13:02:20 RRSAgent has joined #dnt 13:02:20 logging to http://www.w3.org/2011/09/21-dnt-irc 13:02:34 rrsagent, make logs public 13:03:01 fielding has joined #dnt 13:05:16 scribenick: karl Scribe: karl, clp, cris 13:03:18 Meeting: Tracking Protection WG F2F - Day 1 - 21 September 2011 13:03:28 Topic: Intro Chair: Aleecia M. McDonald (aleecia), Matthias Schunter (schunter) 13:04:48 tlr has joined #dnt 13:04:50 Matthias Schunter http://lists.w3.org/Archives/Public/public-tracking/2011Sep/0021 is introducing the goals of the group 13:06:16 matthias: my goal being referee and moderator in this group. very aware of my own privacy 13:06:41 jmayer has joined #dnt 13:06:54 ... Instead of having 50 niche solutions, we would like to get a shared solution. 13:07:10 fjh has joined #dnt 13:07:39 Zakim, who is here? 13:07:39 Team_(dnt)13:00Z has not yet started, fjh 13:07:40 On IRC I see fjh, jmayer, tlr, fielding, RRSAgent, karl, EdFelten, aleecia, kcs, clay, Zakim, npdoty, mischat, hober 13:07:48 ... Our solution must aim at improving the privacy in a way that privacy advocate can support 13:08:11 enewland has joined #dnt 13:08:15 EdFelten has left #dnt 13:08:18 ... I have no clear idea on how to do it. So we need your input. 13:08:30 edfelten has joined #dnt 13:09:06 kcs1 has joined #dnt 13:09:13 ifette has joined #dnt 13:09:13 ... We want a solution which is reasonable and efficient. Not big, but simple. And something that anyone can support. 13:10:09 ... there is no really viable alternative. Things will stay the same and shattered across the industry. 13:10:20 ... The mission is challenging, sometimes perceived as impossible. 13:10:58 ... We will need constructive inputs, sometimes thinking out of the box. I value progress. 13:11:15 tl has joined #dnt 13:11:25 ... We will be using the W3C tracking tool to help us. 13:11:41 ... Do not wait the last minute for giving your input. 13:11:49 ... Early input is very valuable. 13:12:17 ... Everybody is allowed to ask questions. I will myself ask many stupid questions. 13:12:38 ... please use the queue for asking questions. 13:12:46 ... your hands for new topics 13:13:01 ... your pen for for answering 13:13:04 q+ 13:13:07 q- 13:13:25 aleecia: Use also IRC 13:13:36 Zakim, who's your daddy? 13:13:36 Ralph is taking good care of me but you all are my family, ifette 13:13:42 matthias: It will not be easy. 13:14:00 ... We will not be able to solve these in two days. 13:14:08 ... let's get started. 13:14:27 13:14:36 Dan has joined #dnt 13:15:10 scott has joined #dnt 13:15:28 Cris has joined #dnt 13:15:45 matthias: I would like to do a quick round. 3 min each. 13:15:53 ... - who you are? 13:16:05 ... - 2 to 3 success criterias 13:16:18 ... - where are you from? 13:16:57 Team_(dnt)13:00Z has now started 13:17:04 + +1.617.715.aaaa 13:17:47 alex_ has joined #dnt 13:18:04 Zakim, aaaa is StarConferenceRoom 13:18:05 +StarConferenceRoom; got it 13:18:27 ... we will be writing our success criteria on post it notes and we be sticking them on the wall. 13:21:28 jkaran has joined #dnt 13:22:34 Scribe: ifette 13:22:45 Zakim, who is on the phone? 13:22:45 On the phone I see StarConferenceRoom 13:24:46 Agenda+ Intros 13:24:55 take up agendum 1 Topic: Introductions 13:24:58 ErikaMcCallister, NIST, lots of standards, but just observing today 13:25:31 tlr: A broadly deployed spec quickly 13:25:40 ClayWebster: CBS, representing online publishers 13:25:45 ... not too many publishers here. 13:26:13 ... third party definition that helps consumer privacy 13:26:23 KevinTrilli: TRUSTe 13:26:44 ... understand how browser works with ad solution 13:26:52 s/ad solution/ad tag solution/ 13:26:59 ... has been US centric so far, different in EU 13:27:16 ... large band of consumers with different values, need to consider people with extreme privacy protection and safe advertising 13:27:32 ... complex topic, consumers haven't done well with cookie controls, need to avoid niche solutions 13:27:39 EricaNewland: CDT 13:27:46 rrsagent, bookmark? 13:27:46 See http://www.w3.org/2011/09/21-dnt-irc#T13-27-46 13:28:01 DavidWainberg: observing 13:28:06 David has joined #dnt 13:28:10 ... want to see policy drive more than technology 13:28:29 s/CDT/CDT: want to help consumers/ 13:28:30 Kevin has joined #DNT 13:28:36 RoyFielding: UX and content management side 13:29:01 ... clear definition of tracking 13:29:03 s/UX/representing Adobe, UX/ 13:29:21 ... tell websites I don't want to be tracked is a bad summary, people don't know what it means and it's over-broad 13:29:27 ShaneWiley: Yahoo 13:29:44 ... balance privacy and datacenter operations 13:29:50 ... take into consideration self regulatory work 13:29:59 ... let consumers selectively exercise control 13:30:05 ChrisOlsen: Privacy at FTC 13:30:14 ... supporting self regulating efforts to improve transparency, customer choice 13:30:25 ... preliminary report laid out criteria for a consumer control mechanism 13:30:49 ... universality, ease of use, persistence, effective, enforceable, addresses collection not just use. Want definitions. 13:30:54 rrsagent, bookmark? 13:30:54 See http://www.w3.org/2011/09/21-dnt-irc#T13-30-54 13:31:12 ... third party issues also important 13:31:46 EdFelten: Chief technologist at FTC. Provide consumers with effective choice and confidence to consumers that they will get what they think they are going to get. Allow for reasonable innovation in industry 13:31:55 ... areas with not so much controversy, hope we can move towards concerete standards 13:32:02 ... hope we can move towards consensus on others 13:32:04 schunter has joined #dnt 13:32:23 Bret Errer: echo adobe, what does tracking mean definition-wise? 13:32:41 ... is "tracking" an encumbered term? 13:32:45 s/Bret Errer/BrettError/ 13:33:10 JonathanMayer: stanford, care about getting a definition that gives choice over data collection not just use. Want path to adoption in browsers and industries. 13:33:21 ... want to do it in a few months 13:33:34 13:34:09 EdOConnor: WebKit team at Apple, success: making sure we have definitions and descriptions clear to users, implementers, authors 13:34:18 ... technology people are willing to interoperably implement 13:34:21 KevinSmith: Adobe 13:34:30 ... wanted to see Cheers 13:34:33 ... got to see it last night 13:34:44 ... clear concise definitions 13:34:56 ... implementation 13:35:03 Brett has joined #dnt 13:35:24 CharlesPerkins: freelance identity and relationship nuance, XMPP Jabber etc at IETF. Success: definition of who you are. True name vs pseudonymity 13:35:47 ... important even in the context of tracking, pseudonymous status may allow more tracking if it's truly pseudonymous 13:35:55 ... hoping to have core spec with extensions to allow more complexity later 13:36:16 AleeciaMcDonald: thrilled to see diverse representation at the group 13:36:19 ... success is about end users 13:36:34 ... variation in what people want 13:36:44 ... better ads, personalization... vs concern about privacy 13:36:50 ... and swing voters in the middle 13:36:56 ... many ppl don't understand technlology in the background 13:37:03 s/technlology/technology/ 13:37:07 ... stop the arms race 13:37:16 ... user preference, enable people to take direct steps with TPLs, 13:37:21 ... enables business to thrive and flourish 13:37:26 ... implementable 13:37:44 MatthiasSchunter: IBM, tried to make criteria clear earlier 13:37:49 ... I'm a European 13:37:59 ... get European inputs and get link to EU regulators 13:38:11 ... don't want 50 different solutions (for different regions) 13:38:23 NickDoty: W3C and UC Berkeley 13:38:30 ... share criteria 13:38:38 ... want to see the process itself work 13:39:00 JulesPaulinetsky: future of privacy forum 13:39:05 ... push the process along 13:39:19 PeterXXX: technology director at EFF 13:39:47 Names: Jules Polonetsky, Peter Eckersley 13:39:50 s/XXX/Eckersley/ 13:39:57 ... criteria for success: based on a belief that third party ads / metrics need things from server logs that can be delivered by strongly anonymous methods, but not enough incentive for development for those methods 13:40:05 ... incentivize industry participants to develop and deploy those methods 13:40:27 s/Paulinetsky/Polonetsky/ 13:40:30 ... whatever community delivers should be simple way to gain control over who records your activities 13:40:46 ... subtle and hard, but need to partition issue of data retention for fraud detection purposes from other purposes 13:40:57 ... find a way to make sure fraud detection doesn't become back channel for how tracking happens 13:41:33 SeanHarvey: Google, straightforward goals. Common standard, easy to use, genuinely useful without undue / unnecessary harm to industry 13:41:54 IanFette: Google, from Chrome team and speaking in that context 13:42:10 tl has joined #dnt 13:42:12 KimonZorbas: IAB in Bruxelles 13:42:20 ... difficult to define what is meaningful for users, different challenges and interests 13:42:27 ... not forget different jurisdictional backgrounds 13:42:33 ... debate in Europe alien to privacy framework they haev 13:42:36 s/haev/have 13:42:44 ... look at how the pieces fit into a larger / bigger framework 13:42:53 AlexDeliyannis: With Nielsen 13:43:03 ... people know what we do 13:43:21 ... able to measure audiences from different web contexts / pages 13:43:29 ... and should be device agnostic 13:43:41 ... what we come up with on the internet, but there's devices on the net using other protocols 13:43:51 ... do we want to have something for these devices as well 13:43:58 ... give people using Roku, smart TV etc confidence 13:44:05 ... backwards compatability 13:44:20 FrederickHirsch: Nokia 13:44:26 ... observing at the present 13:44:56 ... understand how it fits into larger issue of privacy. convey user intent. Issues of secondary use, retention 13:45:03 ... related to DNT 13:45:26 DanMcKinney: product development for WPP digital 13:45:30 ... several businesses 13:45:30 Hi Ian -I'm from DoubleVerify - I saw you didn't catch my intro. We are here to ensure that the standards decided on here can be incorporated into our DAA Self-regulatory program product (we are a certified vendor of the DAA). 13:45:42 ... looking for clear definition on what "track" is 13:45:57 List of WG Participants<-http://www.w3.org/2000/09/dbwg/details?group=49311&public=1 13:46:02 ScottJulian: effective measure. Same vein as Nielsen. 13:46:12 ... I'm australian, but we operate in SE asia / EMENA 13:46:24 ... success criteria about guidance 13:46:35 ... came to have a great framework people agree on that we can quickly implement 13:46:50 CrisFrancisco: Software development at Blue Cava 13:46:57 ... fraud detection and online advertisement 13:47:04 ... definition on types of data impacted by DNT 13:47:12 ... do not collect behavioral ad data, or broader 13:47:16 ... first vs third party 13:47:24 ... consistent across browsers 13:47:40 ... balance between consumer privacy tools while supporting benefits of advertising supported internet 13:47:45 ThomasLowenthal: M ozilla 13:47:51 s/M ozilla/Mozilla/ 13:47:57 ... come up with a definition that works for users 13:48:01 ... feature users will actually want to use 13:48:06 ... not break the open web 13:48:28 ... have to be able to create a nice UI for. Concise expression even if there's complexity behind the scenes 13:48:36 MikeZaneis: IAB from DC office 13:48:38 ... echo David 13:48:47 ... hope policy will drive and technology will inform 13:49:03 ... working through first vs third party issues important 13:49:12 ... represent DAA (digital advertising alliance). self regulatory body in the US 13:49:27 ... working to get members into compliance 13:49:39 ... hope we won't add confusion to marketplace 13:49:44 ... beginning to see consistency in market 13:50:06 AmyColando: Microsoft, want a healthy and robust ecosystem for providers, consumers 13:50:11 ... alignment with self regulatory work 13:50:26 ... personally, want to better understand W3C process 13:50:28 KarlDubost: Opera 13:50:34 ... previously W3C 13:50:46 ... privacy is not binary thus binary solutions will fial 13:50:48 s/fial/fail/ 13:50:53 ... super easy to implement system 13:51:01 ... if it's too complex people won't do it 13:51:08 "ideally one day to implement" 13:51:15 ... allow users to block without saying it. don't disclose i am blocking things 13:51:22 ... set the right expectation for users 13:51:36 SueGluck: Microsoft 13:51:47 ... IE privacy lawyer as well as Windows privacy lawyer 13:51:48 s/Gluck/Glueck/ 13:51:57 ... not experienced with W3C, looking forward to learning more and appreciate patience 13:52:08 Dan_ has joined #dnt 13:52:20 ... success learn more about how the technology works on advertising side 13:52:41 ... we all need to expand our sphere of knowledge and stand in each others' shoes 13:52:52 ... we all need to represent the people not in the room, e.g. consumers 13:52:56 ... but also small publishers 13:53:18 ... finally, this should be simultaneously easy to implement even for smaller businesses 13:53:29 ... and something consumers can understand 13:53:32 ... want balance 13:53:54 RichardWeaver: deputy privacy officer at Comscore 13:54:04 ... reaching consumers and making sure they understand what's happening 13:54:21 ThomasPottjegort: Comscore, responsible for data collection 13:54:42 ... want to be ethical and do the right thing 13:55:05 rrsagent, bookmark? 