Microsoft Takes InPrivate Public

Microsoft has recently blogged the details of its “InPrivate” browsing and blocking feature for IE8. InPrivate is a bona fide privacy-enhancing technology; Microsoft should be commended for taking this step. As anyone familiar with the space should realize, InPrivate also fits within and informs the complex history of the online advertising industry.

InPrivate contains several related features that enhance user privacy and control. InPrivate Browsing helps shut down cookie-based tracking by erasing and ceasing to store “history, cookies, temporary Internet files, or other data.” InPrivate Blocking, meanwhile, is “designed to help give you information about third-party content that has a line of sight into your web browsing and gives you a choice about what information you share with these sites.” This feature will automatically “block sites that have ‘seen’ you across more than ten sites,” presumably preventing third-party websites from continuing to track users through non-cookie technologies such as web beacons. InPrivate Subscriptions further allows users to sign up to block content downloads from specific domains.

InPrivate also fits within a greater dialog on online advertising in which Microsoft has been an avid participant. For instance, Microsoft promised in its July 2007 privacy principles around search and online advertising to “continue to develop new user controls that will enhance privacy,” adding that “[s]uch controls may include letting individuals use our search service and surf Microsoft sites without being associated with a personal and unique identifier used for behavioral ad targeting, or allowing signed-in users to control personalization of the services they receive.” InPrivate is certainly a “new user control,” but it does not specifically allow users to surf Microsoft sites anonymously.

Second, the emphasis on “third-party websites” evinced by InPrivate Blocking dovetails with Microsoft’s proposed principles governing behavioral advertising before the Federal Trade Commission. Specifically, Microsoft seeks enhanced privacy requirements for “[t]hird parties engaged in online advertising across multiple, unrelated sites,” because of the relative lack of transparency and the absence of a direct user relationship.

Finally, although InPrivate has impressively sought to tackle some forms of non-cookie tracking, there is no indication that InPrivate will prevent the newest threat on the scene: deep packet inspection. Were InPrivate to be widely deployed, and assuming some resolution to the withering scrutiny of DPI, companies such as NebuAds and Phorm might gain an advantage over website-based advertisers.

In short, InPrivate is a welcome feature and good for consumers, as well as an additional piece of a complex, industry-wide picture.