Tracking Compliance and Scope

2.1 Goals

What are underlying user concerns, and goals, that we hope a tracking preference recommendation will address?

ISSUE-6: What are the underlying concerns? Why are we doing this / what are people afraid of?

1. Using the internet by definition involves the exchange of data across servers; the web cannot exist without it. In addition, commerce and the commercialization of content on the web often involves personalization of both content and advertising by websites, their advertisers, and their partners. Given the realities of this environment, this standard seeks to provide an exceedingly straightforward way for users to gain transparency and control over data usage and the personalization of content and advertising on the web.
2. CDT document: The user experience online involves the unintentional disclosure and commercial compilation of many different kinds of user data among different entities, comprising a wide range of practices that could be called "tracking." At the most basic level, online communication requires the exchange of IP addresses between two parties. Completion of e-commerce transactions normally involves the sending of credit card numbers and user contact information. Social networking sites often revolve around user-provided profiles. Much web content is supported by advertising and much of this advertising is linked to either the content of the page visited or to a profile about the particular user or computer. Complex business models have arisen around the online data flows. DNT mechanisms should, at their core, empower users to prevent the collection and correlation of data about Internet activities that occur on different sites. Users expect control over who is tracking them and how tracking data may be shared.
3. Open issues:
   1. What is this solution attempting to address that has not been addressed by previous solutions such as opt-out cookies, browser-level cookie blocking, etc? (i.e. other technologies? something else?)
   2. Are there any unintentional dangers/harms to either users or web commerce that the standard is seeking to avoid while achieving its primary goal?

ISSUE-8: How do we enhance transparency and user awareness? Explain the scope of this tracking document in the context of Do Not Track

2.2 Success Criteria

Explain the success criteria. What do we want this specification to achieve?

3.1 First Party

ISSUE-10: What is a first party?

ISSUE-49: Third party as first party - is a third party that collects data on behalf of the first party treated the same way as the first party?

ISSUE-26: Providing data to 3rd-party widgets -- does that imply consent?

Options for discussion:

1. Should we define first party based on company and affiliation, or organizational boundaries, or corporate structure?
   1. A first party is the entity (and its commonly branded affiliates) that owns or controls the web site the end user visits. An affiliate is an entity that Controls, or is Controlled by, or is under common Control with, another entity; or an entity where the relationship to another entity is evident to end users through co-branding or similar means.
   2. The entity that is the owner of the website or has control over the website with which the user interacts and its affiliates.
2. Should we define first party based on domain owner, common branding and user expectation?
   1. The domain that the user visits.

In addition, a domain that hosts a third-party visible widget or window that is clearly identified and branded as being controlled and operated by a party separate and distinct from the first party becomes a first party itself when a user engages in "meaningful interaction" with the window or widget.

There has also been a discussion whether we should distinguish between first and third party. Is this a useful road to go down?

3.2 Third Party

A third party is any entity other than a first party as defined above. A user is neither a first party nor a third party.

Open questions:

1. Third party data collection for first party use?

3.3 Transactional data

Transactional data is information about the user's interactions with various websites, services, or widgets which could be used to create a record of a user’s system information, online communications, transactions and other activities, including websites visited, pages and ads viewed, purchases made, etc.

Our definition should be technology independent (cookies, flash cookies, etc)

ISSUE-16: What does it mean to collect data? (caching, logging, storage, retention, accumulation, profile etc.)

3.4 Types of Tracking

ISSUE-5: What is the definition of tracking?

Note: This section will obviously be the topic of conversation and will need significant work; the current text merely represents a straw man and a starting point. It may be useful to decide, first, whether we are working to prevent XYZ or allow only ABC.

For now, we are using "behavioral tracking" as the term of interest in the scope of this document, though we may want to refer in all cases to "tracking" instead.

Behavioral tracking is the collection and retention of transactional data about the web-based activities of a particular user, computer, or device across non-commonly branded entities in a form that allows activities across non-commonly branded entities to be attributed to a particular user, computer, or device, over time, for any purpose other than the explicitly-excepted purposes specified below.

Depending on the conclusion of first vs. third parties issues, this definition of tracking may not include references to common branding.