13:55:05 See http://www.w3.org/2011/09/21-dnt-irc#T13-55-05 13:55:35 schunter: happy to see overlap in goals 13:56:40 Zakim, close this agendum 13:56:40 agendum 1 closed 13:56:41 I see nothing remaining on the agenda 13:56:45 Agenda+ walk through agenda 13:56:50 Zakim, next agenda 13:56:50 agendum 2. "walk through agenda" taken up [from ifette] 13:56:49 http://www.w3.org/2011/tracking-protection/agenda-20110922 13:56:59 MatthiasSchunter: will walk through W3C process 13:57:02 ... then a break 13:57:07 Agenda+ W3C process 13:57:24 Agenda+ presentation by Thomas of Princeton workshop results 13:57:45 Agenda+ Aleecia walking us through the charter 13:58:21 Agenda+ group exercise clustering expectations 13:58:41 Agenda+ actual work (regulatory definition items) 13:58:44 Agenda+ technology items 13:58:50 Zakim, agenda? 13:58:50 I see 7 items remaining on the agenda: 13:58:52 2. walk through agenda [from ifette] 13:58:54 3. W3C process [from ifette] 13:58:55 4. presentation by Thomas of Princeton workshop results [from ifette] 13:58:57 5. Aleecia walking us through the charter [from ifette] 13:58:59 6. group exercise clustering expectations [from ifette] 13:59:01 7. actual work (regulatory definition items) [from ifette] 13:59:03 8. technology items [from ifette] 13:59:31 ... dinner at Legal Seafood 13:59:38 ... self hosted dinner, but have reservation 14:00:32 ... tomorrow we will talk about technical deliverables 14:01:45 ... if you want to reach consensus, all proposals must be discussed in a larger group 14:01:45 Are we talking about task forces here? 14:01:49 Nope 14:01:53 ... this group doesn't decide for everyone what to think 14:02:20 The idea was to perhaps have smaller subgroups, then come back together to discuss more fully 14:02:23 davidwainberg has joined #dnt 14:02:31 ... should we do things differently? other opinions? 14:02:38 ... people want break? 14:02:59 RoyFielding: editors need to be selected for the three drafts 14:03:06 AleeciaMcDonald: editors not yet announced 14:03:40 Matthias: if you are interested in editing, ping us 14:03:49 For example, 5 groups all talking about the same thing at once, coming together to then talk through the issue 14:04:54 Zakim, close agendum 14:04:54 I don't understand 'close agendum', ifette 14:05:01 Zakim, close this agendum 14:05:01 agendum 2 closed 14:05:02 I see 6 items remaining on the agenda; the next one is 14:05:04 3. W3C process [from ifette] 14:06:33 suegl has joined #dnt 14:08:03 Zakim, who is on the phone? 14:08:03 On the phone I see StarConferenceRoom 14:09:49 kcs has joined #dnt 14:11:59 Zakim, next agendum 14:11:59 agendum 3. "W3C process" taken up [from ifette] 14:12:00 amyc has joined #dnt 14:12:09 tlr: ... thsi discussion is inevitable 14:12:09 agenda: http://www.w3.org/2011/tracking-protection/agenda-20110922 14:12:12 s/thsi/this/ 14:12:22 Zakim, agenda? 14:12:22 I see 6 items remaining on the agenda: 14:12:23 3. W3C process [from ifette] 14:12:25 4. presentation by Thomas of Princeton workshop results [from ifette] 14:12:27 5. Aleecia walking us through the charter [from ifette] 14:12:29 6. group exercise clustering expectations [from ifette] 14:12:30 ... W3C is a consensus organization 14:12:31 7. actual work (regulatory definition items) [from ifette] 14:12:32 8. technology items [from ifette] 14:12:49 ... listen to each other, work through iissues in cooperative spirit 14:13:02 ... tools built to support that 14:13:08 ... another value is interoperability 14:13:18 ... works and uniform in the right way, implementable 14:13:25 ... not here to write xforms2 14:13:33 s/xforms2/something that cannot work on the web at large/ 14:13:48 ... something that fits into the overall architecture of the web, not break foundational architecture 14:14:27 ... next, want a comprehensible spec that has meaning and is useful 14:14:31 ... how do we get there? 14:14:50 ... prep phase (at the end now) 14:15:17 ... then start a WG, which works on documents 14:15:36 ... next break would be a great time to volunteer to edit 14:16:08 ... iterate, build consensus over time and publish working drafts along the way 14:16:16 ... WDs ARE drafts and will have open questions 14:16:29 ... eventually will get to last call 14:16:35 ... get broad public review 14:16:47 ... work through comments 14:17:01 ... then candidate recommendation 14:17:06 ... collect information about implementations 14:17:19 ... then formal review (proposed recommendation) 14:17:35 ... tools: Mailing list public-tracking@w3.org 14:17:40 ... irc (here) 14:17:42 alex_ has joined #dnt 14:17:45 ... and issue and action tracker 14:17:48 http://lists.w3.org/Archives/Public/public-tracking/ 14:18:04 if anyone is still having issues with the mailing list, please let me know 14:18:39 ACTION: tlr to close this action, created as an example so people can see what actions look like and where they are DUE 2011-09-25 14:18:40 Created ACTION-2 - Close this action, created as an example so people can see what actions look like and where they are DUE 2011-09-25 [on Thomas Roessler - due 2011-09-28]. 14:18:54 http://www.w3.org/2011/tracking-protection/track/ 14:19:08 ACTION-2? 14:19:08 ACTION-2 -- Thomas Roessler to close this action, created as an example so people can see what actions look like and where they are DUE 2011-09-25 -- due 2011-09-28 -- OPEN 14:19:08 http://www.w3.org/2011/tracking-protection/track/actions/2 14:19:10 Kevin has joined #DNT 14:19:20 tlr: issue tracking helps structure the discussion 14:19:30 ... open questions (what about third party? is this or that involved?) 14:19:36 ... these are distinct things that can be tracked 14:19:41 kimon has joined #dnt 14:19:44 ... WGs keep public lists of issues 14:19:57 ISSUE: Example issue to be closed, so people can see what an issue looks like. 14:19:58 Created ISSUE-1 - Example issue to be closed, so people can see what an issue looks like. ; please complete additional details at http://www.w3.org/2011/tracking-protection/track/issues/1/edit . 14:20:21 trackbot, close ISSUE-1 14:20:22 ISSUE-1 Example issue to be closed, so people can see what an issue looks like. closed 14:20:22 + +1.949.483.aabb 14:21:33 close ACTION-2 14:21:33 ACTION-2 Close this action, created as an example so people can see what actions look like and where they are DUE 2011-09-25 closed 14:21:46 http://www.w3.org/2011/tracking-protection/track/changelog 14:21:54 tlr: in issues we explain where we are coming from, respond comments 14:22:02 ... we also accept comments from the public during the process 14:22:07 ... mailing list is publcly archived 14:22:34 ... issues also help the group to document issues and not come back to the same issues forever, determine what the group's status is 14:22:39 ... encourage discussions on mailing list 14:23:15 ... publishing drafts is another key component 14:23:22 ... we have an aggressive schedule 14:23:31 ... publish drafts with lots of open issues to get early review and visibility 14:23:34 ... drafts visible to public 14:24:01 ... minutes are also public 14:24:03 q+ to use dvcs.w3.org for editor's drafts 14:24:09 So drafts are published, but any questions go into the issues list, correcT? 14:24:10 ... taken on IRC and published 48h after 14:24:32 jkaram, questions typically come to the mailing list and the working group members and/or chairs open issues or actions based on those questions/comments 14:24:42 tlr: discusses irc commands 14:24:47 q+ 14:24:50 q- 14:24:58 zakim, mute me 14:24:58 sorry, aleecia, I do not know which phone connection belongs to you 14:25:01 <[Thomas]> [Thomas] has joined #dnt 14:25:12 zakim, who is on the phone? 14:25:12 On the phone I see StarConferenceRoom, +1.949.483.aabb 14:25:17 Mike has joined #dnt 14:25:25 tlr: we do collaborative scribing. everyone is a potential victim 14:25:31 (if it wasn't clear - zakim is a bot, not a human) 14:26:10 ACTION-2? 14:26:10 ACTION-2 -- Thomas Roessler to close this action, created as an example so people can see what actions look like and where they are DUE 2011-09-25 -- due 2011-09-28 -- CLOSED 14:26:10 http://www.w3.org/2011/tracking-protection/track/actions/2 14:26:12 pde has joined #dnt 14:26:12 ISSUE-1? 14:26:12 ISSUE-1 -- Example issue to be closed, so people can see what an issue looks like. -- closed 14:26:12 http://www.w3.org/2011/tracking-protection/track/issues/1 14:27:08 tlr: actions need to have clear owner, date 14:27:16 ... if you can't do it, find someone else or change the date 14:27:36 ^change the date^go back to the group/chairs 14:27:44 ...ideally early 14:27:47 aleecia, depends on the group 14:27:48 edfelten has left #dnt 14:28:02 efelten has joined #dnt 14:28:04 tlr: discusses meaning of consensus (look at the slides) 14:29:08 is there a page somewhere that documents these queue management and issue management tools? 14:29:33 Tracker documentation http://www.w3.org/2005/06/tracker/ 14:29:39 http://www.w3.org/2005/06/tracker/irc 14:29:41 ... generally we achieve consensus people can live with. not everyone will necessarily be enthusiastic 14:29:51 Zakim IRC documentation http://www.w3.org/2001/12/zakim-irc-bot 14:30:28 tlr: discusses standing and what good standing means 14:31:02 ... currently not intending to apply "bad standing" / "good standing" to this WG 14:31:12 ... but important people consider the reasoning of the points behind "good standing" 14:31:12 anyone mind if I put these in the channel status while people may still be joining? 14:31:22 Kevin_ has joined #dnt 14:31:23 ... e.g. please show up to groups 14:31:45 ... and deliver action items in time 14:31:56 fjh has joined #dnt 14:32:32 tlr: finally, respect conflict of interest polict 14:32:35 s/polict/policy 14:32:42 ... if you are in three companies please disclose all three 14:32:48 ... no covert agents 14:33:13 KevinT has joined #dnt 14:33:42 tlr: last call - this is where we think we're done, we get broader review and address issues and document dependencies 14:33:49 ... we're not really done at that point though 14:34:44 ... group needs to address all comments 14:35:06 ... some may be previously considered, at which point you provide a link to previous discussion 14:35:18 ... unless new points are raised at which point we may reopen discussion 14:35:26 ... there is a back and forth with the commenters 14:35:51 ... after LC is a call for implementations 14:36:04 ... group collects information about implementations and whether there are problems in the spec w.r.t. implementation 14:36:19 ... then transition to formal review 14:36:35 tlr: left the patent policy out of the slides 14:36:36 ... oops 14:36:44 ... want to produce specs implementable on a royalty free basis 14:38:02 q? 14:38:23 I forgot to mention that I am on the board of the Apache Software Foundation, which is also a W3C member, but my role here is just to represent Adobe 14:38:28 JonathanMayer: to what extent does w3c process allow for discussion of business confidential information? 