Evan Schuman's StorefrontBacktalk

Retailers could really use some cooperation from vendors these days—or at least fewer surprises—when it comes to following privacy policies. Right, that’ll happen. As of last week, Microsoft and the Apache Web server project are feuding over how Apache (the most widely used Web server) will handle Do Not Track features of Internet Explorer (the most widely used Web browser).

Unfortunately, the two software suppliers aren’t just throwing the usual hissy fits at each other. They’re configuring their software as part of the feud, which means retailers and their online privacy policies and, potentially, the Federal Trade Commission are caught in the middle.

The fight stems from Do Not Track, which is part of the not-yet-released IE 10. Microsoft has decided to turn on Do Not Track by default, so the browser will inform Web sites that the user’s Internet movements shouldn’t be tracked. Sounds reasonable, if overly protective, right?

Trouble is, the Do Not Track standard, which is being developed by the World Wide Web Consortium, is a voluntary standard that requires cooperation from everyone in the Web-browsing chain. That, in turn, means the Do Not Track header is supposed to reflect a conscious decision on the part of the user, not a default setting, according to Roy Fielding, an Apache co-founder who’s also on the Do Not Track standards committee.

So Fielding wrote a patch to force Apache Web servers to ignore Microsoft’s default Do Not Track setting that’s now part of the latest stable version of Apache. That sounds extreme, but online advertising organizations have already said they’ll ignore Microsoft’s default setting, claiming it violates what was negotiated as part of the self-regulation standard. Other browser makers have also criticized the Microsoft action.

Fielding also doesn’t think Microsoft is being benevolent and protective: “The decision to set DNT by default in IE 10 has nothing to do with the user’s privacy,” he wrote. “Microsoft knows full well that the false signal will be ignored, and thus prevent their

own users from having an effective option for DNT even if their users want one. You can figure out why they want that.”

Who’s right? Who cares? Vendor feuds are a fine spectator sport. And none of this would matter to retailers—except that every big chain has a published privacy policy on its Web site, and many of those policies specify that the chain will go along with customers’ privacy preferences.

Remember, violating a privacy policy is one of the few ways a chain can get into privacy trouble with the otherwise largely toothless FTC.