08:52:24 <RRSAgent> RRSAgent has joined #dnt
08:52:24 <RRSAgent> logging to http://www.w3.org/2012/01/24-dnt-irc
08:52:26 <trackbot> RRSAgent, make logs world
08:52:28 <trackbot> Zakim, this will be 
08:52:28 <Zakim> I don't understand 'this will be', trackbot
08:52:29 <trackbot> Meeting: Tracking Protection Working Group Teleconference
08:52:29 <trackbot> Date: 24 January 2012
08:52:42 <npdoty> Meeting: Tracking Protection Working Group Brussels f2f
08:53:32 <tl> tl has joined #dnt
09:06:29 <npdoty> scribenick: npdoty
09:06:46 <npdoty> schunter: we've achieved a lot, established our group, lively discussion, made progress on solving issues
09:06:49 <alex_> alex_ has joined #dnt
09:06:50 <npdoty> ... so far good progress
09:06:58 <npdoty> ... produced several documents
09:07:03 <npdoty> ... happy about the atmosphere in the group
09:07:05 <Joanne> Joanne has joined #DNT
09:07:34 <npdoty> ... still a lot of issues to resolve
09:07:41 <ninjamarnau> ninjamarnau has joined #dnt
09:07:44 <jmayer> jmayer has joined #dnt
09:07:45 <npdoty> ... at a make or break point of this venture
09:08:04 <johnsimpson> johnsimpson has joined #DNT
09:08:09 <npdoty> ... time to identify solutions that fulfill our requirements
09:08:30 <npdoty> ... now have to start moving on our positions, don't go for the perfect solution
09:08:47 <johnsimpson> +1 to consensus
09:09:11 <npdoty> ... efficient to implement and increase privacy
09:09:23 <johnsimpson> =1 to perfect consensus
09:09:45 <npdoty> aleecia: fantastic hosts (European Commission)
09:09:59 <npdoty> guiseppe: head of policy development unit in electronic communications
09:10:10 <npdoty> ... we are responsible for the ePrivacy directive
09:10:12 <npdoty> ... happy to host
09:10:30 <npdoty> ... we will attend all sessions, can provide assistance on European regulatory framework
09:10:56 <npdoty> ... wish you every success
09:11:31 <npdoty> Carl-Christian Buhr
09:12:07 <npdoty> introduction video from Vice President Kroes
09:12:16 <jchester2> jchester2 has joined #dnt
09:13:03 <npdoty> buhr: VP sends her best wishes for a good event, wanted to attend the opening session, has to be in two Parliaments todays, sends her apologies
09:13:25 <jimk> jimk has joined #dnt
09:13:26 <WileyS> WileyS has joined #DNT
09:13:44 <npdoty> ... more technical remarks in context
09:13:56 <npdoty> ... managed finally to provide hosting
09:14:08 <npdoty> ... we think this work is important because we think it can help with our policy goals
09:14:31 <npdoty> ... we have a different legal framework in the EU
09:15:38 <npdoty> ... a common approach and tool, rather than having every provider scramble to respond to a particular law
09:15:51 <KevinT> KevinT has joined #dnt
09:15:53 <npdoty> ... DNT and things like it can be a solution to the problem of fragmentation, if they are good enough
09:16:12 <fwagner> fwagner has joined #dnt
09:16:27 <npdoty> ... doesn't distinguish between tracking/non-tracking activities, or between 1st and 3rd, requires explicit consent for many types of cookies
09:17:09 <npdoty> ... what is the concern that they want to address in using DNT
09:17:15 <bryan> bryan has joined #dnt
09:17:27 <npdoty> ... our plea is that we keep in mind EU compliance
09:17:34 <bryan> present+ Bryan_Sullivan
09:17:40 <rigo> rigo has joined #dnt
09:17:50 <npdoty> ... we don't think a solution that isn't 100% is somehow worthless
09:18:01 <npdoty> ... please feel free to contact me to discuss further
09:18:09 <npdoty> ... wish you a great event
09:18:24 <npdoty> video (with audio!) of Neelie Kroes
09:18:42 <justin> justin has joined #dnt
09:18:43 <npdoty> kroes: impressed with the quality of this group, breadth of representation and technical expertise
09:19:05 <npdoty> ... if we don't have trust and privacy, people will shy away from the online world
09:19:15 <npdoty> ... something that users can instantly understand and easily make a choice
09:19:21 <npdoty> ... Do Not Track can help us get there
09:19:45 <npdoty> ... four things: principles of transparency, fairness and user control
09:20:17 <npdoty> ... second, must be rich and relevant
09:20:32 <npdoty> ... third, must be flexible enough to work in different legal frameworks
09:21:02 <npdoty> ... fourth, we need this standard soon
09:21:14 <npdoty> ... Do Not Track today is still an aspiration
09:21:28 <npdoty> ... called for agreement by June of this year, to turn DNT into a reality for Web users
09:21:49 <npdoty> ... if we get it right, DNT can become the standard way to comply
09:22:06 <npdoty> aleecia: lucky to be hosted here
09:22:25 <npdoty> ... introduce the chairman of the Federal Trade Commission 
09:22:56 <npdoty> leibowitz: joined by efelten, whom you all know; and thanks to EC for hosting
09:23:17 <npdoty> ... long time and always productive collaboration with Neelie Kroes
09:23:36 <npdoty> ... sometimes we take slightly different approaches, but we very much take the same goals, "strike the right balance"
09:23:54 <npdoty> ... 13 months ago the staff report (final report in the next 6 weeks or so)
09:24:02 <npdoty> ... a few pages on Do Not Track seemed to resonate the most
09:24:31 <npdoty> ... users want to have a choice, especially when it comes down to third parties which track users
09:24:46 <npdoty> ... giving users choice won't solve all privacy problems, but it would be a step forward
09:25:20 <npdoty> ... browsers rolled out tracking protection features, thank you Mozilla; and I saw Mike Zaneis here, thank you Mike
09:25:52 <npdoty> ... I think going forward no one will follow the SOPA approach (that was a joke)
09:26:17 <npdoty> ... in the US, we don't usually first just set down laws/rules for everyone to follow
09:26:30 <npdoty> ... in general, we take the position that stakeholders are in the best position to solve problems
09:27:01 <npdoty> ... industry can sometimes very quickly come up with solutions
09:27:26 <npdoty> ... but those solutions don't always do the best in protecting consumers
09:27:47 <npdoty> ... the third approach that we really like is a multi-stakeholder process, with open public international process
09:27:56 <npdoty> ... and that's what we're doing here
09:28:06 <npdoty> ... perhaps it can even help with the complexities of the EU regulation debate
09:28:35 <npdoty> ... extraordinarily broad participation from industry sectors (analytics, advertising, social networks), consumer groups, multiple countries
09:28:47 <npdoty> ... so impressed with the progress made thus far
09:28:54 <npdoty> ... I know there's a lot of work left to do
09:29:20 <npdoty> ... not everyone gets everything that they want, but all invested in the outcome as we all share the goal that a Do Not Track standard is within reach
09:29:33 <npdoty> ... thank you so much for letting me participate
09:30:11 <npdoty> aleecia: thank you all very much for being here, some traveling a great distance
09:30:28 <npdoty> Matthias at IBM working on privacy and security
09:30:41 <npdoty> I'm at Mozilla half-time who have made it possible for me to participate in this work
09:30:57 <npdoty> s/Matthias/... Matthias/
09:31:04 <npdoty> s/I'm at/... I'm at/
09:31:11 <npdoty> please don't lose your badges
09:31:18 <npdoty> aleecia: privacy as a three-layer cake
09:31:28 <npdoty> ... some data required to be kept
09:31:35 <npdoty> ... some where there's user choice
09:31:54 <npdoty> ... some where data collection is prohibited (for certain data and certain communities)
09:32:19 <npdoty> ... without user choice, the other categories tend to grow, like policymakers prohibiting more data collection
09:32:41 <npdoty> ... theme of a loss of user trust
09:33:14 <npdoty> ... can lose a lot of revenue if users lose trust in things like advertising
09:33:26 <npdoty> ... privacy is very contextual
09:33:37 <npdoty> ... reasonable people differ on preferences, users not a singular block
09:33:44 <npdoty> ... give users a voice
09:34:09 <npdoty> ... why Do Not Track in particular?
09:34:30 <npdoty> ... arms race of different tracking methods and opt-out techniques
09:35:12 <npdoty> ... Do Not Track originally goes back multiple years
09:35:25 <npdoty> ... DNT can solve new problems, like redirects
09:35:42 <npdoty> ... here at W3C we create technical standards
09:35:56 <npdoty> ... preference expression as bytes on the wire, and compliance as the meaning of those bytes
09:36:13 <npdoty> ... tracking selection lists we've gone back and forth on
09:36:21 <npdoty> ... to determine if we're going to publish something on that
09:36:33 <npdoty> <applause for the editors>
09:36:46 <npdoty> aleecia: successive drafts of these documents
09:37:08 <npdoty> ... FPWDs as extended outlines
09:37:30 <npdoty> ... Last Call would mean that we have addressed all the major issues and move to an issue freeze within the group, and gather external feedback which can turn up new issues
09:37:54 <npdoty> ... Candidate Recommendation after we've responded to all that external feedback
09:38:04 <npdoty> ... this stage we Call for Implementations
09:38:10 <npdoty> ... this has to be something that works in the real world
09:38:43 <npdoty> ... Proposed Recommendation we should have at least (and probably more) two working interoperable implementations
09:39:33 <npdoty> ... first phase was really identifying issues, then exploring them
09:39:44 <npdoty> ... now entering a phase of resolving, we need to close these issues, come to a resolution for them
09:40:01 <npdoty> ... now have 17% of our issues closed, but still increasing the number of open issues
09:40:13 <npdoty> ... we've also done a fair amount of work proposing text
09:40:21 <npdoty> ... "Getting to Closed"
09:41:13 <npdoty> ... can re-open issues when we have new information and a new text proposal at the chairs' discretion
09:41:40 <npdoty> ... try to find consensus, the 80%, the least-strong objections, something we all can live with
09:42:00 <npdoty> ... with votes, your company gets one vote
09:42:18 <npdoty> ... Invited Experts also get one vote
09:43:17 <npdoty> ... if we have formal objections, we give a group response and can then finally end up with a Director decision
09:43:35 <npdoty> aleecia: laughter not yelling
09:44:07 <npdoty> JC: what about monitors/observers?
09:44:21 <npdoty> aleecia: observers cannot vote
09:44:58 <npdoty> aleecia: must help privacy, must be implementable by user agents and by sites
09:45:07 <npdoty> ... confirmation bias sometimes (remembering everyone agreeing with me)
09:45:18 <npdoty> ... our process is to get to consensus
09:45:47 <npdoty> ... our goal for this meeting is to get issues closed
09:46:22 <efelten> efelten has joined #dnt
09:46:30 <npdoty> agenda for today: welcomes, overviews of drafts, discussing of Tracking Selection Lists, move to Centre Borschette (and get lunch)
09:46:50 <npdoty> ... presentation from comments of the Community Group
09:47:16 <npdoty> ... then take up some of the meat; 1st and 3rd parties, tracking/cross-site
09:47:28 <npdoty> ... exceptions 
09:47:42 <npdoty> ... reserve some time for unresolved issues
09:47:47 <npdoty> <laughter on that joke>
09:48:20 <karl> karl has joined #dnt
09:48:25 <andyzei> andyzei has joined #dnt
09:48:40 <jchester2> jchester2 has joined #dnt
09:50:03 <JC> JC has joined #DNT
09:50:21 <mgroman> mgroman has joined #DNT
09:51:01 <sean> sean has joined #dnt
09:51:03 <meme> meme has joined #dnt
09:51:14 <npdoty> scribe volunteers: bryan, rvaneijk, AlanC, dsinger, efelten, jeffC, ninjamarnau
09:52:18 <npdoty> please help the scribes find your names!
09:52:25 <bryan> scribenick: bryan
09:52:54 <npdoty> Topic: Editors introducing drafts
09:53:18 <vincent_> vincent_ has joined #dnt
09:53:26 <tlr> tlr has joined #dnt
09:53:27 <npdoty> http://www.w3.org/2011/tracking-protection/drafts/tracking-dnt.html
09:53:34 <bryan> matthias: Roy will present the TPE first
09:54:04 <bryan> ... goal is to get an overview not discuss all issues, ask questions, note issues for later sessions
09:54:47 <bryan> roy: a lot of progress up to and in Santa Clara
09:55:21 <bryan> ... defining comms between UA and servers is the goal. Its all editors text so far.
09:55:36 <npdoty> bug request for Tracker that we should distinguish between closed and duplicate issues
09:55:55 <jmayer> +1 on the issue tracker recommendation
09:56:03 <bryan> ... some issue management is needed, to triage and address the issues. input is needed on what is expected in the text
09:56:03 <ShaneW> ShaneW has joined #dnt
09:56:09 <jmayer> also, hierarchy would help
09:56:28 <bryan> ... if you disagree with the intro section, recommend text
09:56:55 <schunter> schunter has joined #dnt
09:57:04 <bryan> ... input that is received is reflected in the text, so get your voice in
09:57:55 <bryan> ... overview: explaining what user preference means, how UAs determine what to send, how it is sent, and what do servers send back in response
09:57:57 <aleecia> aleecia has joined #dnt
09:58:28 <bryan> ... user-managed site exceptions is for users to opt-back-in etc, so user can manage site-specific exceptions for tracking
09:58:43 <bryan> ... still unsure what tracking means, but we will get there
09:58:50 <bryan> ... main changes are in section 3 and 6
09:59:07 <bryan> ... section 3, determining user preference
09:59:18 <bryan> ... we addressed the role of intermediaries
09:59:44 <bryan> ... for section 4 there is some text that does not have consensus, on expressing tracking preferences, we need to discuss here
10:00:28 <bryan> ... last part is UA managed site exceptions - nick, shane, and sid offered to provide input
10:00:42 <bryan> ... those are all the highlights 
10:01:05 <npdoty> there are a couple of issues tracked regarding site-specific exceptions that aren't included in the draft, I think, because I'm behind
10:01:48 <npdoty> like http://www.w3.org/2011/tracking-protection/track/issues/67 should we have a user-agent-managed technique at all?
10:02:16 <npdoty> and http://www.w3.org/2011/tracking-protection/track/issues/118 we should make it asynchronous
10:02:36 <npdoty> we're now looking at: http://www.w3.org/2011/tracking-protection/drafts/tracking-compliance.html
10:02:48 <bryan> sean: I work for Google, co-editor Justin has worked in privacy for a long time, also support from Erica and Heather who are not here today
10:03:17 <bryan> ... a lot of text is not consensus yet, but it is here so that we can look at it holistically and have a discussion starting point
10:04:32 <bryan> ... at a high level there are 3 goals and success criteria
10:05:45 <bryan> .. enable awareness of data collected, be simple to control, be verifiable in terms of compliance
10:06:11 <bryan> ... definitions are based upon a lot of input but no consensus yet on many of them
10:06:29 <bryan> ... parties, we are done with (not though 1st and 3rd)
10:06:53 <bryan> ... branding needs discussion to reach consensus, e.g. what constitutes corp affiliation and branding
10:07:34 <bryan> ... will be a lot of discussion re 1st and 3rd parties, i believe there is close to consensus on widgets 
10:08:17 <bryan> ... hope to come to resolution this week wrt the role of corp affiliation and common branding, to come to a clear definition of 1st party
10:09:09 <bryan> ... tracking definition has been proposed, we can debate and seek consensus
10:09:26 <npdoty> I thought we did have some tentative definition of tracking on the calls from discussion between WileyS and jmayer
10:09:27 <bryan> ... most obvious aspect is that tracking is about collection of user data
10:09:43 <tl> tl has joined #dnt
10:09:50 <bryan> ... beyond cookies, fingerprints and other methods are also to be considered
10:10:00 <jmayer> Agreed npdoty, all collection and use.