14:38:35 tlr: information shared is at least visible to all w3c members 14:38:43 ... this is a needle which must be threaded 14:38:56 ... if there are pieces of info based on confidential info you may need to abstract/obfuscate it 14:39:01 ... we can't deal with this in general 14:39:20 ... exception made in CR phase for implementation phase 14:39:25 ... re: who has made the implementation 14:39:38 ... and the WG simply sees the list of test cases that "implementation A, B, C" satisfy 14:39:48 ... suspect that won't be the issue here 14:39:54 ... but this is not the place to share confidential analytics data 14:40:39 ws addressing - example of good process 14:41:14 tlr: failure modes include groups where everyone observes, or people get bogged down in analysis too early 14:41:28 ... over-engineering complexity 14:42:07 ... timelines designed to keep this at bay 14:42:13 ... groups may also self-implode 14:42:26 KarlDubost: groups may also lack the right people 14:42:43 q? 14:44:26 http://www.w3.org/2005/10/Process-20051014/policies.html#WGArchiveMinorityViews 14:44:39 please don't just object, also offer what you want to see as a solution 14:45:07 tlr: discusses http://www.w3.org/2005/10/Process-20051014/policies#WGArchiveMinorityViews 14:45:22 ... important to include proposed reolutions in objections 14:45:22 ack karl 14:45:22 karl, you wanted to use dvcs.w3.org for editor's drafts 14:46:19 information on W3C process: http://www.w3.org/2004/02/Process-20040205/cover.html#toc 14:46:25 tlr: would strongly advise using dvcs.w3.org for editors draft and have that be publicly visible 14:46:40 tl: what does it mean? 14:46:46 tlr: they're on the web in version control system 14:47:56 Matthias: would like to move on, any objection to coffee break? 14:47:59 Zakim, close this agendum 14:47:59 agendum 3 closed 14:48:00 I see 5 items remaining on the agenda; the next one is 14:48:02 4. presentation by Thomas of Princeton workshop results [from ifette] 14:48:59 Brian has joined #dnt 14:51:04 clp has joined #dnt 14:51:12 +[Microsoft] 14:55:14 mischat_ has joined #dnt 15:06:29 npdoty has joined #dnt 15:11:39 KevinT has joined #dnt 15:15:17 Hello everyone, break about to end. --Charles L. Perkins, Virtual Rendezvous, rendezvous.com 15:19:41 amyc has joined #dnt 15:20:50 ScribeNick: ifette 15:23:27 Zakim, next agendum 15:23:27 agendum 4. "presentation by Thomas of Princeton workshop results" taken up [from ifette] 15:20:54 tlr: we met in princeton 15:20:58 ... and had about 80 people 15:21:09 cris has joined #dnt 15:21:11 ... find out what we should focus on 15:21:19 ... showing slides from workshop 15:21:23 ScribeNick: cris 15:21:24 tlr: how did we get here? (history) 15:21:30 (thank you) 15:21:37 scott has joined #dnt 15:21:58 tlr: prevalence of tracking on the web 15:22:14 efelten has joined #dnt 15:22:37 what are the expectations of users? 15:22:49 s/what are/... what are/ 15:23:27 studies on what users felt about opting in? 15:23:58 introduction of mozilla DNT header 15:24:36 Safari "Send Do Not Track HTTP Header" menu item 15:24:44 msft: introduced Tracking Protection Lists (TPL) 15:25:21 Microsoft member submission: http://www.w3.org/Submission/web-tracking-protection/ 15:25:50 big question...what does Do Not Track mean? 15:26:12 there are different views on the matter 15:26:49 fjh has joined #dnt 15:27:08 discussing scope limitations and requirements on properties of tracking controls 15:27:15 CDT requirements: simple, universal, comprehensive, inclusive, effective, seamless, persistent, usable 15:27:50 there currently is not a two-way dialog between consumer and publisher on DNT 15:29:03 s/ what are the/... what are the/ 15:29:10 s/studies on/... studies on/ 15:29:24 s/introduction of mozilla/... introduction of mozilla/ 15:29:43 s/msft: introduced/... microsoft introduced/ 15:29:49 s/big question/... big question/ 15:29:50 another view: canadian law ... third parties "web trackers are breaking the law" 15:29:50 this argument from bluekai ("as current conceived DNT does not facilitate a transparent two-way dialog between the user and the publisher") a question to address is whether such dialogues should happen in HTTP headers, in web UI, or some mixture of the two 15:29:59 s/another view:/... another view,/ 15:30:19 s/there are different/... there are different/ 15:30:28 s/discussing scope/... discussing scope/ 15:30:37 s/there currently is not/... there currently is not/ 15:30:37 s/this argument/from this argument/ 15:31:19 FTC criteria for do not track: consumer criteria should be universal, usable, persistent, effective and enforceable 15:31:36 s/FTC/... FTC/ 15:32:45 ...european countries view "cookies should be opt-in" 15:33:13 s/...european/... european/ 15:33:34 ... Brussels event organized by UC Berkeley: challenge to get DNT done in a year 15:33:50 ePrivacy Directive, article 5(3): http://circa.europa.eu/Public/irc/infso/cocom1/library?l=/public_documents_2010/cocom10-34_guidance/_EN_1.0_&a=d [PDF, sorry] 15:34:11 ... the Tracking Protection Working Group Charter now exists (we're here) 15:35:15 ... we need to come up with Tracking Preference expression, definition, and compliance 15:35:45 charter, including the list of deliverables, is available here: http://www.w3.org/2011/tracking-protection/charter 15:35:45 ... and recommendation for Tracking Selection Lists 15:36:18 Zakim, agenda? 15:36:18 I see 5 items remaining on the agenda: 15:36:19 4. presentation by Thomas of Princeton workshop results [from ifette] 15:36:20 5. Aleecia walking us through the charter [from ifette] 15:36:22 6. group exercise clustering expectations [from ifette] 15:36:22 ... first in person meeting 9/21-9/22 in Cambridge, MA 15:36:23 7. actual work (regulatory definition items) [from ifette] 15:36:25 8. technology items [from ifette] 15:37:11 Kimon: Article 5(3) is about consent, not necessarily opt in 15:37:44 ... Kimon: discussing european law 15:38:04 s/... Kimon/Kimon/ 15:39:10 ... aleecia: out of scope opt in vs opt out 15:39:27 s/... aleecia/aleecia/ 15:40:02 ian: what the default tracking setting is greatly affects solution 15:40:35 aleecia: how does the standard change? 15:41:16 should we record an issue for it? 15:41:24 matthias: let's follow up with how to deal with opt in an opt out at later time? 15:41:59 ???: definition of tracking will affect the solution 15:42:08 s/???/Brett/ 15:42:39 <[Thomas]> [Thomas] has joined #dnt 15:42:55 jkaran: +1 on Ian, Brett 15:44:45 joel: we should spend time understanding issues and uses of opt in or opt out 15:44:56 s/joel/Jules/ 15:45:09 matthias: issues: exact definition of tracking and data collection 15:45:24 sudbury has joined #dnt 15:45:25 ... default (opt in and opt out) and user interface ideas 15:45:37 fjh has joined #dnt 15:46:10 ISSUE-1? 15:46:10 ISSUE-1 -- Example issue to be closed, so people can see what an issue looks like. -- closed 15:46:10 http://www.w3.org/2011/tracking-protection/track/issues/1 15:46:31 q+, to wonder if we can make an assumption of default = off for technical direction and let that stand as advice in recommendations 15:46:38 tlr has joined #dnt 15:46:43 q+ 15:46:49 david wainberg: discuss privacy risks with solutions 15:47:16 ISSUE-2: What is the meaning of DNT (Do Not Track) header? 15:47:16 Sorry... adding notes to ISSUE-2 failed, please let sysreq know about it 15:47:37 ISSUE: What is the meaning of DNT (Do Not Track) header? 15:47:37 Created ISSUE-2 - What is the meaning of DNT (Do Not Track) header? ; please complete additional details at http://www.w3.org/2011/tracking-protection/track/issues/2/edit . 15:48:39 (meta: we'll hit these issues after lunch) 15:48:48 q- 15:49:25 ISSUE: what is the granularity of the choice we expect users to make? 15:49:25 Created ISSUE-3 - What is the granularity of the choice we expect users to make? ; please complete additional details at http://www.w3.org/2011/tracking-protection/track/issues/3/edit . 15:49:49 zakim, next agendum 15:49:49 agendum 5. "Aleecia walking us through the charter" taken up [from ifette] 15:50:17 matthias: discuss what we are trying to do with wg 15:51:18 amyc has joined #dnt 15:51:19 ... interactions between TPL, TP-Expression, and DNT 15:51:42 one document to describe the technical interaction between the browser and server 15:52:09 and another (compliance, definitions) to describe what the server does once it's reached the server 15:52:45 aleecia: almost done with process side of discussion 15:52:56 ... want to discuss charter 15:52:57 http://www.w3.org/2011/tracking-protection/charter.html 15:53:31 clp has joined #dnt 15:53:34 ... will have weekly teleconferences 15:53:45 ... will have face to face meetings 15:54:08 ... out of scope: user interface 15:54:58 ifette: agree, but we can't avoid UI 15:55:35 npdoty: guidelines of user experience would be in scope 15:57:27 tl: we can talk about the UI, understand the implications of the UI, without specifying it 15:58:28 aleecia: tracking selection list = TPL 15:59:08 - +1.949.483.aabb 15:59:22 ... we have w3c dependencies for collaboration with other w3c groups 16:00:27 ???: wants to add section for best current practices 16:00:36 s/???/charles/ 16:00:44 fjh has joined #dnt 16:00:49 http://www.w3.org/2004/02/Process-20040205/tr 16:00:50 s/practices/practices (like BCP from the IETF world)/ 16:01:11 tl has joined #dnt 16:01:15 jkaran has joined #dnt 16:01:22 aleecia: showing calendar 16:01:51 FPWD out by October 6th, even though there won't be general agreement 16:02:00 ... schedule working draft by oct 6th 16:02:25 http://www.w3.org/TR/qaframe-spec/ 16:02:26 ... Oct 13 - deadline for second face to face meeting 16:03:04 ... Oct 25th - internal issue cut-off 16:03:21 ... Nov 1st - next face to face meeting in Santa Clara 16:03:40 s/Nov 1st/Oct 31st-Nov 1st/ 16:04:37 ... Jan 30 - last call for comments on Dec draft 16:05:50 ... Apr 30 - candidate recommendation document 16:06:10 ... May 11 - request for transition 16:06:26 ... May 22 - proposed recommendation 16:07:00 ... drafts should go out on Tues and Thurs (quick iterations) 16:07:05 clp has joined #dnt 16:07:50 ... discussing issues (with format and associated email thread) 16:08:17 example issue: http://www.w3.org/html/wg/tracker/issues/30 16:08:59 ISSUE: what is the default? Is this an opt-in or an opt-out? 16:09:00 Created ISSUE-4 - What is the default? Is this an opt-in or an opt-out? ; please complete additional details at http://www.w3.org/2011/tracking-protection/track/issues/4/edit . 16:09:00 ???: request to put calendar/schedule online 16:09:10 s/???/Shane/ 16:09:55 aleecia: Oct 31st-Nov 1st Santa Clara (face to face) 16:10:06 ACTION: nick to put meeting calendar on WG home page 16:10:06 Created ACTION-3 - Put meeting calendar on WG home page [on Nick Doty - due 2011-09-28]. 