Redmond, Washington — With the recent outcome of reports that Google had dodged privacy settings in Apple’s Safari browser, software maker Microsoft on Monday hopped into “Safari Tracking” controversy by accusing the search engine giant Google of circumventing similar privacy protections in Internet Explorer too.
In a blog post, Dean Hachamovitch, corporate vice president for Internet Explorer, explained as to how Microsoft considers Google is avoiding IE privacy policies–“When the IE team discovered that Google had dodged user privacy settings on Safari, we asked ourselves a simple question– is Google circumventing the privacy preferences of Internet Explorer users too?”
With the ongoing scrutinizing process–“We have discovered the answer is yes: Google is employing similar methods to bypass the default privacy protections in IE and track IE users with cookies.” The blog post, which unraveled Microsoft’s findings and offers privacy protection tips, said it has communicated with Google about its concerns and asked it to “commit to honoring P3P privacy settings for users of all browsers.”
IE by default restricts so-called third-party cookies unless a site presents to the browser a P3P Compact Policy Statement describing how the site will use the cookie and pledging not to track the user. P3P is a protocol that websites use to disclose details in a standard format about how they plan to use information availed from users. Third party cookies are those dropped by domains other than the one in the user’s browser address bar.
In the blog post, Hachamovitch explained how the bypass occurs:
Technically, Google employs a nuance in the P3P specification that has the effect of avoiding user preferences about cookies. The P3P specification (in an attempt to leave room for future advances in privacy policies) mentions that browsers should ignore any undefined policies they encounter. Google sends a P3P policy that fails to inform the browser about Google’s use of cookies and user information. Google’s P3P policy is actually a statement that it is not a P3P policy.
P3P-compliant browsers read Google’s policy as stating that the cookie would not be utilized for tracking or any other purpose, he said. “By sending this text, Google bypasses the cookie protection and enables its third-party cookies to be allowed rather than blocked,” he wrote.
Moreover, “Cookies” are small bits of information obtained about your Internet activity. They can be useful–like remembering passwords and settings on sites that you surf to frequently–but there are also concerns about targeted advertising and how much data is really collected.
“Considering this real-world behavior, we are scrutinizing what additional changes to make to our products. The P3P specification says that browsers should ignore unknown tokens,” Hachamovitch said. “Privacy activists involved in the original specification have recently suggested that IE ignore the specification and block cookies with unrecognized tokens. We are actively investigating that course of action.”
Google responded that Microsoft backs a system that is outdated and impractical.
“It is widely known–including by Microsoft–that it is impractical to comply with Microsoft’s request while providing modern Web functionality,” Rachel Whetstone, senior vice president of communications and policy for Google, said in a statement to CNET this evening. “We have been open about our approach, as have many other Web sites.”
“Today the Microsoft policy is widely non-operational,” Whetstone continued. “A 2010 research report indicated that over 11,000 websites were not issuing valid P3P policies as requested by Microsoft.”
Over the weekend, the glitch was uncovered by a Stanford University graduate student, Jonathan Mayer, who published a report that blamed Google and three other ad networks of evading the privacy settings on Apple’s Safari browser to track usage on iPhones and Macs without permission.
Responding to the accusation, Google said the report, which was picked up by the Wall Street Journal, ‘mis-characterizes’ the search giant’s efforts. However, the company acknowledged that a bug accidentally allowed Google cookies “to be set” on Safari and promised a fix.
Nevertheless, Apple did not respond to a request for comment on the Safari tracking issue. But the matter has prompted a response from members of Congress and it is now the subject of a lawsuit.