10:10:30 <bryan> ... 3rd party collecting data, and 1st party sharing data with 3rd party are also in scope
10:11:21 <jmayer> ShaneW and I had a few differences on drafting, but agreement on meaning.
10:11:26 <bryan> ... exemptions for operational use need significant discussion, privacy folks have discussed need for minimization
10:12:09 <bryan> ... definitions are further explained and requirements for 1st and 3rd parties follow
10:12:16 <npdoty> ShaneW and jmayer, can we dig that out and write up some text today?
10:12:34 <bryan> ... close to consensus on 3rd party and intermediaries, and somewhat on 1st party
10:13:25 <bryan> ... focusing on 3rd party compliance. (reads the current text) 
10:14:04 <bryan> ... there is a general discussion with open issue re sensitive information. so far we are not heightening protections based upon info category
10:14:11 <jmayer> See the thread "High-level text on third-party responsibilities."
10:14:18 <bryan> justin: location is a relatively under-discussed topic
10:14:27 <npdoty> issue-39?
10:14:27 <trackbot> ISSUE-39 -- Tracking of geographic data (however it's determined, or used) -- open
10:14:27 <trackbot> http://www.w3.org/2011/tracking-protection/track/issues/39
10:14:32 <bryan> sean: it would be good to address location in this meeting
10:14:55 <bryan> aleecia: we have a lot more to discuss
10:15:10 <adrianba> adrianba has joined #dnt
10:15:33 <npdoty> I think we're now looking at: http://dvcs.w3.org/hg/tracking-protection/raw-file/tip/ED-tracking-tsl.html
10:15:40 <aleecia> aleecia has joined #dnt
10:15:42 <bryan> ... we have a tracking protection list draft that has not been discussed, but closely follows the input from microsoft
10:15:53 <justin> justin has joined #dnt
10:16:25 <bryan> karl: we asked f we could put this draft online since its easier to work with, but this is not a wg draft, just an editors draft. it will stay in this stage until the group agrees to work on it 
10:16:56 <bryan> ... we went thru a round of comments from our companies and put the issues in boxes. its far from final form, but good for discusson
10:17:12 <fielding> fielding has joined #dnt
10:17:20 <bryan> ... we need list discussion to avoid missing things
10:18:02 <bryan> ... the approach needs to be simpler than 1st/3rd party distinction, just related to blocking for specific sites
10:18:09 <fwagner> fwagner has joined #dnt
10:18:51 <bryan> ... what happens when the servers don't comply, what is the user choice... is TBD
10:19:15 <bryan> ... what is the final defense mechanism for the user - they need to be able to say no, but can't right now
10:19:44 <bryan> ... its very preliminary, some issues noted in the intro
10:19:59 <aleecia> Rigo, thanks
10:20:12 <aleecia> Second in queue is Shane
10:20:19 <bryan> ... 1st/3rd party URIs are a technical issue, it is not handled right yet
10:21:05 <bryan> roy: suggest a paragraph clarifying this is not a consensus document, remove the product of the WG boilerplate
10:21:41 <aleecia> action: karl to edit document to make sure there's no confusion this is not a consensus document based on WG boilerplate
10:21:42 <trackbot> Created ACTION-46 - Edit document to make sure there's no confusion this is not a consensus document based on WG boilerplate [on Karl Dubost - due 2012-01-31].
10:21:43 <fielding> just a small addition to the SOTD to clarify the special status of this document (as opposed to a normal ED)
10:21:59 <aleecia> it will come up as soon as Karl finishes the overview
10:22:02 <bryan> ... shanew: how does this relate to ad blockers (scribe: not sure I got the question)
10:22:24 <bryan> karl: the document is about blocking URIs
10:22:32 <ShaneW> JMayer - definitely a clarifying question
10:22:45 <npdoty> s/... shanew: how/shanew: how/
10:23:32 <bryan> ... the document defines the rule and how the UA selects and applies the rules. its very technical, no policy aspects
10:23:47 <fwagner> mar1mba
10:23:50 <bryan> aleecia: we will move on to the points e.g. from Shane
10:24:11 <bryan> ... its been controversial, we have spent an hour each time, and this is the 3rd tome to consider it
10:24:34 <fwagner> delete pls  wrong window...
10:24:35 <bryan> ... there are a couple of things going on... this does not have the same timeline as the other docs
10:25:09 <bryan> ... timeline for DNT is very short as we need clarity about what happens when user clicks a DNT buttone
10:25:11 <npdoty> s/mar1mba//
10:25:32 <bryan> ... one approach for TPL is to have a subgroup that can go off and work on it
10:25:58 <bryan> ... objections on whether the WG should tackle this has also been raised
10:26:53 <bryan> ... currently there is no mechanism around the policy of how TSL are managed... browser companies doing this on their own... it might be good to help shape that
10:27:21 <bryan> ... we can do it, but we need to consider the member submissions that led to this proposal
10:27:40 <ShaneW> +q
10:27:43 <bryan> ... in the next half hour we need to come to consensus on who will support this work
10:27:51 <schunter> q?
10:27:57 <jmayer> +q
10:28:28 <andyzei> +q
10:28:52 <bryan> roy: feel that this is not the product W3C should produce - mechanized removal of content from sites is not legal. if driven by a user is OK, but IMO selection lists published by someone else is illegal
10:29:17 <bryan> aleecia: if you had TSL scoped for users to white/black list is that OK?
10:29:21 <bryan> roy: yes
10:29:34 <schunter> q?
10:29:36 <tl> +q
10:29:40 <tl> q?
10:29:43 <npdoty> ack ShaneW
10:29:50 <dsinger> q?
10:29:54 <adrianba> q+
10:30:12 <johnsimpson> q?
10:30:13 <dsinger> q+ to talk about recusing and hostility
10:30:27 <sean> sean has joined #dnt
10:30:32 <sean> +q
10:30:37 <Chapell> Chapell has joined #dnt
10:30:47 <bryan> ShaneW: from a W3C support perspective, I recognize the tech can be used for many things, but its primary purpose to date has been ad blocking. as the chief monetizaton  for the web it does not make sense to move in that direction.
10:30:59 <schunter> q+ nmarnau
10:31:02 <bryan> aleecia: so the purpose of the web is to serve ads?
10:31:06 <schunter> q- nmarnau
10:31:18 <JC> +q
10:31:20 <schunter> q+ zaneis
10:31:24 <bryan> ShaneW: not the purpose but the chief use is to delivery ad-supported content
10:31:27 <johnsimpson> +q
10:31:29 <schunter> q?
10:31:31 <vincent_> +q
10:31:40 <bryan> aleecia: differences exist on that but a good statement
10:31:43 <dsinger> q?
10:31:45 <npdoty> ack jmayer
10:32:06 <bryan> jmayer: ad blocking is not the chief use - it's protecting users from security risks
10:32:07 <justin> +q
10:32:09 <ShaneW> Look at the list of domains in TPLs available in IE9
10:32:49 <alex_> q?
10:33:11 <bryan> ... browsers that interact with services that rate sites however the data is collected - that is a great tool and a good place for standards to go
10:33:39 <schunter> q?
10:33:50 <npdoty> ack andyzei
10:33:51 <bryan> ... ad blocking was going into chrome but got yanked... we should now settle on one approach to help pluses and minuses be resolved
10:34:06 <rigo> support from JMayer
10:34:23 <schunter> q?
10:34:24 <rigo> support from Andy(MS)
10:34:31 <fielding> thanks karl
10:34:38 <rigo> opposition from Roy
10:34:46 <schunter> q+ ksmith
10:34:46 <rigo> opposition from Shane 
10:34:55 <bryan> andyzei: this is a tech feature that can help users until DNT is ready. no matter the jurisdiction there will always be noncompliance, some illegal. but this solution is globally flexible.
10:35:01 <npdoty> karl, "published by the undefined"?
10:35:04 <jmayer> s/to help pluses and minuses be resolved/instead of having unnecessarily conflicting standards/
10:35:23 <schunter> q?
10:35:24 <bryan> ... some jurisdictions will be legislated, others not and this can help there also
10:35:27 <schunter> ack tl
10:35:28 <schunter> q?
10:35:29 <karl> npdoty, yup in the meantime I have found the way to setup Respec for it ;)
10:36:09 <vincent_> npdoty, couldn't a TSL like format be used by "user managed site specific exceptions"
10:36:11 <vincent_> ?
10:36:18 <bryan> tl: that TSL are illegal is a strange view, and that they will break the Web need to be validated also
10:36:23 <alex_> q?
10:36:51 <rigo> vincent, TSL is just an interoperable recording format for those decisions IMHO
10:36:56 <bryan> ... te main use is blocking malicious software... this group was formed to define list management, and is a majority of the founding chartetr
10:36:57 <ShaneW> I did - read Yahoo's paper presented at Princeton
10:36:58 <jmayer> Would support renaming from "Tracking Selection Lists" to something more purpose neutral, e.g. "Content Selection Lists"
10:36:58 <tlr> q?
10:36:59 <schunter> q?
10:37:18 <bryan> ... those who want to work on DNT can do so, but we should work on TSL
10:37:24 <schunter> ack adrianba
10:37:30 <tl> +q
10:37:31 <tlr> clarification: TSLs are one of several elements of the charter.
10:37:53 <vincent_> q-
10:38:03 <ShaneW> JMayer - how about "Security Protection List"?
10:38:21 <schunter> q?
10:38:30 <bryan> adrianb: echo what Tom said, and remind about disposition of comments on the charter. comments from the team at the time was there was strong support for standardizing some type of lists. this does not require all the room, but can be addressed by a task force
10:38:46 <schunter> ackn dsinger
10:38:49 <schunter> ack dsinger
10:38:49 <Zakim> dsinger, you wanted to talk about recusing and hostility
10:38:54 <schunter> q?
10:39:12 <tlr> member-confidential link to the disposition of comments: https://www.w3.org/2011/09/privacy-ac.html
10:39:21 <bryan> dsinger: concern about this is that it is an overtly hostile move, and sites will respond e.g. with DNS tricks and hiding domains etc with a war resulting
10:39:36 <schunter> ack sean
10:39:41 <bryan> ... I can't work on this myself, but I am OK stepping aside while others work on it
10:39:51 <jmayer> ShaneW - would prefer to stay neutral.  I fully acknowledge that ad blocking would be a use.  I don't think W3C needs to (or would) take a position for or against that use.
10:39:57 <tlr> also for reference, the charter: http://www.w3.org/2011/tracking-protection/charter
10:40:06 <schunter> q?
10:40:24 <bryan> sean: wrt TSL primary purpose, it was an ad blocker. thats ok and MS can use it for IE as they choose, but that purpose is why we are uneasy
10:40:31 <vincent_> q+
10:40:33 <ShaneW> Supporting the lists knowing their core purpose will be for ad blocking hardly seems neutral
10:40:40 <npdoty> some have referred to the disposition of comments, which is here (Member-only, sorry): https://www.w3.org/2011/09/privacy-ac.html
10:40:45 <adrianba> q+
10:40:51 <bryan> ... in Santa Clara is was clear the consensus was not to move forward, and surprised to see it coming up again. 
10:41:19 <schunter> sean concerned about ´pay to play´ usage of lists: Pay or be blocked.
10:41:24 <bryan> ... when TPLs went out, pay to play moves led to what seems like not  clean solution and W3C should not work on that
10:41:49 <ShaneW> Truly malicious sites domain rotate regularly to avoid these lists - so the only truly harmed entities are the good actors.  This seems up-side down to where W3C attempts to support from a voluntary standards perspective.
10:41:51 <jmayer> ShaneW - I just explained how ad blocking isn't the primary purpose I'm concerned with, and quite possible won't be the primary use of such lists.  And setting aside that, W3C can explicitly not take a position on the merits of ad blocking.
10:42:07 <alex_> q?
10:42:15 <bryan> aleecia: we had a straw poll in Boston, and in Santa Clara we discussed editors if we moved forward, and at the end we weren't sure if we would publish, but had no consensus
10:42:19 <rigo> q+
10:42:24 <adrianba> q-
10:42:37 <bryan> sean: the impression of some members is different coming out of Santa Clara
10:42:50 <schunter> q+ testinghasdja
10:42:50 <tl> -q
10:42:56 <schunter> q- testinghasdja
10:43:08 <schunter> ack JC
10:43:39 <ShaneW> JC - we've already built-in that capability into DNT via Site-Specific Exceptions
10:43:41 <mischat> mischat has joined #dnt
10:43:50 <schunter> q?
10:43:51 <dsinger> …wants to confirm that the W3C would only publish the FORMAT spec., not an actual list, right?
10:43:58 <jmayer> WileyS - would you support the proposal if renamed "Security Selection Lists"?
10:44:00 <bryan> JC: consumers must be able to say who they trust and not, and some way for parties that can be trusted to be conveyed. it should not be an ad blocker, but allow users to manage trust.
10:44:01 <schunter> ack zaneis
10:44:06 <npdoty> from the minutes last time: "Aleecia: we have a disagreement in the room. split in half. we will continue to discuss this"
10:44:12 <npdoty> http://www.w3.org/2011/11/01-dnt-minutes.html#item03
10:45:17 <bryan> zaneis: if this was primarily an ad blocking tool, it would be problematic. there are certainly legitimate concerns and challenges. content being blocked just because its from a different domain is something users don't understand.
10:45:37 <bryan> ... if we move forward, we should split this from DNT as they don't work together well
10:45:45 <fielding> Actual member survey results "https://www.w3.org/2002/09/wbs/33280/privacy/results" demonstrate that only 12 members responded, most of whom are not here.
10:45:52 <tl> +q
10:45:55 <schunter> q?
10:45:55 <npdoty> s/be problematic/be less problematic/
10:45:56 <ShaneW> JMayer - It would still be difficult to support due to true use not being security specific but at least that draws optics closer to the intention I feel is defendable (security is important - but unfortunately the real outcome here is exactly NOT that)
10:46:08 <bryan> ... most TPLs are for ad blocking and mostly whitelists. we should put out two standards that work together 
10:46:48 <schunter> ack johnsimpson
10:46:48 <bryan> aleecia: re legality, we need a 1-on-1 session
10:46:48 <npdoty> on the scribing, I think Mike's point was that ad blocking was less problematic than free speech issues, right?
10:47:04 <jmayer> ShaneW - hypothetical, if the text made clear security is the primary purpose, then would you support it?
10:47:06 <schunter> q- tl
10:47:43 <bryan> johnsimpson: this is another tool that empowers users, akin to lists of good things e.g. books that people put out. its not about ads, but about other ways of giving users control
10:48:02 <tl> s/1-on-1/101
10:48:36 <schunter> q?
10:48:40 <bryan> ... the notion that the web is about ads, and content is made possible due to ads. most places I go are not ad supported. so the web is not all about advertising, and we need to get out of that mindset.
10:48:46 <ShaneW> JMayer - again, as this concept has already been tested in real-life and we can see the outcome is chiefly ad blocking, it's difficult to support it at all.  I wish there were a way to focus a result only on security (which I believe in strongly) but this approach doesn't offer that.