16:10:11 trick or treat? :) 16:10:25 http://www.w3.org/2011/track-priv/report.html 16:10:59 aleecia: "short" papers from princeton are online 16:11:39 http://www.w3.org/2011/track-privacy/report.html 16:12:10 s/track-priv\//track-privacy\// 16:13:45 davidwainberg has joined #dnt 16:14:06 ... we have a lot of work ahead of us (esp at beginning) 16:14:44 matthias: lunchtime 16:15:00 kcs has left #dnt 16:15:42 thomas: legal seafood reservation for 40 people at 7pm 9/21 16:16:21 -[Microsoft] 16:20:31 npdoty has joined #dnt 16:21:55 Lunch until 1:30 pm FYI 16:35:33 sudbury has joined #dnt 16:37:01 + +1.818.575.aacc 16:37:03 - +1.818.575.aacc 16:45:43 scott has joined #dnt 16:53:04 npdoty has joined #dnt 16:55:45 aleecia has joined #dnt 16:57:19 sudbury has joined #dnt 16:59:51 fielding has joined #dnt 17:09:55 scott has joined #dnt 17:18:52 cris has joined #dnt 17:34:03 scott has joined #dnt 17:34:44 matthias: time to go organize and categorize the success criteria with sticky notes 17:35:22 efelten has joined #dnt 17:38:15 <[Thomas]> [Thomas] has joined #dnt 17:42:15 Brett has joined #dnt 17:44:23 jmayer has joined #dnt 17:44:35 Scribe: jmayer 17:45:03 please add "Good one-sentence description of DNT scope for use in browser config" (I am stuck on an Apache board meeting call outside) 17:46:27 ScribeNick: jmayer 17:46:46 Doing an exercise on the wall 17:47:19 next agendum 17:47:39 suegl has joined #dnt 17:48:15 matthias: review of the sticky board categorization 17:48:52 sounds fine...let me know 17:49:29 amyc has joined #dnt 17:49:42 aleecia: reminding group to think about use cases 17:50:01 agenda? 17:50:17 agenda+ talk about what is tracking 17:50:24 ... going to spend 20 minutes addressing "What is tracking?" 17:50:32 close agendum 6 17:50:38 the agenda order is 9, 7, 8 17:50:49 zakim, next agendum 17:50:49 agendum 9. "What is tracking?" taken up [from ifette] 17:51:08 ... inviting thoughts from input documents 17:51:21 ... first component: semantics 17:51:22 jkaran has joined #dnt 17:51:27 ... second component: exemptions 17:51:45 ... differing opinions on what should be exempted, and to what extent 17:52:04 ... third component: monolithic? 17:52:18 ... is this a binary choice, or more options for users? 17:52:48 ... fourth component: notice and feedback? 17:52:56 ... should there be a response, and if so, what should it do? 17:53:07 s/binary choice/monolithic choice across all sites 17:53:30 s/more options/per-site decisions 17:53:56 ... everyone has a view of what tracking means 17:54:00 q+ 17:54:11 ... often conflicting 17:54:16 ... inviting input on what tracking means 17:54:18 ack tl 17:54:31 ThomasLowenthal: we should start with a broad definition and add exemptions 17:54:39 +[Microsoft] 17:54:54 q- 17:54:56 ... "Anything that accumulates attributes or particular pieces of information about a user, a browser, or perhaps even a device." 17:54:59 fjh has joined #dnt 17:55:15 PeterEckersley: EFF has a blog post on this 17:55:28 ... broad definition, with exemptions 17:55:33 ... quoting from blog post 17:55:48 "retention of information that can be used to connect records of a person's actions or reading habits across space, cyberspace or time" 17:56:19 npdoty: you beat me to it :) 17:56:34 I was quoting myself from this blog post: https://www.eff.org/deeplinks/2011/02/what-does-track-do-not-track-mean 17:56:44 IanFette: would define more narrowly, e.g. behavioral tracking 17:56:59 ... thinks it will be difficult to make progress with a broad definition 17:57:12 ... "Collecting data to generate a profile of a user." 17:57:30 ifette: I should have said what I thought the exceptions were 17:58:16 since I think those go a long way toward bridging between the broad definitions tl and I were starting with, and the narrower one you thought we could move forward with 17:58:17 CharlesPerkins: "realtime or historical collection of information that in the aggregate is considered private by the user" 17:58:24 alex has joined #dnt 17:59:37 BrettError: think about consumer expectations and what consumers should be able to ask about 18:00:30 ... do you expect your library to forget you? 18:00:42 ThomasLowenthal: I think this is about needed data collection 18:01:33 ShaneWiley: if a broad definition, should have a caveat for "across non-associated sites or experiences" 18:01:44 Aleecia: please clarify 18:01:58 ShaneWiley: should be able to apply to apps, devices, and others 18:02:14 Ed Felten: what's the difference between peter's and ian's definitions? 18:02:14 s/Thomas Lowenthal: I think this is about needed data collection/Thomas Lowenthal: I think that the most important exception is for the information needed to provide & use the service 18:03:10 s/Ed Felten/efelten/ 18:03:47 pde: We have exemptions in our definition for first parties, fraud, clear opt-back-in, and where needed to provide a service 18:03:59 aleecia: trying to hold off on the exemptions discussion 18:04:11 efelten: still looking for a clarification 18:04:46 shawn: aggregate reach calculation, frequency capping 18:04:59 s/shawn/sean/ 18:05:07 TRUSTe definition of behavioral targeting (subset of tracking): http://www.truste.com/privacy-program-requirements/ 18:05:13 SeanHarvey: would like to use data collection for aggregate statistics and frequency capping 18:05:16 "Behavioral Targeting" is the collection and use of information on an Individual's Online activity over a period of time for the purpose of developing and using predictive models to determine potential future behavior or interests. 18:05:27 fielding has joined #dnt 18:05:40 rrsagent, bookmark? 18:05:40 See http://www.w3.org/2011/09/21-dnt-irc#T18-05-40 18:06:06 XXX: "Information about individual users or machines across sites of multiple owners" 18:06:24 s/XXX/kimon/ 18:06:32 slides fro, this morning: http://www.w3.org/2011/tracking-protection/tlr-dnt-process-20110921.pdf, http://www.w3.org/2011/tracking-protection/tlr-dnt-kickoff-20110921.pdf 18:06:49 jkaran: wondering if a broad definition is possible given all the things even one company might do that could be considered tracking 18:06:51 s/slides fro,/slides from 18:06:54 s/fro,/from/ 18:06:55 s/kimon/ThomasPottjegort/ 18:08:25 karl: this is about unique ids and linkability 18:08:32 ... that includes an ip address 18:08:56 scott: about collection of attributions about an individual user 18:09:01 ... about "do not track me" 18:09:12 ... about uniqueness of attributes 18:09:13 s/scott/ScottJulian/ 18:09:21 scribenick: ifette 18:09:36 JonathanMayer: tracking masks a first order question about what are users concerned about, what should users be concerned about 18:09:42 ... it's not about profiling or specific use of data 18:09:43 s/linkability/linkability of data/ 18:09:51 +1 to user centric definition 18:09:53 ... but that there are companies with a list of a user's reading habits, or large portion of what they've seen on the web 18:10:01 ... regardless of what that is used for, that necessitates a broader definition 18:10:13 ... if you think the concern is narrower, that mandates a narrower definition 18:10:22 ... would like to hear what people think users are/should be concerned about 18:10:30 ScribeNick: jmayer 18:10:48 tracking definitions piratepad 18:10:50 http://piratepad.net/w3-tpw3 18:11:58 MikeZaneis: many parties are trying to get to an end result 18:12:15 ... almost everything we're talking about is tracking 18:12:25 ... the DAA's definition is very broad 18:12:40 "basically, collection of data over time across sites" 18:12:50 Q+ 18:12:53 ... we have to be honest that with many exceptions, Do Not Track won't cover all tracking 18:12:55 -q 18:13:28 scott: we need to figure out what the problem is, and how to frame the question we're asking users 18:13:43 ... "do you want free content on sites?" 18:13:51 s/scott/Brett/ 18:14:21 mattias: we need a common understanding of what we mean 18:15:02 s/mattias/schunter/ 18:15:49 jmayer: want to get at the underlying concern, some people think it's about seeing ads based on what they do on other sites, other people upset about profiles being created, others (including myself) about collection of reading habits at all 18:16:41 CharlesPerkins: concern is no explicit, simple description of tradeoff between functional content and privacy 18:16:51 some users, not all users. 18:17:09 ShaneWiley: blended conversation between what users are concerned about/should be concerned about and what we do 18:17:20 ... "Do Not Track" is a buzzphrase with press and FTC 18:17:43 ... I don't believe that "Do Not Track" has left the station 18:17:55 ... we can choose a new name 18:18:13 I thought Shane was making the opposite point, that there's actually too much friction to try to re-name 18:18:33 s/we can choose/we can't choose/ 18:18:40 ... concern is profiling and tracking across sites 18:18:47 s/don't believe/believe/ 18:18:48 ifette: what is realistic to expect? 18:19:14 ... asking web services to forget a user's interaction is unrealistic 18:19:53 fjh: not following process, think we should be working through definition and exemptions 18:20:57 Some exemptions can involve some complexity so trying to capture in a single definition at the start can be hard 18:21:05 Jules: would it be worth defining the contexts in which we're defining tracking? 18:21:40 Tom and Scott offered what appears to be a simple and user-centric, simple, starting point 18:21:40 JulesPolonetsky: Do we need a single definition of tracking, or would it be ok to have two or three? 18:22:04 Q? 18:22:08 Q- 18:22:34 tl: there are two approaches, start broad and add exemptions, or give specific examples of tracking 18:23:12 Jules: there are a range of sensitivities around tracking, we should accommodate them 18:24:22 Brett: I don't understand what we collectively view the problem to be 18:24:27 ... here's what I think it is 18:25:14 ... I don't think we're saying that when a consumer gives a first party some information, she expects the first party to not have the information 18:25:42 ... if I haven't given information to a site and it personalizes for me, that's the problem 18:26:16 pde: EFF's problem is that other companies see what you read on the New York Times or a dating site. Companies that the user doesn't expect to give their information to. 18:26:20 Brett: I agree. 18:27:28 fielding: Storing information on the third-party is the issue. There's no way to avoid a third party storing an audit of where content appears. That's needed for click fraud prevention. Would silo data. 18:27:43 Brett: I think we are making progress, right? 18:27:48 ... Should be stored by a specific advertising network for each site. 18:28:07 Thinking about indirect tracking such as the mail I sent to a user with his data being tracked, my address information shared with a friend and put in a system which does data mining. 18:28:16 KevinT: Have to distinguish between general use case and sensitive information, e.g. medical information. 18:28:30 ... Concerns about identifiability of information are a driver. 18:28:45 Can the combination of data that is not sensitive become sensitive when combined? 18:28:53 AmyColando: Consumers differ in what they think is ok. 18:28:56 fielding: leaving companies the necessary room to fight clickfraud while preventing that from being an open-ended record of their reading habits is in my view the most insolube part of DNT 18:29:22 something like "siloing" may be the best we can do 18:29:25 pde: we have some ideas on it, talk later 18:29:49 AmyColando: we need to work on making choice and what's going on more transparent for consumers 18:29:50 pde, I think we should focus on DNT preventing sharing of data rather than collection of data 18:29:55 siloing, along with limited retention and other things 18:30:08 emphasis: when third parties need to store data, it should be as an agent of the first party, and strictly siloed 18:30:22 fielding: whereas my view is we should just exempt collection that feeds into a siloed clickfraud prevention process 18:30:25 kimon: think we should be talking about browsers 18:30:41 active sharing with someone else through a service doesn't mean sharing with the company offering the service. Example: Discussions of two friends in a cafe or on the phone. You do not want your discussion analyzed. 18:30:50 ... might be more room to agree there 18:31:25 s/collection/retention 18:31:26 q? 18:31:30 i would like to reiterate karl's position strongly 18:31:32 aleecia: wide range of views, closer than expected 18:32:00 ... starting from princeton, broad definition with exemptions 18:32:23 ... we'll wind up with a definition 18:32:33 ... it'll be a point of contention whether it's narrow or broad 18:32:37 ... and what's exempted 18:33:53 matthias 18:33:58 CharlesPerkins: we could try using adjectives around tracking, e.g. "behavioral tracking" scribenick: tlr 18:34:11 matthias: 1. what is tracking as first issue — take this list in there 18:34:12 ISSUE: What is the definition of tracking? 