Making Tracking Protection Lists Available From Your Web Site

  • Article

Any site can offer Tracking Protection Lists (TPLs) to help consumers protect their privacy. This post shows you how to make a TPL available from your site. For example, clicking here in IE9 will add the list from the EasyPrivacy.

A word about Tracking Protection Lists

Tracking Protection Lists are similar in concept to the lists behind the AdBlockPlus add-in for Firefox. The main differences are that TPLs are built in to IE, the W3C is working through the standardization process of their format, and adding a TPL in IE sends the DNT header (link).

Technically, TPLs are just text files that can be hosted on any Web server and linked to from any Web page, like an RSS feed for a blog. You can find TPLs at several different sites, like the IE gallery site (linked to from the Manage Add-ons dialog within IE), the EasyList Web site, or on other sites like this one.

Let’s use the EasyPrivacy TPL as our example. The TPL is located on the EasyList webserver at https://easylist-msie.adblockplus.org/easyprivacy.tpl. Following that link in any browser will show the contents of that list… useful for privacy enthusiasts, but not as much for consumers who want to add the list.

Internet Explorer 9 includes a JavaScript API, msAddTrackingProtectionList (link), to do this:

<a href="javascript:window.external.msAddTrackingProtectionList('https://easylist-msie.adblockplus.org/easyprivacy.tpl', 'EasyList Privacy')">EasyPrivacy TPL</a>

Clicking on this link results in a user confirmation prompt:

Dialog confirming the addition of a Tracking Protection List

This makes sure that the consumer really wanted the list, and that the site isn’t installing it without user consent. This is like a pop-up blocker against unwanted TPLs.

For security reasons, msAddTrackingProtectionList can only be called from places in your page that are associated with a user interaction – buttons, links, forms, etc. are all fine. It can’t be called on page load automatically. Another benefit of using a JavaScript API is that you can easily deploy a TPL from your Web site without having to change your server configuration; for example, no custom MIME types are required.

If you’re passionate about privacy, consider adding a link to your favorite TPL on your own Web site.

—Andy Zeigler, Program Manager, Internet Explorer