10:49:03 <bryan> ... those users that want to use ad-supported sites can do so
10:49:26 <schunter> ack justin
10:49:29 <bryan> aleecia: there are different perspectives being expressed here
10:49:34 <tl> ShaneW, The main use of lists of this sort is Safebrowsing. By far the largest and most-used lists
10:49:47 <tl> .
10:50:31 <bryan> justin: we envision TPL to also send out DNT headers, and blacklisting bottom feeders.
10:50:34 <ShaneW> Site-Specific Exceptions ALREADY cover this need - and do it in a transparent manner.
10:50:41 <schunter> q?
10:51:26 <schunter> ack ksmith
10:51:35 <justin> I've been tasked to supplement my comments by the scribe --- my final point was that I'm not worried about third-parties evading TPLs and DNT signals because I think most of the techniques that have been motted to do that would be illegal/deceptive under existing law
10:51:36 <bryan> ksmith: if we go forward, a minimum is that websites must know if they have content that is blocked, or that their content is being shown without being paid for
10:51:37 <jmayer> justin, could you elaborate a bit on that preference circumvention view?
10:51:43 <schunter> ack vincent_
10:51:51 <ShaneW> The largest IE9 TPL is AdBlocker
10:51:52 <npdoty> I think that's an excellent point (ksmith, notification to a site that some resources were blocked), we could add that to this draft
10:52:01 <andyzei> Shane: that is factually not true
10:52:05 <bryan> vincent: couldn't we use this also to block 1st parties?
10:52:09 <justin> Sure, if a third party were to try to mask itself as a first-party domain, I think that would be a deceptive practice in violation of Section 5
10:52:09 <bryan> aleecia: yes
10:52:09 <ShaneW> tl -> the largest IE9 TPL is AdBlocker
10:52:10 <npdoty> s/Shane:/Shane,/
10:52:12 <johnsimpson> + 1 to knowing that you as a site have been blocked.
10:52:46 <andyzei> shane: the largest IE9 TPL is the EasyPrivacy list
10:52:47 <ShaneW> Andy - could you point to a public document from MSFT stating TPL marketshare?
10:52:54 <bryan> rigo: the lists are dual-use tools. you can use them for ad blocking, but the ad blockers don't need W3C. the use of TSL is not in our hands for that.
10:53:00 <tl> ShaneW, but IE9 TPLs aren't the largest set of lists of this type. Google's Safebrowsing list is far larger than any IE9 TPL.
10:53:03 <npdoty> s/shane:/shane,/
10:53:11 <andyzei> Shane: The easylist guys have published some stats you can take a look at.
10:53:11 <bryan> ... wrong use of a tool is not the tools fault
10:53:30 <ShaneW> Please post here so we can review.
10:53:43 <bryan> ... if i have different browsers how do I manage preferences among them and across devices etc
10:53:49 <tl> dsinger, No: we're talking about defining the *format* for lists.
10:53:54 <fielding> http://www.ghacks.net/2011/02/16/internet-explorer-tracking-protection-lists-check-before-installing/
10:53:56 <justin> jmayer, it's a tougher argument to say that shuffling domains is deceptive, but I don't think that's scalable for ad serving companies
10:54:01 <andyzei> npdoty, sorry -- thanks
10:54:20 <bryan> ... can we live with this dual use tool and preserve interoperability with DNT?
10:54:30 <jmayer> Ok, thanks justin.
10:54:35 <bryan> ... transparency is also important, but it is a useful tool
10:54:53 <bryan> aleecia: a lot of interest in this topic - a quick show of hands?
10:55:20 <bryan> ... appx 12 people out of ~34 wg and experts - 1/3 of the group
10:55:53 <bryan> ... there is at least enough interest to do the work, which answers an open question
10:56:09 <jmayer> My lab's research on TSLs in the wild: http://cyberlaw.stanford.edu/node/6730
10:56:38 <bryan> ... at this point, what can we live with? why do we do? I suggest to break off a small group, and work on something concrete that can be discussed
10:57:18 <bryan> ... straw poll: who thinks we should not work on this, and want to block the work? 6 people, plus probably some tired of the discussion
10:57:25 <npdoty> half a dozen people that don't want us to create a sub-group for it (or continue at all)
10:57:58 <bryan> ... at this point I think we should have a small group go off and work on it
10:58:06 <bryan> ... anything new to discuss?
10:59:09 <bryan> jmayer: possibly expanding the scope... downloading TSL is not the only way. various forms of sync/async determination of what you can trust on the web can be considered
10:59:43 <npdoty> speaker is Hannes Tschofenig, an observer from Nokia and IETF
11:00:03 <bryan> Hannes Tschofenig: also include methods for spam blocking, trusted provisioning protocols
11:00:10 <bryan> thx
11:00:16 <johnsimpson> johnsimpson has left #DNT
11:00:17 <bryan> lunch
11:00:47 <npdoty> thanks for scribing, bryan!
11:50:51 <dan> dan has joined #dnt
11:51:51 <amyc> amyc has joined #dnt
12:24:35 <jimk> jimk has joined #dnt
12:24:49 <hwest> hwest has joined #dnt
12:25:17 <Chapell> Chapell has joined #dnt
12:27:31 <aleecia> aleecia has joined #dnt
12:27:45 <tedleung> tedleung has joined #dnt
12:28:28 <dsinger> dsinger has joined #dnt
12:29:31 <ninjamarnau> ninjamarnau has joined #dnt
12:30:32 <KevinT> KevinT has joined #dnt
12:31:10 <rvaneijk> rvaneijk has joined #dnt
12:32:27 <efelten> efelten has joined #dnt
12:32:31 <tl> tl has joined #dnt
12:32:34 <rvaneijk> rvaneijk has joined #dnt
12:32:35 <jeffchester2> jeffchester2 has joined #dnt
12:32:38 <npdoty> npdoty has joined #dnt
12:32:53 <npdoty> http://www.w3.org/community/dntrack/2012/01/14/community-group-comments-on-w3c-dnt/
12:33:02 <rvaneijk> John: community group comments on W3C DNT
12:33:07 <tl> http://www.w3.org/community/dntrack/2012/01/14/community-group-comments-on-w3c-dnt/
12:33:13 <npdoty> scribenick: rvaneijk
12:33:21 <meme> meme has joined #dnt
12:33:21 <schunter> schunter has joined #dnt
12:33:28 <rvaneijk> scribenick: Alan
12:33:48 <rvaneijk> documents has not kept up with reality, is an ongoing proces
12:33:54 <Chapell> John: doc is designed as a broad based group
12:33:59 <rvaneijk> includes various contibuting organizations
12:34:03 <npdoty> scribenick: Chapell
12:34:09 <jmayer> jmayer has joined #dnt
12:34:11 <rvaneijk> Lie TIen was co-editor
12:34:12 <Chapell> EFF, CDT and other orgs
12:34:17 <alex_> alex_ has joined #dnt
12:34:19 <Joanne> Joanne has joined #DNT
12:34:20 <Chapell> PRC and WPF
12:34:48 <rvaneijk> started to react op first working drafts
12:34:55 <Chapell> The doc is considered a draft - they started to react to the first published working drafts - which evolved while they were being commented on
12:34:57 <fielding> fielding has joined #dnt
12:35:14 <rvaneijk> identifies issues on the mailing list editors felt need to comment about
12:35:33 <Chapell> The form of the document -- high level bullets, general comments and open issues and issues for further consideration
12:35:59 <Chapell> They assumed their comments would evolve over time as the WG lanugage becomes clearer
12:36:01 <rvaneijk> When LC paper comes out, editors will be more specific as documents become more and more clear
12:36:25 <npdoty> npdoty has left #dnt
12:36:28 <fielding> Is the community group discussing this somewhere other than the mailing lists? http://lists.w3.org/Archives/Public/public-dntrack-contrib/
12:36:29 <npdoty> npdoty has joined #dnt
12:36:32 <karl> karl has joined #dnt
12:36:40 <vincent_> vincent_ has joined #dnt
12:36:40 <Chapell> The idea is that the WG would reach consensus, and their doc would provide a consensus statement in favor or (or opposing) the WG statement
12:36:43 <bryan> bryan has joined #dnt
12:37:14 <mgroman> mgroman has joined #DNT
12:37:28 <Chapell> The current practices should not necessarily be enshrined - status quo is not normative
12:37:51 <Chapell> they believe meeting user expections should be driving this - 
12:38:05 <rvaneijk> 1st party 3rd party paradigm as a way to approach the problem at hand
12:38:07 <WileyS> WileyS has joined #dnt
12:39:13 <Chapell> Tracking Pref doc - page 3 -- we think that the document is written from the industry point of view and believe that is a mistake
12:39:49 <Chapell> it is important to acknolwedge the rights of consumers to privacy - the point of the process is to enhance users ability to express their preferences when it comes to privacy
12:39:52 <schunter> q?
12:39:58 <schunter> ack rigo
12:40:06 <JC> JC has joined #DNT
12:40:15 <rvaneijk> ... include the notion not everything on the web is commercially driven
12:40:25 <justin> justin has joined #dnt
12:40:36 <Chapell> A successful DNT mechanism should be able to send a message to all sites that the user doesn't want to be tracked
12:41:08 <tlr> tlr has joined #dnt
12:41:50 <Chapell> Issue 8 - page 7 -- first and 3rd party definitions from Tom and Jonathan make sense and could provide a basis for solid consensus
12:42:34 <Chapell> they offered a definition of tracking that is different from the W3C doc
12:43:24 <rvaneijk> ... the approach is to get comments on the document
12:43:38 <fwagner> fwagner has joined #dnt
12:43:39 <rvaneijk> Jeffrey: try to reach out
12:43:44 <rigo> rigo has joined #dnt
12:43:53 <Chapell> Jeff Chester - they tried to get multiple perspectives internationally
12:43:56 <rigo> rigo has joined #dnt
12:43:57 <rvaneijk> ... to give consumers internationally a voice
12:44:15 <Chapell> .... want to align consumer ngo's on these issues
12:44:23 <rvaneijk> jchester: align consumer organizations globaly is a goal of this effort
12:45:04 <Chapell> Aleecia: we will evaluate the comments, see where they make sense
12:45:08 <rvaneijk> aleecia: TPWG will go through comments and determines to respond or not
12:45:19 <fwagner> fwagner has joined #dnt
12:45:22 <Chapell> .... we will see many different perspecitives come into play
12:45:29 <rvaneijk> ... there will be many different perspectives to come into play.
12:46:03 <Chapell> Aleecia: what are the three main issues of concern?
12:46:23 <Chapell> Jeff: 1. User expectations - 
12:47:06 <Chapell> John: 2. Philosphical idea - the rationale for doing all of this should be in the intro of the compliance document - and wherever it goes, it should have 
12:47:18 <Chapell> ...... a substantial recognition of the importance of privacy rights
12:47:24 <rvaneijk> john: current documents reflects privacy right not enough
12:47:31 <Chapell> .... should reference article 19
12:47:35 <rvaneijk> ... referents to art 19 , declaration of rights etc.
12:47:35 <jmayer> To clarify, John is reacting to the current introduction of the TPE document.
12:47:57 <Chapell> ..... 3. the definitions of first and third parties -- they are in favor of the language they suggested
12:48:38 <rvaneijk> aleecia: nick will do live editing
12:48:54 <Chapell> Aleecia: taking us to way back machine - how did we get here?
12:48:54 <johnsimpson> johnsimpson has joined #DNT
12:49:16 <Chapell> ... in Santa Clara, 1st and 3rd party was discussed
12:49:30 <rvaneijk> ... flowchart of 1st/3rd party path 
12:49:40 <meme> meme has joined #dnt
12:49:45 <Chapell> ,,,, anything under EXAMPLE.com is a party
12:50:36 <Chapell> .... if you're a website and have other domains, you could spell out those domains - not thoroughly discussed
12:50:37 <dsinger> s/,,,,/.../
12:50:47 <rvaneijk> ... analytics issue not been discussed in detail
12:51:10 <rvaneijk> ... other route is base don interaction of a user
12:51:14 <Chapell> .... base this upon user expectations driving the interaction
12:51:41 <rvaneijk> ... depends on whether a party knows it is a 1st or 3rd party
12:51:42 <Chapell> ... our approach depends upon whether or not a first party knows they are a first party
12:51:56 <rvaneijk> ... Q: what is a 1st or 3rd party
12:52:19 <Chapell> ... two paths 1. jonathan & Tom's - branding plus approach -- but it is testable, and too costly
12:52:24 <WileyS> +q
12:52:44 <Chapell> .... 2. affiliate model - is the cost too high?
12:52:57 <Chapell> .... also, some discussion on email threads about cross-site tracking
12:53:03 <npdoty> s/cost too high?/cost too high for users to figure out what counts as a first party?/
12:53:32 <schunter> q?
12:53:34 <rvaneijk> ... if we do not come to a good definition of 1st 3rd parties, we wil go a different route
12:53:48 <sean> sean has joined #dnt
12:54:08 <Chapell> Justin: conflating "party" determination with determination of 1st vs 3rd party
12:54:56 <npdoty> ack WileyS
12:55:15 <Chapell> Shayne: there are merits to the cross-site and 1st / 3rd party - and both may get us to the same place
12:55:18 <rigo> q+
12:55:19 <rvaneijk> WIleyS: proposed a more hybrid solutin
12:55:39 <jmayer> +q
12:55:42 <rvaneijk> ... list concept
12:55:52 <npdoty> s/Shayne/WileyS/
12:55:54 <rvaneijk> ... well known location (URL)
12:56:11 <karl> q+
12:56:29 <dsinger> q+
12:56:36 <JC> +q
12:56:59 <rvaneijk> WileyS: to give transparency on who will be part of the 1st party group
12:57:01 <karl> q+ to ask "what is a list and how long the list will be? How many times it would be downloaded? etc. It looks like the white list TPL :D"
12:57:18 <Chapell> .... WileyS - wants to get us out of the more subjective measures
12:57:34 <rvaneijk> ... if you are not on that list, you are a 3rd party
12:57:39 <dsinger> thinks that an easier and maybe better solution for 'are sites X and Y the same party' is to have well-known URLs at X and Y that redirect to the 'owner
12:57:42 <schunter> q?
12:57:52 <jmayer> A means of communicating party status is independent of how we determine party status.
12:58:14 <Chapell> Aleecia: questions / concerns with sec 3/2 (?)
12:58:22 <jmayer> No need to link this to a corporate affiliation test.
12:58:25 <Chapell> .... trying to define who a party is
12:58:41 <efelten> q+
12:58:41 <npdoty> http://www.w3.org/P3P/2004/03-domain-relationships.html#Proposed
12:58:43 <fielding> q+
12:58:58 <Chapell> DSinger: still things we're conflating "party" with 1st vs 3rd party determinations
12:59:00 <schunter> q?
12:59:00 <rvaneijk> dsinger: we are discussing what is a party
12:59:08 <schunter> q?
12:59:15 <rvaneijk> aleecia: we are discussiong 3.2.1 defs
12:59:36 <Chapell> Aleecia: Corporate ownership constributes to, but is not determinative
12:59:41 <schunter> q?
12:59:47 <bryan> q+
12:59:55 <schunter> ack rigo
12:59:58 <rvaneijk> ... A "party" is any commercial, nonprofit, or governmental organization, a subsidiary or unit of such an organization, or a person, that an ordinary user would perceive to be a discrete entity for purposes of information collection and sharing. Domain names, branding, and corporate ownership may contribute to, but are not necessarily determinative of, user perceptions of whether two parties...