18:34:12 Created ISSUE-5 - What is the definition of tracking? ; please complete additional details at http://www.w3.org/2011/tracking-protection/track/issues/5/edit . 18:34:24 ISSUE: What are the underlying concerns? Why are we doing this / what are people afraid of? 18:34:24 Created ISSUE-6 - What are the underlying concerns? Why are we doing this / what are people afraid of? ; please complete additional details at http://www.w3.org/2011/tracking-protection/track/issues/6/edit . 18:34:28 ... 2. what are underlying concerns, why do we do this, what are people afraid of — document 18:34:48 ... 3. what types of tracking exist, how is tracking used — click fraud, frequency tracking 18:34:49 ISSUE: What types of tracking exists, and what are the use cases for these types of tracking? 18:34:49 Created ISSUE-7 - What types of tracking exists, and what are the use cases for these types of tracking? ; please complete additional details at http://www.w3.org/2011/tracking-protection/track/issues/7/edit . 18:34:59 ... would like to see a list what are the useful things that are done with these dat 18:35:02 karl: Agreed. The phone company should not collect information about me by evesdropping on my calls. 18:35:05 s/dat/data/ scribenick: jmayer 18:36:02 photos of the whiteboard will be available 18:36:17 s/karl: Agreed/karl, Agreed/ 18:36:50 schunter: issue of exemptions 18:37:11 Input document: TRUSTe consumer research on OBA (http://www.truste.com/ad-privacy/TRUSTe-2011-Consumer-Behavioral-Advertising-Survey-Results.pdf) - specific q's around DNT and perceived threats 18:37:12 ... last issue is transparency and better informing users 18:37:37 crowd: user awareness, education 18:37:45 ISSUE: How do we enhance transparency and consumer awareness? 18:37:45 Created ISSUE-8 - How do we enhance transparency and consumer awareness? ; please complete additional details at http://www.w3.org/2011/tracking-protection/track/issues/8/edit . 18:38:23 aleecia: four buckets to work through: semantics, exemptions, monolithic?, and notice and feedback 18:39:09 aleecia: semantics is the base case 18:39:30 zakim, agenda? 18:39:30 I see 3 items remaining on the agenda: 18:39:32 9. talk about what is tracking [from ifette] 18:39:34 7. actual work (regulatory definition items) [from ifette] 18:39:35 8. technology items [from ifette] 18:39:41 agenda+ use cases 18:39:46 zakim, close this agendum 18:39:46 agendum 9 closed 18:39:47 I see 3 items remaining on the agenda; the next one is 18:39:49 7. actual work (regulatory definition items) [from ifette] 18:39:53 zakim, take up agendum 10 18:39:53 agendum 10. "use cases" taken up [from ifette] 18:40:02 aleecia: moving on to use cases 18:40:52 davidwainberg: preface that there are many commonalities among definitions 18:41:06 sudbury has joined #dnt 18:41:20 ... privacy risk is complex, about who stores data, how, and more 18:41:34 ... use case 1: retargeting 18:41:56 ... user visits site A, views a product; visits unaffiliated site B, sees an ad for the product 18:42:10 ... just a single data point used for retargeting 18:42:31 ... use case 2: interest segments stored in a cookie 18:42:49 ... use case 3: cookie used as an ID for a server-side store 18:43:01 ... all three have very different risk profiles 18:43:31 ShaneWiley: disagree with davidwainberg 18:43:49 ... all three use cases would fall into Do Not Track 18:44:16 ... And would no longer occur if user elects dnt 18:44:30 pde: non-linkable forms of segment targeting should be ok 18:45:32 aleecia: question is whether we should have an exemption for client-side segmenting 18:45:36 scribenick: ifette 18:45:37 pde saying segmented targeting (not uniquely-identifiable) fine even under Do Not Track 18:45:49 JonathanMayer: disagree with peter in what he just said, but agree with what he said two months ago 18:46:06 ... way he's thought about this is to bring a holistic definition of the high level semantics 18:46:16 ... at the same time allow things that don't engender privacy concerns 18:46:22 ... is to lump that into privacy buckets 18:46:26 s/privacy/exemptions/ 18:46:37 ... disagreements around how the balance lies 18:46:53 ... broad definition leads to lots of exemptions, narrow definition has fewer exemptions 18:47:06 ... re: segments in cookies 18:47:27 ... on that specific issue of client side data storage, would like to not get too far into specifics because there's many options with marginally different privacy options 18:47:37 ... if we just say "it's a client side storage thing" and leave the details for later 18:47:40 scribenick: jmayer 18:48:40 SharlesPerkins: as long as it's pseudonymous we shouldn't be worried 18:48:47 s/Sharles/Charles/ 18:48:55 tl: i don't think that's a consensus view 18:49:14 jmayer: what do you think I changed my opinion over the past two months? 18:49:14 Brett: how information came to be on the client matters a lot, e.g. a cookie sync 18:49:24 s/over/of over/ 18:49:52 SeanHarvey: use case 1: first party on own site 18:50:11 ... use case 2: third party across multiple websites 18:51:08 ... use case 3: companies like CBS that use a third-party vendor with a third-party cookie, but used as just a software tool and with only the website able to read the data 18:51:24 ... use case 4: companies that collect data on their own sites and want to leverage that data on other sites 18:51:41 it's important to note that users have no idea what first and third parties are 18:52:06 ... doubleclick is 3, google display network is 2 18:52:58 ShaneWiley: pure first party, pure third party, first party as third party, third party as first party 18:53:27 ... a lot of discussion of first party as a third party, e.g. the facebook like button 18:53:47 <[Thomas]> [Thomas] has joined #dnt 18:54:12 ISSUE: Understand all the different first- and third-party cases. 18:54:13 Created ISSUE-9 - Understand all the different first- and third-party cases. ; please complete additional details at http://www.w3.org/2011/tracking-protection/track/issues/9/edit . 18:55:44 CharlesPerkins: need to be able to explain to the user what these use cases are 18:56:10 karl: suppose someone has an account with gmail 18:56:21 ... they're ok with being tracked by google 18:56:28 ... i'm on my own personal server for email 18:56:41 ... and I email someone who uses gmail 18:57:01 SeanHarvey: Google would be a first party in this case. 18:58:51 tl has joined #dnt 18:59:15 ChrisOlsen: suppose I'm forbes, and there's data collection on other websites, and i want to use that for ad targeting 18:59:24 SeanHarvey: that's a third-party product 18:59:38 Is email like trash, once you put it out it isn't private or yours ( depending on receivers choices) ? 19:00:11 ShaneWiley: yahoo analytics product allows a customer to request that their data be stored in a silo 19:00:55 fjh: perhaps a better way of fitting that slightly off-topic email example into the framework we've been discussing, is that Google's receipt of the email you sent is necessary for the completion of a transaction you requested, and therefore is covered by an exception even if it's tracking 19:01:15 KevinSmith: how are first party as first party and third party as first party separate 19:01:22 CharlesPerkins: the third party might be untrusted 19:01:56 npdoty: Depends on what "silo" means. Can have significant implications for users. 19:03:12 jkaran: many third parties can be brought in with a single ad 19:03:13 is "tag" an advertising term for a javascript include? 19:03:45 enewland: separating out first and third parties can be circular, but valuable 19:04:40 ThomasPottjegort: if you silo data, it would be wise to anonymize the data before storing it 19:05:14 CharlesPerkins:users might expect that some first party uses would be covered 19:05:19 ... for example inside google 19:05:53 MikeZaneis: small companies with distinct brands can also be difficult for a definition 19:06:10 Pde, depends on how you define essential. 19:06:26 note that "email" was just an example of a Web service in the case of gmail. You could use any services using Web standards to communicate across domain names (not silos) where the consumption of data of someone else might end up to the creation of a profile without having even agreed on any terms about it. 19:06:32 rrsagent, bookmark? 19:06:32 See http://www.w3.org/2011/09/21-dnt-irc#T19-06-32 19:06:43 s/essential/necessary/ 19:07:08 ClayWebster: there can be difficulties where there are differences in branding or logo or domains 19:07:22 ... for example, this weird .com.com thing we did for awhile 19:07:42 ... we have to be a first party for ourselves 19:09:10 But I see your point, pde 19:09:12 pde: Responding to Charles Perkins, there will be cases where consumers are concerned about one entity sharing information internally. But it's a company's problem if it violates consumer expectations. That's very different from different domain names. 19:09:32 AmyColando: Defining first party is a key foundation, probably can't get it done today. 19:09:47 ISSUE: What is a first party? As an example, CBS and C|Net are the same company but visually distinct websites/brand, is this a first party relationship? 19:09:48 Created ISSUE-10 - What is a first party? As an example, CBS and C|Net are the same company but visually distinct websites/brand, is this a first party relationship? ; please complete additional details at http://www.w3.org/2011/tracking-protection/track/issues/10/edit . 19:09:52 ... Good reasons for third parties to keep data without anonymizing it. 19:10:16 ShaneWiley: Recall that in the EU there are different definitions, data controller vs. data processor. 19:10:28 fjh: I think it's reasonable to say that the recipient's mx servers (and anything they forward to) are a necessary part of email transactions; and per karl's example I think this would work equally well for any other back-end protocol that users interact with through websites 19:10:32 what is data controller? What is data processor. 19:10:55 s/fjh: I think/fjh, I think/ 19:11:44 Perhaps karl's point can be restated as how can user DNT request be handled when no direct 1st party relationship is involved 19:11:56 ... there's a t least three versions of first party, common branded, same domain, and affiliated 19:12:12 thanks fjh for clarifying my concern :) in a better way that I did. 19:12:43 davidwainberg: Why do these definitions matter? 19:12:58 ShaneWiley: Because we're going to reference the often. 19:13:16 clp: looking at the youtube homepage, the word "google" does not appear on it anywhere. I would not be surprised if a large fraction of Youtube's users were unaware that the site was owned by Google. 19:13:44 aleecia: Issues about user expectations and implementation. 19:13:55 schunter: Our aim is to surface issues, we're doing that. 19:14:10 adrianba has joined #dnt 19:14:45 ISSUE: document a longer list of use cases -- what's going on today 19:14:46 Created ISSUE-11 - Document a longer list of use cases -- what's going on today ; please complete additional details at http://www.w3.org/2011/tracking-protection/track/issues/11/edit . 19:15:05 http://www.w3.org/2011/tracking-protection/track/issues/raised RAISED ISSUE so far 19:15:59 KevinT: Are apps in scope? 19:16:11 jkaran has joined #dnt 19:16:12 ISSUE: how does tracking require relation to unique identities, pseudonyms, etc.? 19:16:13 Created ISSUE-12 - How does tracking require relation to unique identities, pseudonyms, etc.? ; please complete additional details at http://www.w3.org/2011/tracking-protection/track/issues/12/edit . 19:17:06 schunter: Apps aren't excluded from scope, would address at some point. 