Skip to content

privacy-tech-lab/gpc-optmeowt

Repository files navigation

GitHub release (latest by date) GitHub Release Date GitHub last commit GitHub issues GitHub closed issues GitHub GitHub watchers GitHub Repo stars GitHub forks


OptMeowt logo

OptMeowt 🐾

OptMeowt ("Opt Me Out") is a browser extension for opting you out from web tracking. OptMeowt works by sending Do Not Sell signals to visited websites per the Global Privacy Control (GPC) spec that we are developing at the W3C and placing opt out cookies.

Firefox Add Ons badge Chrome Web Store badge

OptMeowt is developed and maintained by Kuba Alicki (@kalicki1), Oliver Wang (@OliverWang13), and Sebastian Zimmeck (@SebastianZimmeck) of the privacy-tech-lab. Stanley Markman (@stanleymarkman), Kiryl Beliauski (@kbeliauski), Daniel Knopf (@dknopf), and Abdallah Salia (@asalia-1) contributed earlier.

How does OptMeowt work?

OptMeowt sends Do Not Sell signals to websites when you browse the web. Such signals must be respected for California consumers per the California Consumer Privacy Act (CCPA), Regs Section 999.315(d). Some companies also respect them when they are sent from outside of California. OptMeowt also places opt out cookies.

In detail, OptMeowt uses five methods to opt you out:

  1. The GPC header and JS property.
  2. The DNT header.
  3. First party cookies of ad networks participating in the IAB CCPA Compliance Framework for Publishers & Technology Companies.
  4. Third party cookies of ad networks participating in the DAA's CCPA Opt Out Tool for the Web.

Customizing which sites receive Do Not Sell signals: For every site you visit OptMeowt will automatically add its domain to the domain list. Each newly added domain will receive Do Not Sell signals by default. However, you can exclude domains that should not receive Do Not Sell signals. This functionality is available on OptMeowt's settings page, which you can access from OptMeowt's popup window.

Installing OptMeowt from Source

  1. Clone this repo locally or download a zipped copy and unzip it.
  2. Install npm.
  3. From within your local /gpc-optmeowt/ directory install OptMeowt's dependencies with npm ci.
  4. Build the project by running npm run build, which will create a built for both Chrome and Firefox in .../gpc-optmeowt/dist/chrome/ and .../gpc-optmeowt/dist/firefox/, respectively. npm run build will also create packaged versions of OptMeowt in .../gpc-optmeowt/packages for distribution on the Chrome Web Store and on Firefox Add-Ons.

Chrome

  1. In Chrome, navigate to the extensions page at chrome://extensions/.
  2. Enable Developer mode with the slider on the top right corner of the extension page.
  3. Click the Load unpacked button in the top left of the page.
  4. Select the directory where you built OptMeowt, by default /gpc-optmeowt/dist/chrome/ (the directory that contains the `manifest.json``).

Firefox

  1. In Firefox, navigate to the addons page with developer privileges at about:debugging#/runtime/this-firefox.
  2. Under Temporary extensions, click Load Temporary Add-on...
  3. Select the manifest from the directory where you built OptMeowt, by default /gpc-optmeowt/dist/firefox/manifest.json/.

Note: OptMeowt is in active development and new features are frequently added, some of which may cause errors. You can always get the stable release version on the Chrome Web Store and on Firefox Add-Ons.

Installing OptMeowt for Developers

To build the development versions of OptMeowt follow the directions above but replace npm run build with npm run start. This command will run the npm script (referenced in package.json) that will call Webpack in development mode (Webpack settings in webpack.config.js). npm run start will also initiate Webpack servers for both the Firefox and Chrome versions, which will listen for changes as you work and rebuild as necessary.

Webpack and file structure notes:

Webpack will build the development versions of OptMeowt into the dev subdirectory instead of the dist subdirectory. The subdirectories for Chrome and Firefox are dev/chrome and dev/firefox, respectively.

Also, when you build for development, the development manifest (in src/manifest-dev.json) will be used instead of the distribution manifest (in src/manifest-dist.json). The development manifest contains an unsafe eval that we use for our source maps during development. The distribution manifest does not contain this eval. Webpack will select the correct manifest depending on whether you build for development or distribution.

To include new dependencies you can run npm install instead of npm ci. npm install will include new dependencies in the package-lock.json, which is generated from the package.json.

For Windows users:

Note that we have built most of our codebase in MacOS, so path variables and similar code may cause the build to break in other OSs, in particular Windows. We recommend installing a Linux OS if you will be working with the codebase in any significant manner.

Optional

We also like to use Debugger for Firefox from within VSCode when in development to help automate loading the built extension package. The default behavior is F5 to launch and load the extension in browser. There is a similar extension for Chrome, Debugger for Chrome. Make sure to follow the online documentation on writing the correct .vscode/launch.json file, or other necessary settings files, in order to properly load OptMeowt with the debugger.

OptMeowt's Permission Use

Note: We do not collect any data from you. Third parties will also not receive your data. The permissions OptMeowt is using are required for opting you out. To that end, OptMeowt uses the following permissions:

"permissions": [
    "webRequest",
    "<all_urls>",
    "webRequestBlocking",
    "webNavigation",
    "storage",
    "activeTab",
    "cookies",
    "tabs"
  ]
  • webRequest: Pauses outgoing HTTP requests to append opt out headers
  • <all_urls>: Allows modification of outgoing HTTP requests
  • webRequestBlocking: Necessary for pausing outgoing HTTP requests
  • webNavigation: Similar to webRequest, allows OptMeowt to check when navigation requests are made to reset processes
  • storage: Allows OptMeowt to save your opt out preferences in your browser
  • activeTab: Allows OptMeowt to set opt out signals on your active browser tab
  • cookies: Allows OptMeowt to place opt out cookies in your browser
  • tabs: Allows OptMeowt to keep track of HTTP headers per tab to show you the opt out status of the current site in a popup

OptMeowt's Architecture

Detailed information on OptMeowt's architecture is available in a separate readme.

Directories in this Repo

  • src/: Main contents of the OptMeowt browser extension.
  • src/assets: Graphical elements of the extension, including logos and button images.
  • src/background: Listeners for events and logic for placing cookies.
  • src/data: Definitions of headers, cookies, and privacy flags.
  • src/options: UI elements and scripts for the supplemental options page.
  • src/popup: UI elements and scripts for the popup inside the extensions bar.
  • src/theme: Dark and light mode themes.
  • ui-mockup: Contains PDF and XD files demonstrating the preliminary mockup and analysis of OptMeowt.

Third Party Libraries

OptMeowt uses various third party libraries. We thank the developers.

Developer Guide

Keyboard Shortcuts

Analysis Mode

  • Alt+Shift+A β€” runs analysis (eq. to clicking Run Analysis in popup)
  • Alt+Shift+S β€” stops analysis (eq. to clicking Stop Analysis in popup)

Reminder: Users must "stop analysis" prior to changing sites to prevent recording incorrect data

Other Notes

  • If you want to contribute, note that we manage all library dependencies with npm. Thus, it is recommended to use npm i to install libraries.
  • When viewing your browser's console on a site, a 404 error regarding the domain's GPC status file (/.well-known/gpc.json) may be shown. Note that this is normal and will occur (1) on domains that do not support GPC and (2) on domains that support GPC but do not host a /.well-known/gpc.json file.
  • If you have questions about OptMeowt's functionality or have found a bug, please check out our FAQ \ Known quirks page on the Wiki first. If you cannot find what you are looking for, feel free to open an issue, and we will address it.

More Information 🐈

Learn more here.

privacy-tech-lab logo