13:00:00 <rvaneijk> ...are distinct. 
13:00:05 <schunter> Zakim, Issue-117?
13:00:05 <Zakim> I don't understand your question, schunter.
13:00:27 <dsinger> issue-117?
13:00:27 <trackbot> ISSUE-117 -- Terms: tracking v. cross-site tracking -- raised
13:00:27 <trackbot> http://www.w3.org/2011/tracking-protection/track/issues/117
13:00:38 <Chapell> Rigo: Meta argument - should documents agree?
13:00:49 <Chapell> Aleecia: Yes - docs will agree
13:01:07 <rvaneijk> aleecia: tracking def immediately after def parties
13:01:41 <schunter> q?
13:01:44 <rvaneijk> rigo: entity is a well know def in legal which we could re-use
13:01:47 <Mzaneis> Mzaneis has joined #dnt
13:01:50 <dsinger> q+ to ask for some clean 'can be' and 'can't be' tests
13:01:55 <npdoty> rigo, can you provide citations of the well-settled legal definition?
13:02:02 <schunter> ack jmayer
13:02:30 <rvaneijk> jmayer: agrees with shane
13:02:49 <Chapell> JMayer: @SWiley - its a nice idea to have some list based, but this is independent of how we define parties
13:02:51 <rvaneijk> ... nice way to define what is within a 1st party.
13:03:18 <tl> s/\@SWiley/\@WileyS
13:03:43 <WileyS> JMayer - agree they are different as my proposal was meant to support more the Affiliate concept - but now in a very easily discoverable manner
13:03:46 <rvaneijk> ... a lot of the concern about the party def is that it is not predictable enough.
13:03:52 <Chapell> ... @rigo - disagrees that the idea that entity definitions are clear in multiple jurisdictions
13:04:09 <Chapell> ... brite line rule re: party  
13:04:28 <npdoty> s/brite/bright/
13:05:03 <rvaneijk> ... negating of all of the possible tetst. if no corp affiliation no shared name no common branding then forget talking about user expectations
13:05:04 <Chapell> .... 1. test - if its not commonly branded, NO shared ownership,  then this is not part of the same party and consumer exp sn't considered heavily
13:05:09 <dsinger> would add 'no shared liability for privacy violations', maybe?
13:05:19 <WileyS> Actually agree with Jonathan on this point - a multi-test minimum standard feels right - but still feel a list should accompany this to make the outcome objective
13:05:29 <schunter> q?
13:06:17 <mischat_> mischat_ has joined #dnt
13:06:18 <Chapell> Aleecia: what is one party
13:06:27 <rigo> BTW, Wikipedia (as allways) has the most comprehensive definitions of person/party/entity
13:06:34 <jmayer> Didn't mention - we can also use tools like safe harbors here.
13:06:34 <dsinger> wonders if some aspects of privacy policy need to be in common for two sites to be considered one party?
13:07:35 <schunter> q?
13:07:45 <schunter> q?
13:07:57 <jmayer> E.g. if there's common branding, we'll give a rebuttable presumption of same party.
13:08:47 <Chapell> Rigo: BCR in the EU
13:08:48 <rvaneijk> please add your point to irc :)
13:09:01 <npdoty> BCR, "binding corporate rules"
13:10:10 <schunter> q?
13:10:18 <Chapell> Rigo: should we use the term 'affiliation' in our definition?
13:10:31 <rigo> q?
13:11:15 <Chapell> Aleecia: two companies - diff domain names, are they the same party?
13:11:26 <rigo> AM: shared domain names. foo.com and bar.com can be the same entity
13:11:26 <Chapell> WileyS (and others) YES!
13:11:48 <schunter> q?
13:12:04 <rigo> Brian: how is it useful in terms of compliance
13:12:05 <rvaneijk> bryan: usefulness in terms of compliance?
13:12:13 <schunter> q?
13:12:17 <Chapell> Roy: I thought we were talking about the spec, where are we going?
13:12:19 <rigo> Roy: we are talking on spec, where is this going
13:12:36 <rvaneijk> fielding: relevance of definition?
13:12:46 <rvaneijk> aleecia: user expectations not conrete enough
13:12:54 <bryan> it may be a valid test, but how is it useful in compliance? can it be tested in real time in some way?
13:13:08 <rvaneijk> fielding: focus que on def of parties 3.2.1
13:13:10 <jmayer> s/consumer exp sn't considered heavily/and can't foresee consumers expecting otherwise; 2. test - if not corporate affiliation/
13:13:20 <rvaneijk> ... the user is a party
13:13:24 <schunter> q?
13:13:38 <chesterj2> chesterj2 has joined #dnt
13:13:39 <tl> q?
13:13:39 <npdoty> ack karl
13:13:41 <Zakim> karl, you wanted to ask "what is a list and how long the list will be? How many times it would be downloaded? etc. It looks like the white list TPL :D"
13:13:48 <rigo> user expectatiion is not testable at all, so this is a red flag for me
13:13:50 <Chapell> Karl: User expectation is not testable and will not be able to have an easy implimentation
13:13:58 <rvaneijk> karl: user expectation is not testable.this is a pitfall
13:13:59 <fielding> Each legal entity engaging in communication on the Web is a "party". In some cases, two parties might be treated as one party if it is acting as an agent of the other.
13:14:07 <WileyS> Karl +1
13:14:08 <fielding> The user is the second party.
13:14:15 <jmayer> How are user expectations not testable?  In the rare cases that aren't close, can survey.
13:14:22 <jmayer> *are
13:14:26 <rigo> roy, there are no second parties
13:14:30 <rigo> only first and third
13:14:31 <rvaneijk> karl: shane's list resembles the TPL (joke)
13:14:40 <dsinger> the user IS the 2nd party, aren't they?
13:14:41 <rigo> second party is mainly your wife :)
13:14:45 <schunter> q?
13:14:46 <WileyS> Karl - but defined by the first party - not an AdBlocker!
13:14:54 <WileyS> Rigo - LOL
13:14:55 <rvaneijk> ... if there is no way to describe user expectations, we will hit a wall at some time
13:15:06 <chesterj2> +q
13:15:15 <johnsimpson> I understand the user o be the second party
13:15:16 <Chapell> Karl: Y! Japa is diff entity than Y! U.S,
13:15:46 <schunter> q?
13:15:49 <schunter> ack dsinger
13:15:49 <Zakim> dsinger, you wanted to ask for some clean 'can be' and 'can't be' tests
13:16:14 <jimk> Can I be in the queue, not sure of protocol - Jim Killock
13:16:14 <Chapell> Dsinger: wants a bright line test re: single party to deal with 95% of the cases
13:16:21 <npdoty> q+ jimk
13:16:29 <justin> +1 to David
13:16:33 <WileyS> Y!US owns a minority share of Y!J and has BCRs in place - hence "same party" in some senses from a Legal perspective
13:16:35 <jimk> :npdoty thanks
13:16:39 <Chapell> Dsinger: we can deal with vast majority of use cases with a brite line test
13:16:42 <rigo> +1 to David
13:17:02 <rvaneijk> dsinger: Q: do we need aspects in privacy policy in place to be included in 1st party?
13:17:04 <Chapell> .... Do we need some aspects of their privacy policy to be in common to be considered a single party?
13:17:20 <tl> +1 David
13:17:29 <rigo> DS: part of privacy policies are very different, than they can't possibly be one single party
13:17:43 <schunter> q?
13:17:44 <fielding> the domain discussion is not relevant to the definition of party -- it is relevant to the definition of first and third party
13:17:46 <schunter> ack JC
13:17:53 <karl> jmayer - re:user expectation - not testable in a way, that they will not lead to the same answers depending on the users. It is not an objective critera 
13:17:59 <fielding> q- since I jumped the q
13:18:04 <fielding> q-
13:18:04 <Chapell> JC: doesn't want people to feel that a list is sufficient outside of the rules
13:18:06 <rvaneijk> JC: the list isn't sufficient outside of the rules
13:18:08 <efelten> q-
13:18:23 <schunter> q>
13:18:27 <ksmith> ksmith has joined #dnt
13:18:28 <bryan> I believe that definitions based upon what a "ordinary user would perceive", are not testable. However a semantic affilation discovery method would be helpful and may resolve the dependence upon user expectation (e.g. similar to the objective of Web Intents?). Re JMayer's list of test criteria: it may be a valid test, but how are those things useful in compliance testing? Can they be tested in realtime, or will such a test only be done in an audit process or in th
13:18:29 <Chapell> .... msft has sites go up and down every day and its a process to get sites on and off any list
13:18:29 <schunter> ack bryon
13:18:33 <rvaneijk> ... eg list can be very fluent and it takes days to have it up to date
13:18:34 <schunter> ack bryan
13:18:35 <jmayer> karl, it is not deterministic, sure.  Why does that matter?
13:18:39 <andyzei> andyzei has joined #dnt
13:18:48 <ksmith> q+
13:18:58 <adrianba> adrianba has joined #dnt
13:19:08 <Chapell> bryan: a method of semantically discovering affiliation could be helpful, but the list of test criteria is going to be a red flag
13:19:16 <schunter> q?
13:19:21 <rvaneijk> bryan: how can the list be used in a realtime way?
13:19:22 <Chapell> ... in order to work in the web, we'll need to rely upon an audit process
13:19:33 <adrianba> rrsagent, pointer
13:19:33 <RRSAgent> See http://www.w3.org/2012/01/24-dnt-irc#T13-19-33
13:19:45 <Chapell> ... how will a test be actionable without some third party to enforce?
13:19:49 <WileyS> JC - I hope MSFT has a few days heads-up before you buy, sell, or close a company :-)  Just kidding - we'd have to have some fair "lag time" built in so lists are up-to-date.
13:19:54 <rvaneijk> aleecia: policy based versus technically enforced approach
13:19:57 <karl> jmayer - because to implement you need a deterministic criteria in order to decide what message you send back. In Normandy, we say Maybe yes, maybe not :)
13:20:19 <bryan> If we are to use parties in any way in DNT, we need a technical means to determine affiliation that is usable for browsers and servers.
13:20:28 <rvaneijk> jchester: focus on user expectation
13:20:33 <JC> Which user?
13:20:34 <Chapell> chesterj: we need to focus on user expectations - happy to discuss how one tests this
13:20:37 <schunter> q?
13:20:40 <npdoty> fielding, I surely think it (criteria of domains, legal affiliations, branding) is relevant to the definition of what a single party is and it'll be most relevant when we get to the 1st/3rd party discussions
13:20:47 <schunter> ack chesterj
13:21:07 <jmayer> karl, The user agent responds based on the server's assertion.  If the server gets it wrong, it will face liability.
13:21:08 <Chapell> ... it is impractical for a user to know what the rules are
13:21:36 <WileyS> Scribe - please be sure to capture the "difficult for a user to know where they are on the Internet" comment
13:21:42 <schunter> q?
13:21:44 <Chapell> ... to lose user expectations would place users in a difficult situation and limit the effectiveness of dnt
13:22:06 <Mzaneis> I think Jonathan has proposed a smart, valid approach. How do you technically implement?
13:22:13 <Chapell> ... they can show how websites are structured to process user expectations and uses have know knowledge of those techniques
13:22:26 <rvaneijk> chesterj: could show that users have no knowledge of underlying structure of a site
13:22:35 <johnsimpson> +q
13:22:37 <fielding> npdoty, domains have nothing to do with legal affiliation … if we were talking about a definition of what a service is, then yes, but we can't define "party" in a way that assumes the user is not one of the parties.
13:22:43 <karl> jmayer, so far we have defined the behavior of the server with regards to the user agent, but not the user agent response/behavior with regards to that.
13:22:45 <schunter> ack jimk
13:22:51 <schunter> q?
13:23:00 <jmayer> karl, ok, failing to see the issue there...
13:23:05 <Chapell> jeremy: distinction between 1st and 3rd parties gives lots of leeway to first parties to look at user info
13:23:12 <amyc> amyc has joined #dnt
13:23:23 <Chapell> Jeremy = jim killock
13:23:27 <rvaneijk> jimk: 1st parties collecting and profiling is already beyound user expectations
13:23:35 <karl> jmayer, the user is powerless.
13:23:38 <npdoty> s/jeremy:/jimk:/
13:23:57 <Chapell> jimk: 1st party profiling is more intrusive than most users would expect
13:24:19 <rvaneijk> aleecia: we are still figuring out who parties are
13:24:20 <WileyS> Jim - are you suggesting that TOS agreement equals first party?
13:24:52 <schunter> q?
13:24:56 <Chapell> jimk: user expectation must be related to a narrow definition of 1st party - if we broaden the definition of 1st party, then we should limit what that party may do
13:24:59 <schunter> ack ksmith
13:25:00 <rvaneijk> jimk: user expecttions should be bound to a def of party. so scope on what parties may or may not do
13:25:36 <rvaneijk> ksmith: user experience use case
13:25:51 <rvaneijk> ... Yahoo - flickr
13:26:01 <Chapell> ksmith: I don't know Y! and flicker are the same party
13:26:15 <Chapell> ksmith: I know about Google and YouTube
13:26:33 <Chapell> .... supports a list of methods to approximate user expectations
13:26:35 <rvaneijk> ... supports proposal of jmayer: approx ways to meet user expectations
13:26:37 <rigo> q?
13:26:41 <rigo> q+
13:26:48 <fielding> http://www.businessdictionary.com/definition/party.html
13:27:03 <rvaneijk> ksmith: 1. how you define parties and 2. how do you convey that message
13:27:24 <tl> +q
13:27:32 <dsinger> q+
13:27:33 <Chapell> ksmith: rather than create a list of related parties, (maintenance nightmare) he wants to have a group ID or entity ID (e.g., Disney)
13:27:55 <rvaneijk> ksmith: instead of list of domain names, but an intity ID eg. Disney with well known URL
13:28:20 <johnsimpson> can we please respect the Q????????
13:28:21 <schunter> q?
13:28:29 <rvaneijk> WileyS: is testable, 1 time per domain
13:28:37 <dsinger> q-
13:28:50 <rvaneijk> WIleyS: list is methaphorically
13:29:19 <Chapell> Aleecia: User goes to website which is part of 50 sites owned by umbrella entity
13:29:26 <rigo> DS: have a redirect that redirects to the mother corporation, technically easy and sound..
13:29:39 <rvaneijk> Aleecia: undestanding of where the dataflows are
13:29:44 <Chapell> .... what is my user interaction so that the user understands the ownership and data flows between parties
13:30:06 <Chapell> .... having trouble seeing how this can work for users in real life
13:30:06 <dsinger> a simple idea is 'For two sites to be considered the same party, they must maintain a redirection from the well-known URL at their site /X, to the same URL of their 'master' site'
13:30:22 <schunter> q?
13:30:23 <rvaneijk> ksmith: is user interface related
13:30:34 <Chapell> ksmith: has to some way to convey information -- see this as a UI issue
13:30:35 <rvaneijk> ... we have to define it and relay is.
13:30:43 <bryan> We need to avoid creating a lot of additional traffic to taste a site to test if its affiliated with someone. These things do change, and the data can be lost in many ways. So I would not be in favor of a metadata on a site, unless that data is embedded in the HTML of the site (no additional request).
13:30:49 <karl> https://en.wikipedia.org/wiki/List_of_acquisitions_by_Google
13:30:49 <Chapell> Aleecia: is this an argument for user expectations
13:30:50 <schunter> q?