19:17:14 ISSUE: what are the requirements for DNT on apps/native software in addition to browsers? 19:17:14 Created ISSUE-13 - What are the requirements for DNT on apps/native software in addition to browsers? ; please complete additional details at http://www.w3.org/2011/tracking-protection/track/issues/13/edit . 19:19:09 ISSUE: How does what we talk about with 1st/3rd party relate to European law about data collector vs data processor? 19:19:09 Created ISSUE-14 - How does what we talk about with 1st/3rd party relate to European law about data collector vs data processor? ; please complete additional details at http://www.w3.org/2011/tracking-protection/track/issues/14/edit . 19:19:25 Kimon: not clear who's a controller or processor under eu law 19:19:49 Brett: Have to consider how personal the data being collected is. 19:19:59 ISSUE-14: How does what we talk about with 1st/3rd party relate to European law about data controller vs data processor 19:19:59 ISSUE-14 How does what we talk about with 1st/3rd party relate to European law about data collector vs data processor? notes added 19:20:53 Zakim, who is here? 19:20:53 On the phone I see StarConferenceRoom, [Microsoft] 19:20:55 On IRC I see adrianba, [Thomas], sudbury, fielding, alex, fjh, amyc, suegl, jmayer, Brett, efelten, scott, cris, npdoty, davidwainberg, clp, tlr, KevinT, Brian, pde, kimon, 19:20:58 ... trackbot, Dan_, schunter, ifette, enewland, RRSAgent, karl, clay, Zakim, hober 19:20:59 MZ has joined #dnt 19:21:27 KevinT: Have to deal with special treatment for children. 19:22:36 tl: differences between legal questions about what's personal and technical questions about whether users can be identified 19:22:57 ISSUE: What special treatment should there be for children's data? 19:22:57 Created ISSUE-15 - What special treatment should there be for children's data? ; please complete additional details at http://www.w3.org/2011/tracking-protection/track/issues/15/edit . 19:25:07 aleecia has joined #dnt 19:25:31 [organizational discussion] 19:26:17 jkaran has joined #dnt 19:26:39 schunter: propose to break into small groups, each focuses on a narrow set of issues 19:27:50 zakim, who is on the phone? 19:27:50 On the phone I see StarConferenceRoom, [Microsoft] 19:28:03 Brian Tschumper from Microsoft on phone 19:28:05 Break 19:28:10 [decision: discuss everything as a group] 19:29:10 ACTION for nick to set up iCal subscribable version of our events calendar 19:29:10 Sorry, couldn't find user - for 19:29:27 ACTION: nick to set up iCal subscribable version of our events calendar 19:29:27 Created ACTION-4 - Set up iCal subscribable version of our events calendar [on Nick Doty - due 2011-09-28]. 19:33:51 tl has joined #dnt 19:36:55 David has joined #dnt 19:42:59 fjh has joined #dnt 19:55:18 I will try to transcribe the next section, This is Charles L. Perkins, clp, rendezvous.com 19:58:13 zakim, who is on the phone? 19:58:13 On the phone I see StarConferenceRoom, [Microsoft] 19:58:27 Hi - is Microsoft JC Cannon? 19:58:40 Microsoft is Brian Tschumper 19:58:46 cris has joined #dnt 19:58:51 Thank you! 19:59:22 zakim, [microsoft] has BrianTschumper 19:59:22 +BrianTschumper; got it 20:00:26 scott has joined #dnt 20:03:00 fielding has joined #dnt 20:03:34 scott has joined #dnt 20:06:45 npdoty has joined #dnt scribenick: clp 20:10:44 Session begins 20:10:51 Notes that there will be weekly telephone conferences 20:10:59 SHow of hands for timezones 20:11:32 About equal between PDT and ET then about 1/2 as many in other timezones 20:11:36 1 from Australia 20:12:13 11 am ET 8 am PT 5 pm Central Europe 20:13:45 sudbury has joined #dnt 20:13:45 Notes that Europeans have trouble with 10/31 and 11/1 meeting anyway 20:13:59 Suggestion to moving it one hour later 20:14:30 90 min call, weekly 20:15:01 sudbury_ has joined #dnt 20:15:59 karl has joined #dnt 20:18:28 Dan has joined #dnt 20:18:36 5 conflicts on Thur 20:18:39 4 on Tuesday 20:18:42 2 for Wed 20:18:58 at noon 9 6 for ET / PT / Central EU 20:19:13 Wed chosen 20:19:27 noon ET, 9am PT, 6 pm Central Europe. 20:19:29 (for now) 20:20:45 Send Aleecia email if you have issues with this time / day 20:20:48 http://www.timeanddate.com/time/dst/2011.html 20:20:50 She will try to work it out 20:21:15 Take the next section as a Lightning Round 20:21:27 scott has joined #dnt 20:21:39 Alex: is the phone number published? 20:21:40 yes it will be 20:21:56 October 30, DST ends in Europe 20:21:56 November 6, DST ends in USA 20:21:56 known as the messy week for teleconferences 20:21:58 No judgements fast rounds now is the idea 20:22:25 Semantics and Exceptions, hopefully separate first 20:22:37 tlr has joined #dnt 20:22:55 efelten has joined #dnt 20:23:07 First exchange of preference, then site behavior will change 20:23:22 Shane: will we begin with use cases from last time? 20:23:48 Issues 1-- data collection, 2-- data use 20:23:59 (context 3rd party) 20:24:32 Thomas: isn't semantics and exception/exemptions really the same thing? 20:24:55 Trying to keep separate? No, let's give up and combine the first discussion. 20:25:08 s/Trying/aleecia: Trying/ 20:25:19 Thomas: can we straw poll this? 20:25:37 Not now. 20:25:45 jmayer has joined #dnt 20:26:12 Issues for what it means to Comply with getting a Don Not TRack signal 20:26:22 EG 1st party Data collection: 20:26:49 Jules: What is "collecting" in semantics? 20:27:00 ... Collecting, Logging, etc. 20:27:13 ... Caching eg, is that collecting? 20:27:30 ISSUE: what does it mean to collect data? (caching, logging, storage, retention, accumulation, profile etc.) 20:27:31 Created ISSUE-16 - What does it mean to collect data? (caching, logging, storage, retention, accumulation, profile etc.) ; please complete additional details at http://www.w3.org/2011/tracking-protection/track/issues/16/edit . 20:27:34 David: Retention, Accumulation, Profile 20:27:43 fjh has joined #dnt 20:28:03 Attribution, Identification (another term) 20:28:06 s/David/davidwainberg/ 20:29:29 scribenick: npdoty 20:29:40 jkaran: data use by 1st party 20:29:46 clp_ has joined #dnt 20:29:50 back 20:29:51 ... data collection methods, HTTP cookies and other technology types 20:29:59 scribenick: clp_ 20:30:05 Time/Space device etc. 20:30:22 Atrribution / Identifiable 20:30:27 Time/space Devices 20:30:38 Parties -- what is definition of "Party"? 20:30:50 Issue: Data use by 1st Party 20:30:50 Created ISSUE-17 - Data use by 1st Party ; please complete additional details at http://www.w3.org/2011/tracking-protection/track/issues/17/edit . 20:31:00 Data collection -- cookies or not 20:31:41 Issue: Collection definition (not sure I said the prefix before?) 20:31:41 Created ISSUE-18 - Collection definition (not sure I said the prefix before?) ; please complete additional details at http://www.w3.org/2011/tracking-protection/track/issues/18/edit . 20:31:57 Issue: Data collection / Data use (3rd party) 20:31:57 Created ISSUE-19 - Data collection / Data use (3rd party) ; please complete additional details at http://www.w3.org/2011/tracking-protection/track/issues/19/edit . 20:32:13 Jules: What isn't covered? Is there a magic button that gives you privacy? Do not track button does what? 20:32:59 ... Some linkage.... what is not part of this? 20:33:14 ... Common denominator.... why is it in scope of the button? 20:33:29 ... Is there something that makes it belong on this page? 20:33:59 ... is it PII and no cookie etc? 20:34:41 Matthias: can we focus just on the tracking part? 20:34:54 would like to flag - the legal notion of PII is very different from the technical question of what information is identifiable 20:35:16 Shane: exception focus... so the ability for consumer to grant an exception... it's important to Yahoo and regulators -- need external auditibility 20:35:22 ISSUE: different types of data, what counts as PII, and what definition of PII 20:35:23 Created ISSUE-20 - Different types of data, what counts as PII, and what definition of PII ; please complete additional details at http://www.w3.org/2011/tracking-protection/track/issues/20/edit . 20:35:38 ... outside operations, analytics and/or research 20:35:46 ... fraud detection and defence 20:35:55 Matthias: examples? 20:36:30 Shane: prove in an audit that you didn't exceed promises, or that billing was properly done, etc. 20:37:06 ... DNT compliance audit 20:37:18 ISSUE: enable external audit of DNT compliance 20:37:19 Created ISSUE-21 - Enable external audit of DNT compliance ; please complete additional details at http://www.w3.org/2011/tracking-protection/track/issues/21/edit . 20:37:49 ISSUE: still have "operational use" of data (auditing of where ads are shown, impression tracking, etc.) 20:37:49 Created ISSUE-22 - Still have "operational use" of data (auditing of where ads are shown, impression tracking, etc.) ; please complete additional details at http://www.w3.org/2011/tracking-protection/track/issues/22/edit . 20:38:03 ISSUE: possible exemption for analytics 20:38:03 Created ISSUE-23 - Possible exemption for analytics ; please complete additional details at http://www.w3.org/2011/tracking-protection/track/issues/23/edit . 20:38:18 ISSUE: possible exemption for fraud detection and defense 20:38:19 Created ISSUE-24 - Possible exemption for fraud detection and defense ; please complete additional details at http://www.w3.org/2011/tracking-protection/track/issues/24/edit . 20:38:25 ... network quality is industry term - showing your Ads in places that are reputable 20:38:33 ISSUE: possible exemption for research purposes 20:38:34 Created ISSUE-25 - Possible exemption for research purposes ; please complete additional details at http://www.w3.org/2011/tracking-protection/track/issues/25/edit . 20:38:55 Clay: ... lots of overlap... but denial of service prevention... store but maybe not use for this 20:39:17 Peter: ... decent fraud will handle that hopefully 20:39:31 Shane: just so we know advocates don't like a general exception there FYI 20:39:32 ISSUE-22: should cover denial of service attacks, click fraud 20:39:32 ISSUE-22 Still have "operational use" of data (auditing of where ads are shown, impression tracking, etc.) notes added 20:39:56 Clay: we need the semantics well published 20:40:10 ... the auditing will have to mesh well 20:40:27 Aleecia: lead time? what are you saying? 20:40:37 Clay: yes, substantial lead time, before this kicks in 20:40:56 Matthias: easier for them, kick off issues 20:41:08 Clay: have you had a SOCKS (sp?) audit? Avoid at all cost! 20:41:20 s/SOCKS/SOX (Sarbanes Oxley)/ 20:41:57 ... is there a limited defacto opt-in with having to explicitly opt in, e.g. zip code provided ... 20:42:20 ... eg, if you're not being prompted yet you are supplying info, does it opt you in? 20:42:34 Aleecia: if you provide e.g. your billing address... 20:42:54 Jules: but someone then explicitly gives more info, not billing 20:43:10 Ed Fellen: how does this differ from the consumer consent? 20:43:16 Clay: widget on a page 20:43:21 s/Ed Fellen/efelten/ 20:43:26 tlr: I go to site foo 20:43:33 ... it shows me something 20:43:39 Kevin: eg a weather widget? 20:44:03 Thomas: does the 3rd party... yes, thank you 20:44:26 Clay: 3rd party widget and others providing explicit consent 20:44:32 ISSUE: providing data to 3rd-party widgets -- does that imply consent? 20:44:33 Created ISSUE-26 - Providing data to 3rd-party widgets -- does that imply consent? ; please complete additional details at http://www.w3.org/2011/tracking-protection/track/issues/26/edit . 20:45:02 example: 3rd party weather widget from t.com gets information while embedded with a.com, does this count as consent for t.com to track me when I visit b.com? 20:45:45 ThomasComScore: there is one exception he is not sure why it is an exception / issue 20:46:55 Matthias: it's perfectly OK to exempt something ... if its an exclusion it's evident anyway 20:47:32 Kimon: Zorba the Greek... to remember ... not sure about debate... at first don't want to be tracked... yet now I like Google, OK for them to track me 20:47:44 kimon: I might decide I don't want to be tracked — but may permit some specific site to track me regardless? 