We expect to discuss several activities as potential exemptions including the following:

1. Third party non-behavioral ad and content delivery.
2. Third party analytics and other siloed service providers.
3. Certain third party ad reporting.
4. De-identified cross-site analytics or market research and/or data that is, with high confidence, not reasonably linkable to a specific user, computer, or device.
5. Data collected for fraud prevention and other security purposes.
6. Behavioral tracking that is obviously necessary to complete a transaction that the user has affirmatively chosen to engage in.

Should we explicitly identify goals and use cases in order to evaluate these exemptions?

We may want to talk about including a data minimization piece to these exceptions

For the purposes of this specification, here are some examples of activities associated with tracking:

1. Third party behavioral advertising.
2. Non de-identified cross-site analytics or market research.
3. Third party behavioral tracking not conducted for an exempted purpose.

ISSUE-7: What types of tracking exist, and what are the use cases for these types of tracking?

Should we address the association of first party data with third party data? What does this standard say about a first party associating offline data from a third party with their own data and then using that in targeting? How about the first party associating it with third party data and/or selling it to a third party?

ISSUE-34: Possible exemption for aggregate analytics

ISSUE-22: Still have "operational use" of data (auditing of where ads are shown, impression tracking, etc.)

ISSUE-23: Possible exemption for analytics

ISSUE-73: In order for analytics or other contracting to count as first-party: by contract, by technical silo, both silo and contract

ISSUE-24: Possible exemption for fraud detection and defense

ISSUE-25: Possible exemption for research purposes

ISSUE-28: Exception for mandatory legal process

ISSUE-75: How do companies claim exemptions and is that technical or not?

ISSUE-31: Minimization -- to what extent will minimization be required for use of a particular exemption? (conditional exemptions)

ISSUE-36: Should DNT opt-outs distinguish between behavioral targeting and other personalization?

ISSUE-74: Are surveys out of scope?

ISSUE-92: If data collection (even very specific with IP address, user agent, referrer) is time-limited, with very limited retention, is that still tracking?

ISSUE-72: Basic principle: independent use as an agent of a first party

ISSUE-89: Does DNT mean at a high level: (a) no customization, users are seen for the first time, every time. (b) DNT is about data moving between sites.

ISSUE-97: Re-direction, shortened URLs, click analytics -- what kind of tracking is this?

3.5 De-identified data

If we provide an exception for de-identified cross-site research/analytics, we will need to define de-identified data .

ISSUE-20: Different types of data, what counts as PII, and what definition of PII

Note: this may be irrelevant - the rest of the spec does not mention PII

3.6 Consent

The term “affirmative, informed consent” is used throughout this document. While this terminology may ultimately be modified, some options for explaining the underlying idea are presented below:

Option:

1. "Affirmative, Informed Consent to be Tracked" means consent given by an affirmative action such as clicking a consent box in response to a clear and prominent request to ignore a "Do Not Track" setting that is distinct and separate from any other notifications or requested permissions.
2. "Affirmative, Informed Consent to be Tracked" means that the a mechanism to provide for or facilitate the acquisition and storage of permission to ignore the header has been made available to the user and the user has meaningfully interacted with the mechanism in a way that makes clear her intent to grant this permission.
3. No definition, leaving the definition of consent to local rules.

ISSUE-69: Should the spec say anything about minimal notice? (ie. don't bury in a privacy policy)

3.7 Meaningful Interaction

One option for the definition of meaningful interaction is:

1. "Meaningful Interaction" with a widget or window initially presented on a third-party basis means affirmatively clicking on such content (except to stop, close, silence, or otherwise impair the rendering of such content) or otherwise engaging with the content in a manner that would reasonably be interpreted to express an intention to interact with that party. A user merely moving her cursor across the widget or window does not constitute "meaningful interaction."

4.1 First Party Compliance

Options:

1. This standard imposes no requirements on the operators of first-party entities.
2. If the operator of a first party domain receives a request to which a DNT header is attached, that operator must not transmit behavioral tracking data in identifiable form about that user to a third party with the intention or knowledge that the third party shall store and use the data in a way that links that data to other information about a specific person or device, UNLESS that operator has received the affirmative, informed consent to be tracked and such consent has not been subsequently rescinded.

ISSUE-55: What is relationship between behavioral advertising and tracking, subset, different items?

ISSUE-17: Data use by 1st Party

ISSUE-30: Will Do Not Track apply to offline aggregating or selling of data?