13:31:17 <karl> https://en.wikipedia.org/wiki/List_of_acquisitions_by_Yahoo#Acquisitions
13:31:26 <Chapell> dsinger: for two sites to be considered as part of the same first party, they need to make some kind of redirect link to the same larger entity.
13:31:34 <ninjamarnau> q+
13:31:37 <karl> https://en.wikipedia.org/wiki/List_of_acquisitions_by_Microsoft
13:31:50 <dsinger> …as ONE of the conditions to be considered a single party
13:31:54 <Chapell> ksmith: Y! can't meet his expectations -- expectations are based upon experience
13:32:00 <schunter> q+
13:32:29 <karl> these are just list of acquisitions not even services and they are already big  50 to >200
13:32:34 <Chapell> .... there has to be a way for a user to discover the connection between two (otherwise) seemingly disperate parties (e.g., Y and Flicker)
13:32:36 <schunter> q?
13:32:45 <schunter> ack johnsimpson
13:32:52 <rvaneijk> johnsimpson: focus is on marginal cases
13:33:09 <rvaneijk> johnsimpson: usually an entity knows how it is behaving
13:33:15 <Chapell> johnsimpson: 98% of the situations are covered by our definitions abnd we may be spending too much time on edge cases
13:33:26 <rvaneijk> johnsimpson: when in doubt, take it out..
13:33:31 <WileyS> John - I don't think we're arguing that point
13:33:45 <Chapell> ... if you as as site don't know which party you are, then that website should be honorable 
13:33:54 <schunter> q?
13:34:00 <Chapell> .... and err on the site of being a 3rd party
13:34:06 <schunter> ack rigo
13:34:15 <rvaneijk> rigo: we dicussing from the wrong angle
13:34:26 <Mzaneis> Mzaneis has joined #dnt
13:34:38 <rvaneijk> ... if you are in the 1st of 3rd party. THe adressee is the contentprovider.
13:34:58 <rvaneijk> ... what we invent here is a recipe for a site to classify themselves
13:35:12 <rvaneijk> ... user expectation it the wrong angle.
13:35:13 <meme> The party itself knows whether or not its part of another company, its the user that doesn't know
13:35:20 <schunter> q?
13:35:22 <Chapell> Rigo: we are addressing our text to the sites. and if you discuss under this angle (rather than user expectation)
13:35:44 <Chapell> ... this gets pretty simple. Advocates the idea of a list of tests 
13:35:47 <Mzaneis> +q
13:35:58 <schunter> q?
13:35:59 <rvaneijk> ... expression exchange protocol
13:36:02 <schunter> ack tl
13:36:25 <fielding> A party, for the purpose of Tracking Protection, is an entity that takes part in (sends or receives) a sequence of requests related to accessing a service on the Web.
13:36:34 <rvaneijk> tl: 1. hard to know for a corp to knwo where edges are
13:36:36 <Chapell> Schunter: been some suggestions for a coproration to manage its knowledge of its own edge cases.
13:37:16 <WileyS> Tom - who defines "typical"?
13:37:21 <rvaneijk> tl: 2 start with reasonable person approach
13:37:26 <Chapell> TL: wants a reasonable user standard
13:37:38 <schunter> my point was: If two entities cannot tell whether they are part of the same party, they should assume that they are not.
13:37:41 <justin> fielding, so entity = anyone within corporate family?
13:38:00 <Chapell> ... if the affiliation of the site isn't obvious to a User, its unreasonable to expect that the browser will be in the position to do so
13:38:03 <schunter> q?
13:38:08 <rigo> Matthias, this would be one more of the criteria, David is suggesting for consideration
13:38:14 <Chapell> .... sites should have communication strategies to ensure clear linkage
13:38:20 <schunter> ack ninjamarnau
13:38:24 <fielding> entity = legal entity (person, company, org)
13:38:28 <johnsimpson> User expectations can -- and should -- change over time.  If enough people don't 
13:38:38 <rvaneijk> ninjamarnau: web today is a few mayor players
13:38:41 <schunter> yes. It is an anti-criterium: If you cannot tell, then consider yourself separate.
13:38:48 <Chapell> nijamarnau: a few major players have thosands of sites - most users can't keep track
13:38:50 <rvaneijk> ... hard to keep up what services belong to which party
13:38:56 <johnsimpson> ... excpet what the site wants, then it's time for a brading campaign
13:38:57 <Chapell> ... this suppoorts a small party distinction
13:39:00 <tl> WileyS, As with the legal standards based on a "reasonable person"...?
13:39:06 <johnsimpson> meant accept
13:39:13 <rvaneijk> ninjamarnau: consent of users might be cosly for a UI
13:39:15 <WileyS> +q
13:39:19 <tlr> s/except what/accept what/
13:39:20 <schunter> q?
13:39:22 <Chapell> ..... it may be costly for bigger companies, but its not possible for the user to understand who is sharing data with whom
13:39:41 <rvaneijk> schunter: 1. user expectations: do not take it too narrowly
13:39:46 <tl> s/"1. hard to know for a corp to knwo where edges are"/"1. If its hard to know for a corp to know where *its* edges are, just think how hard it would be for users!"
13:40:05 <Chapell> Mattias: If User thinks that two sites are related but they don't share data, that's not a big problem
13:40:20 <justin> fielding, I think that's too naive. What if one FB shell company owns facebook.com and another owns cdn.fb.com --- user expectations (however we define) would deem them one party, but the precise corporate entity test wouldn't allow.
13:40:26 <adrianba> q+
13:40:27 <schunter> q?
13:40:29 <Chapell> ... so, we need to err on the safe side
13:40:34 <schunter> ack schunter
13:40:37 <ksmith> q+
13:40:37 <tlr> ack schunter
13:40:42 <npdoty> ack Mzaneis
13:40:42 <rvaneijk> @schunter please put pointin irc
13:40:47 <Chapell> MZaneis: supports Jonathan's unity provisions test
13:40:51 <fielding> justin, that isn't relevant to the discussion of "party"
13:41:15 <Chapell> ... many publishers have many, many domains on their network of sites
13:41:25 <tl> tl: 3. I love the verifiability of the upstream/ownership link, and think that there are some great UIs that this can enable. However, I still think that sites should be clearly representing their ownership: if a site itself can't communicate its affiliation to users, why should browsers be able to?
13:41:34 <Chapell> .... concerned with the long tail that will be affected by what we implimented - many of the long tail have multiple domains
13:41:39 <rvaneijk> Mzaneis: has bigger concern. millions of website will be effected when implementing dnt
13:41:40 <fielding> If we want to define "service", I'm all for that.
13:41:44 <justin> fielding, if two closely related corporate entities that are clearly in the users' eyes one party can't share data as one party, that would seem to be relevant, yes?
13:41:57 <tl> +q
13:42:00 <Chapell> ... it is unlikley that long tail will be able to implement these types of solutions
13:42:06 <ninjamarnau> to add to rob's scribing: I support the approach to restrict  the scope of "party". The major players own a large number of services. If they want share data between theses services they can ask for the user's consent
13:42:11 <Chapell> without a major resource outlay
13:42:12 <schunter> q?
13:42:18 <rvaneijk> Mzaneis: if too technical approach risk is that companies will not understand and therefor not implement
13:42:21 <fielding> users don't care about the legal affiliations … they care about the service being used.
13:42:31 <Chapell> Aleecia: If we move to something tech defined, the long tail may find itself impacted
13:42:40 <schunter> ack WileyS
13:42:42 <fielding> two different services owned by one party are just as much an issue
13:43:14 <schunter> q?
13:43:17 <Chapell> TL: Many sites can become compliant with DNT without breaking. doesn't see it as an issue
13:43:20 <jmayer> +q
13:43:50 <rvaneijk> WIleyS: we do want to meet user expectations.
13:43:51 <bryan> "we are all" is perhaps too strong...
13:43:53 <Chapell> Wiley: idealogically, we're on the same page. we do want to meet user expectations, but we need objective tests. 
13:43:56 <amyc> +1
13:44:01 <johnsimpson> use of fickr, yahoo as se case may change user expectations...
13:44:06 <schunter> The goal to meet user expectations should be in the text as a preamble for the tests.
13:44:26 <Chapell> ... likes JMayer's tests - an appropriate test and we can work through the edge cases
13:44:35 <rvaneijk> ... 3 test of jmayer are appropriate, good baseline
13:44:43 <Chapell> .... Agrees that once we get agreement, we need a technical signal
13:44:49 <rvaneijk> ... we need to make it testable.
13:44:50 <schunter> q?
13:44:55 <Chapell> ... tech signal helps us test our compliance with DNT
13:45:09 <Chapell> ... any domain should have a simple place to say where its parent is.
13:45:29 <johnsimpson> +1 Matthias for text in preamble
13:46:01 <schunter> q?
13:46:16 <schunter> q+ jeffc
13:46:21 <fielding> My point is that "party" is not a relevant distinction for tracking protection aside from the normal meaning of the term as a party to the communication. Service (which is probably a better term than site) is a ddistinction that is testable and what the current document refers to as "party".
13:46:34 <rvaneijk> aleecia: EXPERIMENT on the flipover..
13:46:39 <Chapell> Aleeca: if we have two sites with diff names
13:47:03 <Chapell> EXAMPLE.com (skiing site) and SAMPLE.com (cooking site) 
13:47:35 <Chapell> .... can we talk through a user case 
13:47:51 <justin> I would be fine with the "service" model, fielding, but it would prohibit Flickr from being deemed the same party with Yahoo! --- I don't feel strongly, but the co-brand proponents might.
13:47:52 <Chapell> .... use case to determine what it would take for a reasonable user
13:48:14 <Chapell> JC: Branding: some type of graphic, signin
13:48:15 <npdoty> fielding, if you have a testable definition of "service" that matches user expectations and works for corporations' data sharing practices, that would be helpful to us right now
13:49:05 <Chapell> jeffc: different privacy practices
13:49:25 <Chapell> Sharvey: same privacy practices lead towards the same entity
13:49:32 <fielding> justin, yes I would consider them different services owned by the same party, which is why I don't think party is a useful term.
13:50:37 <fielding> And the fun thing is that Y! calls them different "properties"
13:50:49 <npdoty> fielding, if you want to run s/party/service/ in your head for the next 30 minutes, would that work for us? ;)
13:52:14 <Chapell> Aleecia: a user looks at two sites and can see that those two sites are sharing data
13:52:24 <Chapell> ... trying to create the criteria
13:52:30 <justin> fielding, but under your "service" test, Yahoo! could not correlate individual user data from Yahoo.com with that user's interactions on Flickr.com because they're different services, Am I understanding you correctly?
13:52:56 <schunter> q?
13:53:02 <rvaneijk> WIleyS: how to deal with the corporate affiliation. How do you make BCR's visible
13:53:03 <Chapell> WileyS: wants to deal with corporate affiliation in a non-common branded approach
13:53:24 <jchester2> jchester2 has joined #dnt
13:53:47 <rvaneijk> ... common legal terms
13:53:57 <fielding> justin, you understand me correctly, though the specific case of Yahoo! may not exactly match that model because they have user accounts with a shared authentication service.
13:54:06 <justin> right, got it
13:54:13 <jchester2> +q
13:54:36 <Chapell> Dsinger: the user things the sites are distinct, but they are not distinct - sees that as the big issue
13:55:12 <Chapell> smith: sees some kind of obvious synergy or intergration between the sites
13:55:18 <npdoty> dsinger's point is that where ambiguous, it's dangerous for the user to assume they're distinct when they are sharing data
13:55:24 <npdoty> s/smith/ksmith/
13:55:46 <rvaneijk> Mzaneis: common ownership point
13:56:42 <Chapell> Aleecia: factors are: Branding, shared signin (tho it gets complicated in an era of OpenID) 
13:57:12 <rvaneijk> jkillock: login is not a good test.
13:57:13 <dsinger> It doesn't matter if two sites that seem to be the same for branding are in fact distinct and don't share data; it matters hugely if two sites that the user thinks ARE distinct are not, and are sharing data
13:58:00 <rigo> q?
13:58:07 <rvaneijk> aleecia: is single sign on sufficient?
13:58:58 <meme> does anyone disagree with jmayer's test?
14:00:00 <schunter> q?
14:00:01 <WileyS> +1 for JMayer's tests
14:00:08 <karl> "The Web is complex" 
14:00:59 <rvaneijk> troessler: signing is a good place to find out about affiliation
14:01:03 <npdoty> here's my text of jmayer's min bar test: At a minimum, if there's no common corporate affiliation (or binding corporate rules or corporate family), common domain name or shared branding, then those entities are not the same party.
14:01:21 <npdoty> and a suggested addition from dsinger: 
14:01:23 <npdoty> If two sites don't both redirect the well-known URI to the same umbrella company URI, then those entities are not the same party.
14:01:27 <dsinger> thinks it is time for a Small Group to write a draft definition of ' for two or more sites to be considered a single Party, one of the following conditions X must hold and none of the following conditions Y must hold'
14:02:31 <karl> RRSAgent, pointer?
14:02:31 <RRSAgent> See http://www.w3.org/2012/01/24-dnt-irc#T14-02-31
14:02:46 <dan> dan has joined #dnt
14:03:05 <rvaneijk> dsinger: break up in smaller group to write a draft paragraph
14:03:41 <npdoty> +1 for a small group that includes dsinger
14:04:08 <jmayer> -1 on small group, at least without more progress
14:04:10 <Chapell> jchester: each IAB rising stars  have different collection practices and are evolving
14:04:12 <jmayer> no more punting
14:04:24 <WileyS> +1 for separate group that includes JMayer - as I believe he already wrote the appropriate list in real-time at the beginning of this conversation.
14:04:28 <schunter> q?
14:05:31 <justin> as long as we retain the floor for corporate ownership/control for same partiness, I'll defer to the group --- can't be here at lunch tomorrow (dsinger, jmayer, npdoty)
14:05:35 <rvaneijk> aleecia: spent time tonight and meet tomorrow at lunch
14:06:19 <rvaneijk> WIleyS: do we need this seperate group, as there is support for jmayer's approach
14:07:10 <npdoty> "At a minimum, if there's no common corporate affiliation (or binding corporate rules or corporate family), common domain name or shared branding, then those entities are not the same party."
14:08:16 <ninjamarnau> I would like to add David's suggestion on liability and privacy practices
14:08:28 <rvaneijk> dsinger: in essence jmayer's test is a 'faillure test'
14:09:02 <ninjamarnau> okay my comment was the positive test
14:09:46 <karl> then we will go down the hell of definitions of "affiliation", "shared branding", etc. 
14:10:43 <Chapell> Aleecia: Baseline agreement on Jonathan's test
14:10:58 <Chapell> .... this is a fine floor, but there is additional work to do
14:10:59 <bryan> Can we ask that the small group also explain how the test will be used? As a test it may be reasonable, but how is it actionable?
14:11:02 <tlr> Strawpol: Use the following language as a floor as a set of tests:
14:11:10 <rvaneijk> aleecia: current test is a fine floor, but additional work to do
14:11:27 <npdoty> resolution: the quoted text above is a floor of tests that determine what isn't a single party (no objections)
14:11:29 <justin> To reiterate: my floor is corporate affiliation plus one of common domain name or common branding
14:12:58 <rvaneijk> WileyS: microsite example with it's own domainname but clear common branding but without common affiliations => 2 first parties
14:13:24 <npdoty> "Corporate affiliation is necessary but not sufficient for two entities to be a single party."