20:47:49 ... revoke the DNT for explicit cases? 20:47:50 ... other point, going into frequency capping 20:48:10 ISSUE: mechanism to revoke Do Not Track for specific entities (maybe I really like Google), "opt back in" 20:48:10 Created ISSUE-27 - Mechanism to revoke Do Not Track for specific entities (maybe I really like Google), "opt back in" ; please complete additional details at http://www.w3.org/2011/tracking-protection/track/issues/27/edit . 20:48:13 clay_ has joined #dnt 20:48:23 ... Post click or other methods, e.g. conversion, advert --> sale 20:48:23 <[Thomas]> [Thomas] has joined #dnt 20:48:39 ... those should not be excluded 20:48:59 ... asks Shane 20:49:09 Shane: yes, when we talk about 3rd party widgets: 2 concepts: 20:49:15 ... impression vs interaction 20:49:25 ... see affliate ad vs they click on it 20:49:35 Scott: Law enforncement requirements? 20:50:04 ISSUE: different rules for impression of and interaction with 3rd-party ads/content 20:50:24 ISSUE: Exception for mandatory legal process 20:50:24 Created ISSUE-28 - Exception for mandatory legal process ; please complete additional details at http://www.w3.org/2011/tracking-protection/track/issues/28/edit . 20:50:32 Charles: fits into my larger point: existing law, policy, how we fit into it 20:51:02 ISSUE: tracking that may be required by law enforcement 20:51:03 Created ISSUE-29 - Tracking that may be required by law enforcement ; please complete additional details at http://www.w3.org/2011/tracking-protection/track/issues/29/edit . 20:51:07 Erica: .. for policy or legal reasons we don't want DNT to apply to them... are there things that we just don't think are NOT in the scope of this? 20:51:34 ... data aggregation EG, collects lots of data, selling to someone else 20:52:18 Aleecia: not online explicitly tracking ... data sharing / enhancementdata in offline world, combined with online 20:52:51 Jules: commerce site, just sells the data, seems like we saying it has to have seomthing to do with online tracking? 20:53:37 ... is offline the only exemption? replicating privacy law and existing ... are we including don't give that data to them? 20:53:48 Matthias: What privacy problems are out of scope? 20:54:46 ISSUE: will Do Not Track apply to offline aggregating or selling of data? 20:54:46 Created ISSUE-30 - Will Do Not Track apply to offline aggregating or selling of data? ; please complete additional details at http://www.w3.org/2011/tracking-protection/track/issues/30/edit . 20:54:49 Jonathon: Minimization... in some cases privacy concern might be minimal, but in many cases lots of tech apporaches 20:55:09 ... to what extent so we want to recommend tech / nice tech? 20:55:26 ... broad exceptions yet some tech might be better for implementing them? 20:55:55 ... frequency capping eg, we are NOT going to allow it in .... but may be allow it in this other case, where minimization makes a difference 20:56:12 Peter: The technical conditional nature of exemption 20:56:37 Aleecia: Is it reasonable for us to only have exemption only based on the tech they use? 20:56:44 ISSUE: minimization -- to what extent will minimization be required for use of a particular exemption? (conditional exemptions) 20:56:44 Created ISSUE-31 - Minimization -- to what extent will minimization be required for use of a particular exemption? (conditional exemptions) ; please complete additional details at http://www.w3.org/2011/tracking-protection/track/issues/31/edit . 20:57:11 Peter: is it a particular detailed choice like language, or just general tech choices 20:57:43 Jonathon: high level... is it reasonable to ask people to ever adopt or not a given tech... 20:58:00 Shane: are there reasonable tech. exemptions 20:58:11 I'm more comfortable with "specific approaches" than "specific technologies" 20:58:15 ISSUE-31: Shane: do you get exemptions by using particular technical implementations? 20:58:15 ISSUE-31 Minimization -- to what extent will minimization be required for use of a particular exemption? (conditional exemptions) notes added 20:58:31 clp_: Peter == pde 20:58:32 Brett: we also need to address... the sharing of data between entities 20:58:36 ... cookie sync'ing 20:58:49 ... beacon calls ... more of a Use Case 20:59:07 Matthias: do we alll agree we know what cookie sync'ing is? 20:59:38 Brett: a 3rd party reads in a 1st party cookie, makes it their own and use it everywhere else (beacon) 20:59:56 Peter: For example, Cookie ID1 and ID2 are the same is one EG 21:00:00 ISSUE: sharing of data between entities via cookie syncing / identity brokering 21:00:00 Created ISSUE-32 - Sharing of data between entities via cookie syncing / identity brokering ; please complete additional details at http://www.w3.org/2011/tracking-protection/track/issues/32/edit . 21:00:08 Brett: may be covered in the linking section. 21:00:22 Brad: complexity of the choice we ask users to make 21:00:30 s/are the same/are the same person/ 21:00:38 ... are you actually exposing these exemptions to users, or just saying these are them 21:00:52 ISSUE: complexity of user choice (are exemptions exposed to users?) 21:00:52 Created ISSUE-33 - Complexity of user choice (are exemptions exposed to users?) ; please complete additional details at http://www.w3.org/2011/tracking-protection/track/issues/33/edit . 21:01:27 Aleecia: many ways of slice/dice the DNT 21:01:40 ... no split one choice 21:01:49 ... DNT either on or off 21:02:25 ThomasLowenthal: ... user said on/off separately from what you do (on/off), there are multiple states the user could be in 21:02:54 Aleecia: that is in Notices and Feedback 21:02:58 Shane: what do you mean again? 21:03:05 Aleecia: One possibility, one button. 21:03:14 Scott: aggregate analytics 21:03:29 ISSUE: possible exemption for aggregate analytics 21:03:30 Created ISSUE-34 - Possible exemption for aggregate analytics ; please complete additional details at http://www.w3.org/2011/tracking-protection/track/issues/34/edit . 21:04:11 Kevin: if you have individual exemptions... can a site then ask the user, hey for US is it OK for US (this site) to track this now? 21:04:22 ... opt back in just for this site 21:04:44 ISSUE-27: Kevin (Adobe): users should be able to opt back in for either a first or third party 21:04:45 ISSUE-27 Mechanism to revoke Do Not Track for specific entities (maybe I really like Google), "opt back in" notes added 21:05:00 Brett: Want a way to express the level of trust, for tracking. 21:05:18 Shane: Brand, and/or affiliated network... what is the definition of a party? 21:05:21 ISSUE-27: opting back in for a brand, for "an affiliated party" 21:05:21 ISSUE-27 Mechanism to revoke Do Not Track for specific entities (maybe I really like Google), "opt back in" notes added 21:05:36 EdFelten: how interacts with other existing programs 21:06:02 Aleecia: including industry self-regulation 21:06:07 ISSUE: how will DNT interact with existing opt-out programs (industry self-reg, other)? 21:06:07 Created ISSUE-35 - How will DNT interact with existing opt-out programs (industry self-reg, other)? ; please complete additional details at http://www.w3.org/2011/tracking-protection/track/issues/35/edit . 21:06:18 fjh has joined #dnt 21:06:39 Thomas ComScore: behavior Ads / content ... tracking is not the issue, but that the content has changed because of what I did before... 21:07:01 Aleecia: Two tiers? ONe is just behaviorally targeted Ads the othe rot just persinalization 21:07:14 Thomas: yes 21:07:34 XXX: I have the idea we need a split, don't know how we decide. 21:07:34 another issue is people with shared devices and/or cybercafes. The browser (the device) is not the person. Specifically in third world countries 21:07:52 amyc has joined #dnt 21:07:54 Jonathon: made draw laughter... you could go all the way toward declarative P3P 21:07:59 ...laughter... 21:08:02 ISSUE: should DNT opt-outs distinguish between behavioral targeting and other personalization? 21:08:02 Created ISSUE-36 - Should DNT opt-outs distinguish between behavioral targeting and other personalization? ; please complete additional details at http://www.w3.org/2011/tracking-protection/track/issues/36/edit . 21:08:12 ...specific biz user roles in ecosystem 21:08:15 s/made draw/this might draw/ 21:08:31 ThomasLowenthal: that seems to be explicitly out of scope 21:08:40 Aleecia: If not deep, OK, if deep, out of scope. 21:09:03 Kevin: as an actual consumer, what data is being kept, why, and is it only the advantage for me or just for you? 21:09:07 for reference: "The Working Group will not design mechanisms for the expression of complex or general-purpose policy statements." 21:09:24 ... something that wide is doable? 21:09:26 ISSUE: granularity could be as complex as something P3P-style, based on business types and uses 21:09:26 Created ISSUE-37 - Granularity could be as complex as something P3P-style, based on business types and uses ; please complete additional details at http://www.w3.org/2011/tracking-protection/track/issues/37/edit . 21:09:42 ... I am fine with the company keeping the info, for this reason, ... 21:10:00 ... part of the split is so wide... conceptually that's what is driving me as the consumer 21:10:11 Aleecia: some categories can then be rolled up 21:10:27 Kevin: Why they want GPS, if it makes sense, will say yes. 21:10:47 Scott: That covers a lot of what I want to say. 21:11:07 ISSUE-37: could have exemptions that are based on different types of use ("I'm okay with anonymized use for research") 21:11:08 ISSUE-37 Granularity could be as complex as something P3P-style, based on business types and uses notes added 21:11:28 Kevin: setting up a DNT on exception and rules, just noting the user doesn't even know its happening, still invisible 21:11:42 ... consideration of when tracking is actually happening 21:12:07 Aleecia: anonymized data, splitting based on data use 21:12:36 Kimon: term of Europe, anonmized means something else perhaps, render a data set anonymous 21:12:55 s/anonmized/anonymized/ 21:13:00 Shane: break the tie with production system, here in US a random ID is OK, in EU, used repetitively is not OK 21:13:23 s/ID is OK/ID is not PII/ 21:13:35 Karl: meaning of DNT with user process in 3rd world country where computer / browser used by many people not just one 21:13:56 ... mobile phone shared by community 21:14:06 ISSUE: granularity for different people who share a device or browser 21:14:06 Created ISSUE-38 - Granularity for different people who share a device or browser ; please complete additional details at http://www.w3.org/2011/tracking-protection/track/issues/38/edit . 21:14:32 Clay: goes alone with mobile, be able to toggle based on geographically ... don't want to be tracked via GPS 21:14:49 ... don't transmit my location ever ... yes 21:15:06 ... other possibly use/not use DNT just for this session 21:15:11 ISSUE: tracking of geographic data (however it's determined, or used) 21:15:11 Created ISSUE-39 - Tracking of geographic data (however it's determined, or used) ; please complete additional details at http://www.w3.org/2011/tracking-protection/track/issues/39/edit . 21:15:27 ISSUE: enable Do Not Track just for a session, rather than being stored 21:15:27 Created ISSUE-40 - Enable Do Not Track just for a session, rather than being stored ; please complete additional details at http://www.w3.org/2011/tracking-protection/track/issues/40/edit . 21:15:46 ISSUE-12? 21:15:46 ISSUE-12 -- How does tracking require relation to unique identities, pseudonyms, etc.? -- raised 21:15:46 http://www.w3.org/2011/tracking-protection/track/issues/12 21:17:49 Charles: True Name vs pseudonymity 21:18:02 ... also social networks as analogy to trust in brand / groups of them 21:18:25 Jennifer: we you use tracking negative but interest based targeting is positive 21:18:36 ... a way to discuss this with users, words matter 21:18:50 ISSUE: consistent way to discuss tracking with users (terminology matters!) 