ISSUE-54: Can first party provide targeting based on registration information even while sending DNT

ISSUE-59: Should the first party be informed about whether the user has sent a DNT header to third parties on their site?

ISSUE-9: Understand all the different first- and third-party cases.

ISSUE-91: Might want prohibitions on first parties re-selling data to get around the intent of DNT

4.2 Intermediary compliance

This issue is being addressed in the Tracking Preference Expression specification.

ISSUE-95: May an institution or network provider set a tracking preference for a user?

4.3 Compliance by a third party

If the operator of a third-party domain receives a request to which a DNT header is attached, that operator must not engage in behavioral tracking of that user UNLESS that operator has received the affirmative, informed consent of that user to be tracked and such consent has not been subsequently rescinded. If data is collected for an excepted purpose, the operator must not use that data for any other purpose.

If the operator of a third-party domain receives a request to which a DNT header is attached, that operator must not use previously collected behavioral tracking data to inform the third party's decision as to what content to render for the user in response to the request, or otherwise alter the user's experience based on the previously collected behavioral tracking data UNLESS that operator has received the affirmative, informed consent of that user to be tracked and such consent has not been subsequently rescinded.

If the operator of a third-party domain receives a request to which a DNT header is attached, that operator must/should/may delete previously collected behavioral tracking data about that user, EXCEPT that operator may retain previously generated reports based on data about aggregated behavioral tracking data from multiple users' data even if those reports were based in part on previously collected behavioral tracking data about that user.

ISSUE-19: Data collection / Data use (3rd party)

ISSUE-88: different rules for impression of and interaction with 3rd-party ads/content

ISSUE-32: Sharing of data between entities via cookie syncing / identity brokering

ISSUE-71: Does DNT also affect past collection or use of past collection of info?

4.4 Compliance regarding Sensitive Information

This specification does not provide for heightened levels of protection for sensitive categories of data, including children's data.

ISSUE-15: What special treatment should there be for children's data?

6.1 How should a tracking preference interact with user overrides?

ISSUE-66: Can user be allowed to consent to both third party and first party to override general DNT?

ISSUE-67: Should opt-back-in be stored on the client side? [Not sure this doesn't belong in the technical spec]

ISSUE-83: How do you opt out if already opted in?

ISSUE-93: Should 1st parties be able to degrade a user experience or charge money for content based on DNT?

6.2 Interaction with existing user privacy controls

If the operator of a third-party domain receives a request to which there is no DNT header attached but detects that it has set an "opt-out" cookie for that particular device, the operator may comply with the behavioral tracking prohibitions on third-party domains that receive the DNT header as specified in x.x (currently 4.3) of this specification, and must comply with the assurances that the operator previously made to the user in association with the user "opting out" from the third party and the setting of the opt-out cookie.

ISSUE-35: How will DNT interact with existing opt-out programs (industry self-reg, other)?

ISSUE-52: What if conflict between opt-out cookie and DNT?

ISSUE-53: How should opt-out cookie and DNT signal interact?

ISSUE-58: What if DNT is explicitly set to 0 and an opt-out cookie is present?

ISSUE-56: What if DNT is unspecified and an opt-out cookie is present?

ISSUE-57: What if an opt-out cookie exists but an "opt back in" out-of-band is present?

ISSUE-33: Complexity of user choice (are exemptions exposed to users?)

ISSUE-65: How does logged in and logged out state work

6.3 User Education and Communication

How do we educate and communicate with users? Is that out of scope?

6.4 Enforcement/Compliance

If there is a response header, this is likely unnecessary

Options:

1. In order to be compliant with this specification, an operator of a third-party domain must either do no behavioral tracking, or make a public statement or otherwise deliver a statement to the user asserting intent to comply with the header.
2. In order to be compliant with this specification, an operator of a third-party domain must make a public statement or otherwise deliver a statement to the user asserting intent to comply with the header.
3. In order to be compliant with this specification, an operator of a third-party domain must either not engage in behavioral tracking or clearly and unambiguously assert in the privacy policy governing that domain that it is in compliance with this specification.

ISSUE-21: Enable external audit of DNT compliance

ISSUE-45: Companies making public commitments with a "regulatory hook" for US legal purposes