14:13:41 <Chapell> Aleecia: two parties with no corp affiliation can't be the same party
14:14:29 <rvaneijk> aleecia: half our break
14:14:37 <tlr> s/our/hour/
14:15:20 <npdoty> resolution: "Corporate affiliation is necessary but not sufficient for two entities to be a single party." <no objections>
14:15:24 <adrianba> q-
14:15:28 <WileyS> jmayer - you've always been "that guy"
14:15:31 <WileyS> :-)
14:28:38 <mischat_> mischat_ has joined #dnt
14:29:52 <rbarcelo> rbarcelo has joined #dnt
14:30:15 <rbarcelo> rbarcelo has joined #dnt
14:30:37 <rbarcelo> issue-117?
14:30:37 <trackbot> ISSUE-117 -- Terms: tracking v. cross-site tracking -- raised
14:30:37 <trackbot> http://www.w3.org/2011/tracking-protection/track/issues/117
14:30:51 <rbarcelo> q?
14:30:58 <rbarcelo> q+
14:31:04 <rbarcelo> q-
14:34:13 <rbarcelo_> rbarcelo_ has joined #dnt
14:38:06 <rbarcelo_> rbarcelo_ has joined #dnt
14:41:25 <rbarcelo_> rbarcelo_ has joined #dnt
14:45:06 <rbarcelo_> rbarcelo_ has joined #dnt
14:49:17 <rbarcelo> rbarcelo has joined #dnt
14:50:01 <npdoty> coming back
14:50:25 <npdoty> q?
14:50:52 <dsinger> scribenick: dsinger
14:51:22 <dsinger> aleecia: we start on 3rd party exceptions
14:51:25 <dsinger> issue-49?
14:51:25 <trackbot> ISSUE-49 -- Third party as first party - is a third party that collects data on behalf of the first party treated the same way as the first party? -- open
14:51:25 <trackbot> http://www.w3.org/2011/tracking-protection/track/issues/49
14:51:34 <efelten> efelten has joined #dnt
14:51:38 <Chapell> Chapell has joined #DNT
14:51:38 <dsinger> section 3.6.1.2.2
14:51:56 <npdoty> topic: Exemptions
14:52:09 <dsinger> …could do with some best practices text on point 4, maybe?
14:52:10 <fwagner> fwagner has joined #dnt
14:52:11 <schunter> q?
14:52:14 <schunter> q-
14:52:22 <schunter> q- ksmith
14:52:25 <schunter> q- tl
14:52:26 <alex_> alex_ has joined #dnt
14:52:29 <schunter> q- jmayer
14:52:30 <amyc> amyc has joined #dnt
14:52:31 <schunter> q- jeefc
14:52:33 <Chapell> Aleecia: four tests 
14:52:41 <schunter> q- jeffc, jchester
14:53:05 <npdoty> q?
14:53:09 <dsinger> 3.6.1.2.1 Normative Discussion
14:53:09 <dsinger> A third-party site may operate as a first-party site if all the following conditions hold:
14:53:09 <dsinger> the data collection, retention, and use, complies with at least the requirements for first-parties;
14:53:10 <dsinger> the data collected is available only to the first party, and the third party has no independent right to use the data;
14:53:10 <dsinger> the third party makes commitments to adhere to this standard in a form that is legally enforceable (directly or indirectly) by the first party, individual users, and regulators; data retention by the third party must not survive the end of this legal enforceability;
14:53:13 <dsinger> the third party undertakes reasonable technical precautions to prevent collecting data that could be correlated across first parties.
14:53:18 <dsinger> …any objections?
14:53:22 <Chapell> @npdoty  thank goodness  (:
14:53:49 <dsinger> WileyS: wants to improve point 2
14:54:00 <amyc> q+
14:54:34 <dsinger> jmayer: the way this works, it doesn't 'stack': you cannot take outsourced data and add on another exception
14:54:45 <tl> +q
14:54:57 <sean> sean has joined #dnt
14:54:58 <fielding> q+
14:54:59 <dsinger> WileyS: we allow others to use, contractually, aggregated/anon data for specific, constrained uses and times
14:55:01 <jmayer> +q
14:55:09 <dsinger> (floort) examples?
14:55:10 <tlr> a?
14:55:12 <tlr> q?
14:55:35 <dsinger> Meme: we allow common screen data, number of users on tablets, etc.
14:55:45 <dsinger> …purely aggregate, anonymous
14:55:52 <bryan> q+
14:56:06 <justin> Can we just say aggregate and avoid the poisonous term "anonymous"
14:56:21 <dsinger> (thinks that anonymous/aggregate is a separate exception)
14:56:41 <schunter> q?
14:57:20 <ninjamarnau> the use of anonymous data isn't critical but the process of anonymisation. How do they do this. On which stage?
14:58:15 <jmayer> Current text: "A third party acting within the outsourcing exception, for example, may not make independent use of the data it has collected even though the use involves unidentifiable data."
14:58:16 <dsinger> aleecia: easier on summing after aggregation, than aggregate then summarize
14:58:26 <justin> +1 to what aleecia says
14:58:36 <dsinger> q?
14:58:38 <schunter> q?
14:58:42 <sean> +q
14:58:45 <schunter> q- amyc
14:58:49 <schunter> ack tl
14:59:05 <karl> karl has joined #dnt
14:59:09 <jchester2_> jchester2_ has joined #dnt
14:59:10 <dsinger> tl: shouldn't have the same exception for 3rd party and anon
14:59:25 <dsinger> wileyS: use anon and aggreg in combination
14:59:26 <schunter> ack fielding
15:00:20 <dsinger> fielding: two specific texts: (3) should be 'consistent with adhering to the standard' (don't need to revise standards)
15:00:21 <amyc> q+
15:00:49 <npdoty> proposed change for 3: "the third party makes commitments that are consistent with adhering to this standard in a form that is legally enforceable (directly or indirectly) by the first party, individual users, and regulators; data retention by the third party must not survive the end of this legal enforceability;"
15:00:50 <dsinger> …and on (4) prevent *retention* rather than collecting across 3rd parties
15:01:25 <jmayer> "consistent with the requirements of this standard"?
15:01:41 <jmayer> concerned "consistent with adhering to" is a little ambiguous
15:01:43 <npdoty> fielding, how do you feel about jmayer's text?
15:01:53 <dsinger> rigo: sharing and retention; you cannot immediately share and then not retain
15:01:54 <npdoty> agree that the proposed change is awkward or ambiguous
15:01:58 <karl> forgetful services
15:02:08 <schunter> q?
15:02:15 <dsinger> …two aspects in the same phrase: do not retain
15:02:26 <dsinger> …defers to Roy for exact text
15:02:36 <ShaneW> ShaneW has joined #dnt
15:02:43 <schunter> ack jmayer
15:02:54 <dsinger> npdoty: should we examine all use of 'collect' and see if it should be 'retain'?
15:02:54 <tl> q?
15:03:32 <dsinger> jmayer: not comfortable with changing 'collect' to 'retain'
15:03:37 <karl> all of these 3.6.1.2.1 is a MAY
15:03:44 <fielding> on part 4, replace "prevent collecting data" with "prevent storage or sharing data"
15:03:46 <rigo> the third party undertakes reasonable technical precautions to prevent retention or sharing of data that could be correlated across first parties.
15:03:47 <dsinger> …companies should not have their hands on info that can be correlated across sites
15:03:56 <rigo> aka siloing
15:04:11 <justin> karl, it's many ONLY IF
15:04:26 <justin> karl, may ONLY if (that is)
15:04:34 <dsinger> jmayer: in particular some web security primitives apply to this problem
15:04:56 <dsinger> …ok revising to clarify, wrt non-protocol info (not IP addresses etc.)
15:05:23 <dsinger> aleecia: we may need a 'best practices' section for this?
15:05:30 <karl> justin, still a MAY is optional. What happening if none of the all happens
15:05:46 <schunter> q?
15:05:52 <dsinger> q+
15:06:20 <dsinger> aleecia: suggests jmayer writing the non-normative discussions, run past fielding
15:06:23 <meme> q+
15:06:33 <schunter> ack bryon
15:06:39 <dsinger> action: jmayer to write discussion on best practices for 3.6.1.2.1
15:06:40 <trackbot> Created ACTION-47 - Write discussion on best practices for 3.6.1.2.1 [on Jonathan Mayer - due 2012-01-31].
15:06:40 <schunter> ack bryan
15:06:57 <justin> karl, the default for a third-party is that they MUST NOT do anything unless certain sections come up.  This provision is an exception to that otherwise rule.
15:07:10 <dsinger> bryan: doesn't understand, it's on behalf of the 1st party
15:07:55 <ninjamarnau> +q
15:07:59 <npdoty> point of agreement between jmayer and fielding seems to be that collection (but not retention) of protocol information might be fine as long as non-protocol data isn't collected at all
15:08:15 <dsinger> bryan: putting limits on the data seems un-nessacrily restrictive
15:08:21 <karl> maybe it is a question of reformulation of the MAY statement.
15:08:23 <justin> karl, complying with these provisions is certainly optional, but you would have to meet all the optional requirements in order to be treated as a first-party
15:08:25 <karl> q+
15:08:32 <dsinger> schunter: e.g. use different cookies, silo the data
15:08:38 <dsinger> q?
15:09:05 <schunter> q?
15:09:16 <npdoty> fielding, on 3. are you okay with "consistent with the requirements of this standard" which is the change I've just made?
15:09:19 <dsinger> bryan: 'could be correlated' is very broad set
15:09:42 <dsinger> aleecia: this seems to be a usability test of the document
15:09:58 <schunter> q?
15:10:12 <dsinger> …have you read the rest of the section?
15:10:27 <fielding> npdoty, not really, since there are a lot of requirements that are not relevant to us … would prefer what I said "consistent with adhering to this standard"
15:10:52 <dsinger> karl: malformed conformance statement?  could it be better phrased for compliance?
15:11:02 <dsinger> …it's a negative conformance statement
15:11:12 <rigo> +1 to karl makes the rules easier
15:11:35 <jmayer> q?
15:11:38 <jmayer> +q
15:11:52 <dsinger> …change from 'may operate' as.. to something less confusing?
15:12:17 <dsinger> bryan: thinks that 'product improvement' Should be allowed
15:12:22 <schunter> q?
15:12:35 <dsinger> ack sean
15:12:41 <karl> q-
15:12:46 <bryan> Acting as a 1st party requires abilities that conflict with the conditions, e.g. retention.
15:12:51 <bryan> "right to use the data" must include actions that the 3rd party takes to improve the service it provides to the 3rd party.
15:12:57 <bryan> "could be correlated across first parties" is too loose a requirement. Many non-PII items can be correlated, and methods of doing so are evolving all the time. This would severely limit the types of data that could be collected.
15:13:04 <dsinger> sean: seconds product improvement issue, we should be careful about excluding that
15:13:05 <npdoty> "consistent with the requirements of this standard" vs. "consistent with adhering to this standard" -- do these mean different things? /cc fielding, jmayer
15:13:32 <dsinger> …are they technical or operational precautions?
15:13:42 <schunter> q?
15:14:01 <dsinger> amyc: also shares point 4 production improv. concern
15:14:08 <schunter> q?
15:14:18 <ksmith1> ksmith1 has joined #dnt
15:14:20 <schunter> ack amyc
15:14:39 <dsinger> ….on (3), say I have a contract with the provider, now…legally enforceable to the user and regulator?
15:14:47 <ksmith1> q+
15:15:33 <dsinger> rigo: concerned about this also, finds it unclear
15:16:36 <fwagner> q?
15:16:51 <dsinger> tl: tries to read the mind of the author: we have screwyou analytics, and some 1st party example.com contracts with them. the analytics company now sells all the data, and example.com doesn't care.  but the users and regulators DO care.
15:17:17 <schunter> q?
15:17:33 <ninjamarnau> -q
15:17:44 <justin> any public statement by screwyou would fix that
15:18:02 <fielding> npdoty, the commitments that we make are not protocol requirements -- they are behavioral limits on us.  Hence, we have contractual commitments that are consistent with adhering to the standard even though they have nothing to do with the protocol requirements.
15:18:06 <dsinger> meme: agrees with the concern, but not sure what can be enforceable by parties, users, and regulators?  would love to solve it, 
15:18:07 <schunter> q?
15:18:20 <dsinger> dsinger: should be actionable by the user if the analytics company lies like this
15:18:57 <dsinger> shane: this creates legal complications; example.com now becomes legally liable for the analytics
15:19:12 <karl> hmmm "3.6.1.2 Exemption for Outsourcing"
15:19:26 <dsinger> tl: clarifies this is on the THIRD party, not the first
15:19:28 <dsinger> q?
15:19:44 <efelten> s/this/liability/
15:19:45 <dsinger> rigo: wants the lawyers to get into a corner and achieve that effect
15:20:43 <dsinger> aleecia: put it in the privacy policy?
15:20:56 <dsinger> dsinger: why not leave it to the requirement that it's legally enforceable?
15:21:21 <dsinger> tl: we try to document the 'end state' that it's enforceable, and not state why
15:21:48 <dsinger> rigo: there is a loophole here.  EU has a privacy law applying to everyone, but contracts are two-party
15:22:06 <dsinger> …you are inventing something to close that spot
15:22:10 <justin> I don't think we can require "legal enforceability" in the spec --- who knows what is legally enforceable in Zambia and Palau?
15:22:11 <npdoty> fielding, the commitments you make are consistent with the requirements in the Compliance spec, right?
15:22:25 <justin> It is simpler to say "third party must make a statement in its privacy policy . . ."
15:22:28 <dsinger> …one way to turn it around is to make the 1st party liable
15:22:41 <tl> s/tl: we try to document/jm: we try to document
15:23:00 <dsinger> aleecia: who would find it acceptable to put the liability on the 1st party?
15:23:18 <dsinger> jchester: this seems to back into the EU 'data controller' concept
15:23:29 <dsinger> aleecia: yes, but we felt that is too far for the group
15:23:41 <dsinger> rigo: this seems complex
15:23:53 <schunter> q?
15:24:26 <jmayer> Was there ever discussion of first party diligence in outsourcing to a third party?
15:24:41 <justin> meme, I would suggest "the third party makes a statement in its privacy policy consistent with this standard" (or mirror whatever fielding proposed to address the contract between the parties)
15:24:49 <jmayer> E.g. if a first party has reason to believe a third party is sketchy, but does business with them anyways?
15:25:37 <schunter> q?
15:25:41 <dsinger> XXXX: two situations, the USA doesn't have [so much] data protection concepts, the EU does.  I don't see how I would NOT expect the 1st party to be involved
15:25:57 <npdoty> s/XXXX/jimk/
15:26:01 <efelten> s/XXX/JimKillock
15:26:11 <dsinger> …you shoveled my data around, and I want to take you to court.
15:26:43 <dsinger> schunter: we seem to agree on goals, and the lawyers think they can improve the text
15:26:46 <schunter> q?
15:27:02 <fielding> npdoty, which requirements?
15:27:11 <rvaneijk> I will touch on issue14 tomorrow in a short presentation, addressing controller-processor and third parties
15:27:17 <dsinger> meme: doesn't know what is legally enforceable around the world; it might never be in some jurisdictions for all 3 parties
15:27:36 <dsinger> action: rigo to re-phrase 3.6.1.2.1 to re-draft (3)
15:27:36 <trackbot> Created ACTION-48 - Re-phrase 3.6.1.2.1 to re-draft (3) [on Rigo Wenning - due 2012-01-31].