21:18:50 Created ISSUE-41 - Consistent way to discuss tracking with users (terminology matters!) ; please complete additional details at http://www.w3.org/2011/tracking-protection/track/issues/41/edit . 21:18:50 ... be consistent, alleviate confusion 21:19:28 Charles: Monolithic is where my social networking thing fits 21:19:43 Matthias: a channel from the browser from the site is there a back channel? 21:20:28 Cris: use cases.... make tracking more prominent in the browser 21:20:33 ... e.g. you see Green or a lock 21:20:42 Aleecia: as a UI issue, we won't go into that 21:21:03 ISSUE: feedback to the user from the browser when Do Not Track is turned on 21:21:03 Created ISSUE-42 - Feedback to the user from the browser when Do Not Track is turned on ; please complete additional details at http://www.w3.org/2011/tracking-protection/track/issues/42/edit . 21:21:10 Cris: DNT enabled, educate user: here's how the site will change because of DNT being "on" 21:21:30 ... either that, condition of using this site is ... we will capture this info., share this with those guys, etc. 21:21:38 ... or you can pay a monthly subscription 21:22:06 Aleecia: vaguely like a Privacy policy is one, another is choice: money or lose functyionaliyu 21:22:24 Cris: Android... why access to my call list? Sure, I will give that up 21:22:47 Karl: Do you mean the server should be able to directly change the setting in the web page? 21:22:58 ISSUE: sites should be able to let the user know their options when they arrive with Do Not Track 21:22:59 Created ISSUE-43 - Sites should be able to let the user know their options when they arrive with Do Not Track ; please complete additional details at http://www.w3.org/2011/tracking-protection/track/issues/43/edit . 21:23:03 Cris: Yes, right, like in Firefox they provide that header,, so they can detect and set it up. 21:23:09 Jonathan: 3 use cases 21:23:27 ....1 measure detect who is making a commitment to DNT 21:23:35 ISSUE: ability to measure/detect who is honoring Do Not Track at a technical level 21:23:36 Created ISSUE-44 - Ability to measure/detect who is honoring Do Not Track at a technical level ; please complete additional details at http://www.w3.org/2011/tracking-protection/track/issues/44/edit . 21:24:01 ... 2 regulatory hook here, companies making commitments here is only way now, have feedback mechanism into US Law 21:24:04 ISSUE: companies making public commitments with a "regulatory hook" for US legal purposes 21:24:04 Created ISSUE-45 - Companies making public commitments with a "regulatory hook" for US legal purposes ; please complete additional details at http://www.w3.org/2011/tracking-protection/track/issues/45/edit . 21:24:29 ... 3 some users might want to engage in self-help, this site promises DNT, user says only use those sites 21:24:54 Aleecia: reads back some: 21:25:20 ... Know who supports DNT across ecosystem (exhaustive list), not just of the sites I was visiting 21:25:24 Jonathon: both would be nice 21:25:30 ISSUE: enable users to do more granular blocking based on whether the site responds honoring Do Not Track 21:25:30 Created ISSUE-46 - Enable users to do more granular blocking based on whether the site responds honoring Do Not Track ; please complete additional details at http://www.w3.org/2011/tracking-protection/track/issues/46/edit . 21:25:40 ... interface right in browser, and also list 21:25:50 Aleecia: regulatory hook? 21:26:25 Jonathon: US Law... without all details.... if a company makes a representation, then violates it, would be to make DNT enforceable via these committments 21:26:48 ISSUE-44: useful both for broader crawling analysis and for per-site notice about which items are responsive 21:26:48 ISSUE-44 Ability to measure/detect who is honoring Do Not Track at a technical level notes added 21:26:50 Shane: challenge/response method, or texturally in Privacy Policy, former in IETF draft 21:27:14 Amy: question for Jonathon 21:27:20 ... co branded page? 21:27:29 ISSUE-45: a way to address "toothless" complaints or enforcement issues for Do Not Track 21:27:29 ISSUE-45 Companies making public commitments with a "regulatory hook" for US legal purposes notes added 21:27:54 Jonathon: providing some ability to know who is honoring it... combined page... broader web context is another... users, reseachers, regulators, stakeholders, etc. 21:28:01 s/Jonathon/Jonathan/g 21:28:08 Amy: collaborative résponse creation OK? 21:28:21 Aleecia: role up, multiple entities 21:28:46 Kimon: not sure the regulatory hook,, would not work out with 27 regulatory jurisdictions 21:28:58 ... unless it is personal data 21:29:19 ... program of accountability.... isn't it under that heading? 21:29:35 Jonathon: both self-regulation and law, both useful here... 21:29:43 ... he thinks law is doable, taking it offline 21:30:22 Aleecia: US and EU could differ, self-regulatory, and auditing can be bundled together, feedback mechanism 21:30:24 ISSUE-45: could be useful for enforcement either through regulation or self-regulation; "accountability"; could be EU/US jurisdiction distinctions 21:30:24 ISSUE-45 Companies making public commitments with a "regulatory hook" for US legal purposes notes added 21:30:35 Shane: self regulation should have teeth via Audits. scribenick: clp 21:32:13 clp has joined #dnt 21:32:35 RoyFielding: issue 21:32:37 ISSUE: should the response from the server point to a URI of a policy (or an existing protocol) rather than a single bit in the protocol? 21:32:38 Created ISSUE-47 - Should the response from the server point to a URI of a policy (or an existing protocol) rather than a single bit in the protocol? ; please complete additional details at http://www.w3.org/2011/tracking-protection/track/issues/47/edit . 21:32:54 ISSUE-47: candidates: HTTP link relationship, .well-known, ... 21:32:54 ISSUE-47 Should the response from the server point to a URI of a policy (or an existing protocol) rather than a single bit in the protocol? notes added 21:33:24 ThomasLowenthal: re-propose, suggest use case: challenge / response, specific proposal 21:33:33 Matthias: Details not ironed out yet 21:33:50 Nick: are there specific details here? 21:34:39 ThomasLowenthal: Challenge is 1, server says I am going to follow 1, or allow 0. I see you are requesting DNT, and I as server may or may not accept that. 21:34:54 ThomasComScore: that means for exception you also have to... 21:35:00 ThomasLowenthal: No 21:35:28 ... reply sent depends on why . what... taken offline 21:35:37 ISSUE: response from the server could both acknowledge receipt of a value and (separately) whether the server will honor it 21:35:38 Created ISSUE-48 - Response from the server could both acknowledge receipt of a value and (separately) whether the server will honor it ; please complete additional details at http://www.w3.org/2011/tracking-protection/track/issues/48/edit . 21:35:45 ISSUE-48: alternate design choice for ISSUE-47 21:35:46 ISSUE-48 Response from the server could both acknowledge receipt of a value and (separately) whether the server will honor it notes added 21:36:06 Kevin: reframe ... with the Icon system ... is there a response with every back/forth so you can see it happening 21:36:15 ... self asserted compliance vs audited compliance 21:36:23 ... more weight to oversight? 21:37:33 Aleecia: Self-asstered compliane, useful feedback, 21:37:41 ... independent audit 21:38:11 Frederick: why not comply? 21:38:33 Aleecia: Facebook says we do not comply with the way that compact policies work rather than having tokens as part of that 21:38:37 ... it exists now 21:38:49 Shane: no pen but have a use case 21:39:00 ... depending on how we go about allowing the user to give consent 21:39:22 ... leave it to parties to give consent vs (lost) 21:39:37 Aleecia: ... opt in using some other procedure 21:39:50 Shane: a common use case for specifying that you don't comply is the use case of noting that you the user have opted back in through some out-of-band measure 21:40:10 KevinAdobe: as a consumer once I click that box user assumes there is no tracking, but actually we can't tell... you may still be tracked 21:40:24 Peter: or they could lie and track you anyway 21:40:36 Aleecia: Notice of sites that DON'T give notice 21:41:26 ISSUE-48: could enable the browser to tell the user that they may still be tracked 21:41:27 ISSUE-48 Response from the server could both acknowledge receipt of a value and (separately) whether the server will honor it notes added 21:41:38 zakim, agenda? 21:41:38 I see 3 items remaining on the agenda: 21:41:40 7. actual work (regulatory definition items) [from ifette] 21:41:42 8. technology items [from ifette] 21:41:42 10. use cases [from ifette] 21:41:48 agenda 7- 21:41:51 clp_ has joined #dnt 21:41:51 agenda 8- 21:41:52 agenda 10- 21:41:56 agenda+ closing remarks 21:41:59 Matthias: closing 21:42:02 zakim, take up agendum 11 21:42:02 agendum 11. "closing remarks" taken up [from ifette] scribenick: clp_ 21:42:22 Matthias: now we have all the boards .... catch all these balls in the air and put into documents somehow 21:42:31 ... We opened 48 issues. 47 in fact. we closed the first one. 21:42:42 ... very positive so far, people listening to each other 21:42:52 ... original agenda... too early for tech... best if we take the issues list and sort it, make little groups... tackle some of the issues 21:43:15 ... if I would be me 21:43:31 ... I would do the basic things first, find what they are, start there, in each issue 21:43:35 ... smaller groups ideal 21:43:56 ... drop yourself into issue interest groups 21:44:08 ... report results back to larger group, then iterate 21:44:39 Aleecia: slip deadline on other deliverables? 21:44:44 Matthias: I don't know 21:44:59 ... what we should do tomorrow: morning: ironing out issue 21:45:13 ... afternoon sort issues into documents, create resolved and unresolved 21:45:33 W3C guy: agenda adjustment on the fly usually a bad idea 21:45:41 s/W3C guy/tlr/ 21:45:47 ... may want to reallocate the time, a dinner discussion 21:46:06 ... equal time, e.g. tech deliverable longer time needed 21:46:20 Brad: we are proposing breaking into groups for issues 21:46:32 ... but people in the room don't agree, not that they don't understand them 21:46:34 s/Brad/ifette/ 21:47:06 ... example of meaningful group discussion 21:47:22 Matthias: 1st party 3rd party, carve out all the cases, document them 21:47:29 Brad: expand and generate 21:47:36 s/Brad/ifette/ 21:47:56 Matthas: identify preliminary agreement... make proposals, plausible conclusion / solution 21:48:11 ... focuses energy, makes results more tangible 21:48:36 Roy: anyone who raised an issue, gives mailing list your own description of what the issue means 21:48:51 Brad: only members can see issues, so some can't see them 21:49:16 tlr: you can send email, that will get registered and linked properly 21:49:38 fielding has joined #dnt 21:49:50 Aleecia: subscribe if you have not, archives are public 21:49:51 http://lists.w3.org/Archives/Public/public-tracking/2011Sep/ 21:49:59 Mailing list 21:49:59 rrsagent, please draft the minutes 21:49:59 I have made the request to generate http://www.w3.org/2011/09/21-dnt-minutes.html ifette 21:50:15 Matthias: end, dinner at 7 pm at Legal Sea Food 21:50:21 ... map on wall 21:50:27 ... end session. 21:50:38 rrsagent, make minutes public 21:50:38 I'm logging. I don't understand 'make minutes public', ifette. Try /msg RRSAgent help 21:50:41 http://www.w3.org/2011/tracking-protection/track/ 21:50:44 rrsagent, make record public 21:50:53 -[Microsoft] 21:51:06 -StarConferenceRoom 21:51:07 Team_(dnt)13:00Z has ended 21:51:09 Attendees were +1.617.715.aaaa, StarConferenceRoom, +1.949.483.aabb, +1.818.575.aacc, BrianTschumper 21:57:51 aleecia has joined #dnt 22:29:10 npdoty has joined #dnt 22:38:10 enewland has joined #dnt 23:05:27 aleecia has joined #dnt 21:28:01 s/Jonathon/Jonathan/g