updating our lists we'd suddenly not block those trackers AND do not tell them that we do not want to be tracked.

Not quite sure if I understand this correctly. Doesn't the DNT header DO tell them that we don't want to be tracked?

[pocmo]

Not quite sure if I understand this correctly. Doesn't the DNT header DO tell them that we don't want to be tracked?

Yes, what I meant is: We need to send the DNT header in order to not get tracked by the sites that have been removed from the new lists. Right now we do not send the header so we would get tracked if a site is removed from the tracking protection lists.

[pocmo]

This is enabled for GeckoView-based builds.

[Sdaswani]

@ekager can we close this issue? I see a closed PR and something related to GV?

[ekager]

Sounds like GV already has it automatically, let's close this

[bbinto]

Do we expose this somehow via UI or is that auto-on? How would a user know? Anything we should highlight with comms as "comes automatically with gv" /cc ing @vesta0.

I couldn't find any ui in the reference issue

#2857 Add do not track header to settings > Privacy and Security

[ekager]

We get this for free in the switch to GV because we're always in private mode, it is auto-on.

You could include this in the GV marketing for the switch.