15:27:58 <dsinger> aleecia: we note other lawyers agreed to help rigo
15:28:08 <dsinger> q?
15:28:14 <bryan> q+
15:28:20 <justin> rigo, I already suggested language to meme
15:28:21 <meme> q-
15:28:22 <schunter> ack dsinger
15:28:23 <efelten> scribenick: efelten
15:28:30 <npdoty> rigo will follow up with meme, amyc, jmayer on ACTION-48
15:28:44 <justin> rigo, I would suggest "the third party makes a statement in its privacy policy consistent with this standard" (or mirror whatever fielding proposed to address the contract between the parties)
15:29:08 <jmayer> q?
15:29:17 <schunter> q?
15:29:18 <efelten> dsinger: Don't know what point 4 is supposed to do. Previous points should rule out this possibility anyway--could never do this on behalf of a first party.
15:29:46 <fielding> ack jmayer
15:30:01 <dsinger> tl: can explain.  (4) is intended to get at what the 3rd party has to do with the data while it is in its possession.
15:30:11 <efelten> scribenick: dsinger
15:30:42 <ShaneW> Proposal:  "The third party undertakes reasonable precautions to prevent data correlation across first parties."
15:30:52 <npdoty> s/tl: can explain/jmayer: can explain/
15:30:54 <tl> s/tl: can explain/jmayer: can explain
15:31:01 <dsinger> …(4) is the technical dual of rule (3).  The 3rd party may have some information that could be used.
15:31:29 <schunter> q?
15:31:41 <dsinger> …technical siloing that goes beyond 'this belongs to A, this belongs to B'
15:33:01 <schunter> q?
15:33:05 <rigo> q+
15:33:07 <npdoty> ShaneW, you agreed with having a MUST requirement for technical siloing at Santa Clara, right? as long as we didn't specify what the technical measure was?
15:33:56 <meme> how did we (or did we) resolve the anonymous aggregated use of the data in 2?
15:34:02 <ShaneW> Correct - but in my mind, "technical" may manifest as a "technical operation" approach to maintain separation.  Now the language feels like that wouldn't be supported.
15:34:05 <dsinger> aleecia: think that 3 and 4 should be separate.
15:34:05 <schunter> q?
15:34:08 <justin> meme, we haven't yet
15:34:57 <schunter> q?
15:35:10 <justin> meme, but aleecia proposed allowing the outsourcee to use aggregated data for each first-party buckey, and then you can combine the buckets, and I think that makes sense
15:35:44 <dsinger> jmayer: it is NOT siloing the two first parties separately, it is making it so that the 3rd party CANNOT ever later re-correlate
15:35:58 <dsinger> JC: operational as well as technical
15:36:11 <dsinger> jmayer: seems to be worried about govt agencies
15:36:35 <npdoty> s/jmayer:/... jmayer/
15:36:46 <schunter> q?
15:36:53 <dsinger> jmayer: initially had technical and legal precautions; rogue employees, data breach, govt intrusion
15:37:02 <npdoty> oh wait, it was sean that said that jmayer was worried about govt access
15:37:08 <rvaneijk> Using the 3 elements of jmayer: in order to comply legally a company needs to take technical and organizational mearures
15:37:10 <dsinger> …we want to make sure the 3rd party gets it right
15:37:11 <dsinger> q?
15:37:12 <ShaneW> +q
15:37:49 <schunter> q?
15:38:06 <dsinger> aleecia: suggests that we ask the editors to separate 3 and 4 from 1 and 2
15:38:09 <dsinger> q?
15:38:15 <dsinger> (more discussion)
15:38:19 <dsinger> ack ksmith
15:38:49 <dsinger> ksmith: under the product improvement, it's difficult for the 3rd party to fix bugs if they cannot see the data
15:39:27 <schunter> q?
15:39:36 <tl> +q
15:39:49 <dsinger> ack bryan
15:39:56 <tl> ack bryan
15:40:17 <dsinger> bryan: doesn't understand how it can affect the capability of sites that don't have integrated advertising, as opposed to those that do
15:40:50 <schunter> ack rigo
15:40:53 <dsinger> …seems to create a non-level field for outsourced advertising
15:41:04 <bryan> The basic problem with this section is that it will inordinately affect the capabilities of 1st parties without integrated advertising (and who thus depend upon 3rd party Ad networks), as compared to 1st parties with integrated advertising. Why should the requirements be any different, if the objective is to protect the user from unwanted tracking based upon cross-site sharing of info?
15:41:19 <dsinger> rigo: 1 and 2 express everything, and 3 and 4 are supporting
15:41:29 <dsinger> …implementation details to fulfill 1 and 2
15:41:34 <schunter> q?
15:41:38 <schunter> ack ShaneW
15:41:39 <fwagner> in some cases correlation of the data is part of the service - re-targeting ?
15:41:40 <npdoty> bryan: "unlevel situation" between 3rd-party advertisers and large 1st parties that do their own advertising
15:41:45 <karl> 3 options in Google about Data Sharing http://support.google.com/analytics/bin/answer.py?hl=en&answer=1011397
15:42:32 <karl> for analytics
15:43:20 <dsinger> wileyS: on (4) I believe that is overly prescriptive, and there are operational approaches to keep data separate. e.g. some companies scrub within a week such that users are no longer identifiable, but not at the moment of collection.  The data analysis services may need it, and you need to be crash-proof.  there are also the bug tracing problems
15:43:20 <jmayer> +q
15:43:38 <dsinger> …is it a user-specific or environmental issue?
15:44:25 <ksmith> ksmith has joined #dnt
15:45:09 <bryan> +1 to Shane's suggestion of focusing on cross-site sharing, rather than collection/retention of data by 3rd parties
15:45:13 <schunter> q?
15:45:14 <rigo> q?
15:45:20 <dsinger> …even after considering all the issues and doing the right things, things can go wrong
15:45:34 <schunter> ack tl
15:45:42 <johnsimpson> q+
15:46:11 <ShaneW> "The third party undertakes reasonable precautions to prevent data correlation across first parties."
15:46:13 <schunter> q?
15:46:17 <fielding> q+
15:46:33 <karl> could we remove reasonable
15:46:34 <meme> justin, seems that even aleecia's suggestion isn't allowed as written
15:47:22 <dsinger> wileys: still concerned about debugging
15:47:40 <justin> meme, you are correct, and I think we need to get back to the text and revise it, but we got off on this topic
15:48:16 <tl> +q
15:48:17 <dsinger> aleecia: if we go down this path of allowing the 3rd some use (e.g. debugging) we should write it down and balance the case against the risks
15:49:29 <dsinger> action: wileys to propose what the operational carve-outs for 3.6.1.2.1 (e.g. debugging by 3rd party) are
15:49:29 <trackbot> Sorry, couldn't find user - wileys
15:49:38 <schunter> q?
15:49:46 <schunter> ack jmayer
15:50:09 <npdoty> action: wiley to propose what the operational carve-outs for 3.6.1.2.1 (e.g. debugging by 3rd party) are
15:50:09 <trackbot> Created ACTION-49 - Propose what the operational carve-outs for 3.6.1.2.1 (e.g. debugging by 3rd party) are [on Shane Wiley - due 2012-01-31].
15:50:12 <dsinger> jmayer: we're looking for text to critique and work on, not agree (agreed)
15:50:44 <karl> "undertakes reasonable precautions" is not applicable. 
15:51:11 <rbarcelo_> rbarcelo_ has joined #dnt
15:51:26 <dsinger> …one conversation has been "we have these needs, some proportion of users will have DNT enabled; those that don't still enable you to debug, don't they?"
15:51:43 <schunter> q?
15:51:45 <alex_> q?
15:51:52 <dsinger> (laughter)
15:52:43 <schunter> meme: With the no-retention rule, the DNT is easy to distinghuish from the massive data since the massive data will not contain DNT data.
15:53:38 <dsinger> wileys: agrees with Jonathan, some of this applies whether DNT is on or off.  what the % is doesn't matter.  there are operational purposes (e.g. masking fraud), just as for the 1st party.
15:53:42 <ksmith> schunter: not once its aggregated
15:53:52 <dsinger> s/its/it is/
15:54:01 <npdoty> issue-22?
15:54:01 <trackbot> ISSUE-22 -- Still have "operational use" of data (auditing of where ads are shown, impression tracking, etc.) -- raised
15:54:01 <trackbot> http://www.w3.org/2011/tracking-protection/track/issues/22
15:54:05 <dsinger> aleecia: we move to issue 22
15:54:10 <ninjamarnau> I would be interested in what frequency/importance we talk about for this "cross-site debugging"
15:54:14 <schunter> q?
15:54:16 <dsinger> see 3.6.1.1.1
15:54:42 <dsinger> (exemption for operational use of data)
15:54:58 <ninjamarnau> q+
15:55:03 <sean> +q
15:55:06 <dsinger> …5 things have been proposed (3.6.1.1.1).  we need detail
15:55:12 <dsinger> q?
15:55:15 <jmayer> +q
15:55:19 <rigo> q?
15:55:44 <dsinger> wileys: introduces this text, and notes there is a (6) coming
15:56:12 <rigo> seeing the 5 exceptions, I wonder about the delta to the current situation
15:56:31 <efelten> scribenick:efelten
15:57:06 <efelten> WileyS: Aggregated reporting might be written as "aggregated and anonymous" if the group prefers
15:57:14 <bryan> q+
15:57:36 <efelten> WileyS: Need a flexible exception for security so bad guys can't hide by turning on DNT.
15:58:01 <efelten> WileyS: new, 6th point is research.  Needs to be appropriately scoped so it isn't too broad.
15:58:14 <bryan> +1 on the need to do research and market analytics on aggregated/anonymous data
15:58:29 <efelten> WileyS: Purpose of research is insight into user population in aggregate, not (e.g.) redlining.
15:58:34 <jchester2_> q+
15:58:48 <efelten> aleecia: How is this different from point 3?
15:58:57 <alex_> q?
15:59:17 <efelten> WileyS: Some research could be non-aggregate, e.g. how users switch between desktop and mobile
15:59:26 <efelten> WileyS: Research is for public benefit
15:59:45 <efelten> jchester: We need specific language for this.
15:59:46 <npdoty> would it be shorter to say the cases where data can't be collected under DNT?
16:00:10 <justin> +q
16:00:20 <bryan> there are many distinct service domains where generic web analytics and standards are inadequate and need to be supplemented by analytics
16:00:21 <efelten> aleecia: Is this the right list of 5/6 points?  Need more?  Drop some?
16:00:48 <efelten> ... Does this cover every part of operational use that we want to include?
16:00:56 <fwagner> +q
16:01:00 <efelten> amyc: Should include product improvement?
16:01:09 <schunter> q?
16:01:15 <ShaneW> +q
16:01:33 <schunter> ack johnsimpson
16:01:39 <schunter> ack fielding
16:01:55 <efelten> fielding: Does point 2 include referral tracking?
16:02:09 <schunter> q?
16:02:15 <efelten> WileyS: Assumed it would include typical http log data, which would include referrer
16:02:21 <ShaneW> + Debugging (which could be an easier path than "Product Improvement")
16:02:22 <tl> +tl
16:02:26 <schunter> ack tl
16:02:29 <jmayer> -q
16:02:35 <tl> +q
16:02:35 <schunter> ack ninjamarnau
16:02:38 <schunter> ack sean
16:02:40 <justin> q-
16:02:47 <jmayer> +q
16:02:55 <dan> dan has joined #dnt
16:03:08 <efelten> sean: Add sequential ad rotation (i.e. showing a set of ads in pre-planned sequence)?
16:03:09 <schunter> ack bryan
16:03:27 <tl> -q
16:03:54 <efelten> bryan: How can this list be future-proof?  How to add new ideas as they develop?
16:04:10 <efelten> ... Aggregate, anonymous data should be off the table.
16:04:25 <schunter> ack jchester2_
16:04:42 <efelten> dsinger: Aggregate, anonymous is already covered -- this list is mostly for non-aggregate, non-anonymous.
16:04:56 <johnsimpson> +q
16:04:59 <dsinger> (see 3.6.1.3 -- still to be written)
16:05:04 <npdoty> 3.6.1.3 is "Exemption for unidentifiable data"
16:05:12 <efelten> jchester: What about real-time bidding?
16:05:35 <justin> Industry has already agreed that collection and use must meet one of a few enumerated buckets as part of the DAA definition.
16:05:38 <schunter> q?
16:06:06 <efelten> WileyS: Challenge is how to allow RTB, with third parties closely involved, while maintaining DNT compliance.
16:06:17 <bryan> I don't see that the enumeration of allowed exceptions can be definitive, we will always find that we left something important out or did not clearly include something in how the exceptions were expressed. As long as aggregated/anonymous data is used, why should there be any problem with any operational use?
16:06:25 <efelten> sean: Couldn't do RTB based on user profile under DNT anyway.
16:06:35 <rigo> q?
16:06:36 <schunter> ack fwagner
16:06:39 <schunter> q?
16:06:40 <johnsimpson> q?
16:06:51 <jmayer> -q
16:06:54 <jmayer> +q
16:07:09 <efelten> fwagner: Not sure point 3 covers analytics clearly.
16:07:19 <efelten> (some confused chatter)
16:07:38 <schunter> q?
16:07:41 <schunter> ack ShaneW
16:07:51 <sean> In a DNT setting the user profile would not be allowed to be used (and the user would not be allowed to be added to a data segment). Any rtb setting would have to let buyers bid on the impression without any specific user information (page context, etc)
16:08:00 <KevinT> RTB/DNT reference: OpenRTB spec has placeholder for DNT (http://code.google.com/p/openrtb/) see v 2.0
16:08:02 <efelten> dsinger: Should separate aggregated/anonymous data from the exceptions that apply to fully or partially identifiable/linkable data.
16:08:09 <jmayer> -q
16:08:44 <efelten> johnsimpson: Have been skeptical about whether any exceptions should exist at all
16:09:01 <schunter> q?
16:09:02 <efelten> ... Would be easier to persuade me if there are short limits on retention
16:09:07 <schunter> ack johnsimpson
16:09:08 <schunter> df
16:09:12 <tl> ack johnsimpson 
16:09:13 <schunter> q?
16:09:17 <tl> +q
16:09:26 <ShaneW> Data Retention is a much broader discussion and should be addressed separately (but absolutely agree it should be addressed)
16:09:53 <efelten> aleecia: Any objections to these points--are any of these unsalvageable?
16:10:11 <efelten> ... don't speak up if these are flawed but fixable
16:10:19 <schunter> q?
16:11:30 <efelten> rvaneijk: Is this MUST, MAY?  How prescriptive?
16:11:36 <efelten> aleecia: Let's defer that
16:11:55 <efelten> mzaneis: Is there a way to amend the standard later to incorporate new practices?
16:12:03 <schunter> q?
16:12:09 <efelten> aleecia: standards can be versioned, things can change in version 2
16:12:41 <efelten> aleecia: Call for objections to each specific item (is it bad and unfixable)
16:13:11 <rbarcelo_> rbarcelo_ has joined #dnt
16:13:13 <efelten> No objections to 1 or 2
16:13:34 <efelten> aleecia: Group wants to take out point 3, as covered elsewhere
16:14:03 <efelten> s/point 3/aggregate-data point/
16:14:30 <efelten> tl: How do financial logging and 3rd party auditing differ?
16:14:47 <efelten> sean: There are differences, it's clearer to specify them separately
16:15:00 <efelten> WileyS: Companies like DoubleVerify illustrate the difference
16:15:11 <schunter> q?
16:15:23 <efelten> aleecia: Set aside research for now, pending more specific text
16:15:42 <efelten> jchester: Object to product improvement point
16:15:46 <karl> I do not understand "Frequency capping" or more exactly I understand it as an escape for serving diverse ads to users. What are the financial implications for the ads network?
16:16:20 <efelten> aleecia: no objection to ad sequencing nor debugging
16:16:40 <efelten> aleecia: Let's focus on frequency capping now
16:16:45 <schunter> q?
16:16:47 <npdoty> just to clarify, this "no objection" is the style of "no way this could be addressed in the spec"
16:16:47 <ninjamarnau> q+
16:16:48 <karl> q+
16:16:50 <jmayer> +q
16:16:58 <tl> +q
16:17:13 <karl> dsinger, why should they remember that?
16:17:33 <efelten> tl: Current text doesn't have any minimization aspect. Q to advertisers: can you use per-ad cookies?
16:17:43 <efelten> justin: Minimization language is already there.
16:18:06 <jchester2_> q+
16:18:07 <efelten> WileyS: per-ad cookies for frequency capping requires too many cookies, or too-large cookies
16:18:24 <efelten> ... not feasible today
16:18:53 <efelten> ... more feasible to use unique IDs for this process
16:18:58 <schunter> q?
16:19:01 <justin> q+
16:19:02 <schunter> \ack tl
16:19:08 <schunter> ack tl
16:19:10 <efelten> tl: Is sequential rotation very similar to frequency capping?
16:19:12 <efelten> sean: yes
16:19:38 <jmayer> If sequential rotation includes targeting, then it's more like retargeting.
16:20:06 <efelten> jchester: To the extent DNT is enabled, how can frequency capping be done? How to balance against user desire not to have actions correlated across sites?
16:20:33 <efelten> WileyS: Essentially keep a mini-profile that is only used to do the counting for frequency-capping.
16:20:44 <efelten> sean: agree with WileyS
16:21:03 <schunter> q?
16:22:12 <efelten> action: WileyS to produce text clarifying implementation of frequency capping and seq ad rotation, with use cases
16:22:12 <trackbot> Sorry, couldn't find user - WileyS
16:22:27 <npdoty> action: Wiley to produce text clarifying implementation of frequency capping and seq ad rotation, with use cases
16:22:27 <trackbot> Created ACTION-50 - Produce text clarifying implementation of frequency capping and seq ad rotation, with use cases [on Shane Wiley - due 2012-01-31].
16:23:01 <schunter> Goal (as far as I understood): Data stored can only associate the frequency count with a specific user agent. No other information can be associated.
16:23:02 <efelten> WileyS: Sequential advertising means showing you a specific sequence of ads to a user, in order -- keeping the "plot" in the right order
16:23:06 <schunter> q?
16:23:12 <schunter> ack ninjamarnau
16:23:13 <efelten> aleecia: More comments on frequency capping?
16:23:24 <tl> Q?
16:23:55 <efelten> ninjamarnau: Quite critical of cookies with unique IDs. Can live with 24-hour lifetime, otherwise would oppose it. If must show DNT user repetitive ads, so be it.
16:24:14 <dsinger> q+
16:24:16 <efelten> WileyS: Frequency capping improves user experience
16:24:34 <efelten> ... users might turn off DNT if annoyed by repeated ads
16:24:39 <dsinger> q-
16:24:41 <schunter> q?
16:26:01 <efelten> tl: Frequency capping data can be interest-based, if some of the ad impressions were contextual.
16:26:18 <efelten> ... Fact of having seen ad X conveys fact that user was on site Y
16:26:44 <schunter> q?
16:26:46 <efelten> WileyS: True, but that's corner case, would be very rare in practice
16:27:28 <efelten> dsinger: Not sure that's true. If ads are targeted well, list of ads you have seen implies your interests.
16:27:46 <schunter> q?
16:28:04 <dsinger> but you cannot use that database of 'ads shown' as a way of targeting, of course
16:28:07 <johnsimpson> q+
16:28:25 <efelten> ... As a safeguard, must be clear that you can't use the frequency-capping data to target anything, etc.
16:28:36 <efelten> aleecia: How often do users actually hit the frequency cap?
16:29:21 <BrianTs> BrianTs has joined #DNT
16:29:28 <efelten> WileyS: Many users don't.  But heavy users will see the most common ads repeatedly and will likely hit the cap.
16:30:18 <jchester2_> q+
16:31:24 <schunter> q?
16:31:31 <sean> +q
16:31:50 <efelten> karl: Agree with tl. Don't understand why frequency capping is needed. 
16:32:04 <schunter> q?
16:32:11 <schunter> ack karl
16:32:14 <johnsimpson> -q
16:32:15 <efelten> .. It's creepy to see sequential ads after disabling DNT. 
16:32:31 <ninjamarnau_> ninjamarnau_ has joined #dnt
16:32:31 <efelten> ... Don't see the need for frequency capping, would rather see repeated ads.
16:33:10 <rbarcelo_> rbarcelo_ has joined #dnt
16:33:11 <efelten> WileyS: Advertisers will pay less for ads without frequency cap.  Users are annoyed by repeated ads. Site gets less revenue.  Lose-lose-lose.
16:33:46 <efelten> karl: Question to WileyS: Why do you need frequency capping?
16:34:06 <ninjamarnau_> sorry if I repost this, but I lost connection to IRC:     I understand the aim of frequency capping. I just want to know if you could do this in a less invasivway than a long-living cookie with unique identifier
16:34:06 <tl> +q
16:34:17 <efelten> sean: Most users will encounter freq cap at some point. 
16:34:31 <schunter> q?
16:34:57 <efelten> ... Business model is aimed to advertiser who wants prominent (e.g.) home page ad, pay premium for that level of visibility
16:35:24 <efelten> ... Benefit to advertiser and brand impression rely on not showing ad to the same user too often
16:35:46 <efelten> ... Not willing to pay top price for repeated impressions
16:36:28 <efelten> .. For publisher, significant revenue comes from those premium impressions
16:36:42 <schunter> Premium CPS pays around 40$ (masthead, high profile site, ...) while low CPS is around 1$
16:37:17 <efelten> aleecia: What about ninjamarnau's suggestion to limit lifetime of frequency capping cookie?  Would that enable sean's business model scenario?
16:37:21 <dsinger> q?
16:37:46 <efelten> WileyS: Most campaigns would be unaffected by 6-8 week lifetime, some are as long as 90 days
16:37:58 <efelten> aleecia: Why not limit retention to lifetime of campaign?
16:38:29 <efelten> WileyS: That's likely practical, given some extra time to carry out the necessary operations.
16:38:37 <schunter> Yahoo would be OK with limiting retention (for frequency capping) to the lenght of the campain bu tnot more than a fixed time (say 90 days).
16:38:54 <efelten> ... might need to keep data longer for other exception-purposes, such as security
16:39:31 <efelten> aleecia: Slightly more complicated if you're using the same cookie for multiple campaigns that have different lifespans.
16:39:44 <schunter> q?
16:39:53 <efelten> WileyS: Some implementation challenges here...
16:40:23 <efelten> tl: Could you scrub out data about a campaign when it's over?  Change identifiers in an unlinkable way?
16:40:46 <efelten> (crosstalk, seems to be some agreement with tl)
16:41:04 <dsinger> q+ to say I find frequency capping (not showing an ad based on history) much less worrying than sequential (showing an ad based on history)
16:41:16 <efelten> jchester: Bottom line question: What is collected about the user in this scenario?
16:41:38 <efelten> ... need to articulate the limitations in this scenario
16:41:38 <sean> +q
16:41:57 <sean> i would like to withdraw sequential creative rotation as an exception. i agree with karl dubost on this one now. 
16:42:14 <rvaneijk> WileyS: addresses purpose limitation
16:42:16 <efelten> WileyS: In this context, only permissible use is to count and check frequency caps.
16:42:31 <efelten> aleecia: Take additional discussion offline.
16:42:48 <efelten> ... Karl, could you live with this if there is a time limit?
16:42:59 <schunter> ack jmayer
16:43:12 <efelten> karl: Yes, if the details are right.
16:43:21 <johnsimpson> q+
16:43:59 <chapell> chapell has joined #dnt
16:44:05 <efelten> jmayer: Don't think we would create this exception if there weren't already a business practice here.
16:44:43 <efelten> ... Many of the threat models I and others worry about stem from the existence of unique IDs plus database of user actions across websites.
16:44:52 <efelten> ... even if companies are well-intentioned
16:45:28 <efelten> ... Exceptions like this cause companies to place tracking cookies, making it hard for users to check whether companies are complying
16:45:43 <ShaneW> JMayer - you state that the "reason we are here" is to "prohibit the collection of data" with DNT - I would argue many in the room don't agree that is the "reason we are here".
16:45:45 <npdoty> <my paraphrase>: creation of a unique id passed around from the browser is always an issue that I would be skeptical of; the harm is in the collection (even if unintentional) and possession of profiles of browsing histories across sites, not their use
16:45:53 <jimk> q+ jimk
16:45:55 <efelten> ... Worry that companies will mess up and data will end up getting used for purposes outside the standard
16:46:11 <karl> the risks of screwing up and cross-sites makes it indeed a no go. I might change my "yes" in a "no"
16:46:29 <efelten> ... Don't see time limits as resolving the problem.  Difficult for client to verify, easy for site to mess up and retain too much
16:47:00 <efelten> ... Companies here are capable of getting this right, but others maybe not
16:47:44 <schunter> q?
16:47:52 <efelten> ... Researchers have shown this can work with client-side storage. An ad network out there (Mochi Media) is using our technology.
16:48:01 <johnsimpson> -q
16:48:19 <efelten> tlr: Remember that all of this is under a data minimization framework.
16:49:10 <efelten> ... so if practical ways to do (e.g.) frequency capping without unique IDs become clearly available, companies' obligations would change
16:49:18 <schunter> This implies SHOULD language.
16:49:28 <schunter> q?
16:49:32 <efelten> ... jmayer may be describing the future; WileyS and sean are describing the present
16:49:41 <chapell> +q
16:49:49 <andyzei> andyzei has joined #dnt
16:49:59 <rigo> Ninja said one day, Shane said 90 days. Aleecia said 7 days without getting a response
16:50:08 <efelten> aleecia: jmayer, would (say) a 90-day timeout address your concern?
16:50:33 <johnsimpson> q?
16:50:38 <schunter> ack jchester2_
16:50:44 <efelten> jmayer: First, they would have to make the cookie-IDs actually unlinkable between generations.  Anyway, reduces but does not eliminate the problem.
16:51:10 <schunter> ack justin
16:51:14 <efelten> jchester: Can live with counting-only use. Want to see specific text.
16:51:14 <rigo> I think there should be some merit to opt-back in. If everything works with DNt=1 there is no incentive to work on "opt-back-in"
16:51:58 <schunter> Once you set a cookie with a persistent ID, then restoring privacy (in case a party may disbehave) is hard.
16:52:06 <efelten> justin: Agree with jchester.   Question to ad networks: For frequency capping, is it enough to remember how many times each ad was seen, and referer?
16:52:13 <karl> the more exceptions the more difficult it will be to implement.
16:52:24 <schunter> q?
16:52:39 <schunter> ack sean
16:52:40 <efelten> WileyS: Cap is on an ad across all sites, don't need to log where the user saw the ad.  (But that comes up for another exception.)
16:53:06 <efelten> sean: In reply to karl, agree that sequential rotation is contrary to spirit of DNT and should not be an exception.
16:53:12 <dsinger> q?
16:53:34 <ninjamarnau_>  regardless of the life span of the cookie, it violates the ePrivacy Directive without consent
16:53:37 <ksmith> ksmith has joined #dnt
16:53:49 <ksmith> q+
16:54:02 <efelten> aleecia: Sense of the room?  Is freq capping fundamentally inconsistent with DNT, or is it a business practice that we should accomodate?
16:55:09 <efelten> ... Pretty even split, slightly heavier on should-accomodate.
16:55:24 <efelten> ... Having specific text would help.  Volunteer to write text?
16:56:09 <rbarcelo_> rbarcelo_ has joined #dnt
16:56:24 <efelten> action: WileyS to Propose specific text for frequency capping exception, including extended discussion.
16:56:24 <trackbot> Sorry, couldn't find user - WileyS
16:56:38 <npdoty> action: Wiley to Propose specific text for frequency capping exception, including extended discussion.
16:56:38 <trackbot> Created ACTION-51 - Propose specific text for frequency capping exception, including extended discussion. [on Shane Wiley - due 2012-01-31].
16:57:21 <efelten> schunter: How much does this discussion have in common with the other exceptions?  Is there some general text that would help?
16:57:31 <bryan> q?
16:57:53 <efelten> ... Can we say that sites should avoid using unique IDs where that's reasonably practical?
16:58:11 <efelten> WileyS: Yes, we should agree to do that.
16:58:11 <dsinger> q-
16:58:41 <efelten> bryan: Can we say that data collected for one of these exceptions should be used for other purposes?
16:58:56 <efelten> aleecia: Already have that, perhaps could be clearer.
16:59:06 <npdoty> s/should/shouldn't/
16:59:11 <dsinger> zakim, restaurant info?
16:59:11 <Zakim> I don't understand your question, dsinger.
16:59:11 <rvaneijk> ShaneW addressed purposed limitation
16:59:19 <efelten> aleecia: Out of time today.  Lots of fruitful discussion, would like to see more issues closed.
17:00:01 <efelten> (lots of talk about food)
17:01:37 <dsinger> http://www.lecercledesvoyageurs.com/
17:01:44 <dsinger> at 7:30
17:02:00 <dsinger> http://maps.google.be/maps?f=q&source=s_q&hl=fr&geocode=&q=Le+Cercle+Des+Voyageurs,+Bruxelles&sll=50.805935,4.432983&sspn=2.457846,5.163574&ie=UTF8&hq=Le+Cercle+Des+Voyageurs,&hnear=Bruxelles,+Région+de+Bruxelles-Capitale&ll=50.848792,4.348311&spn=0.009592,0.02017&z=15&iwloc=A
17:02:56 <tedleung> tedleung has joined #dnt
17:04:09 <KevinT> KevinT has joined #dnt
17:08:22 <mischat> mischat has joined #dnt
17:40:42 <schunter> schunter has joined #dnt
17:41:48 <KevinT> KevinT has joined #dnt
17:44:27 <tedleung> tedleung has joined #dnt
17:50:39 <fielding> fielding has joined #dnt
18:21:04 <aleecia> aleecia has joined #dnt
20:37:59 <test> test has joined #dnt
20:38:26 <test> q+
20:38:33 <test> q-
20:41:01 <test> show agendq
20:41:04 <test> show agenda
21:04:44 <dwainberg> dwainberg has joined #dnt
21:12:19 <KevinT> KevinT has joined #dnt
21:21:03 <tedleung> tedleung has joined #dnt
22:07:14 <KevinT> KevinT has joined #dnt
23:00:17 <npdoty> npdoty has joined #dnt
23:00:28 <npdoty> trackbot, end meeting
23:00:28 <trackbot> Zakim, list attendees
23:00:28 <Zakim> sorry, trackbot, I don't know what conference this is
23:00:31 <trackbot> RRSAgent, please draft minutes
23:00:31 <RRSAgent> I have made the request to generate http://www.w3.org/2012/01/24-dnt-minutes.html trackbot