In November 2012 experts from academia, industry, civil society and regulators met at the University of California, Berkeley, to discuss the status of the current work of the Tracking Protection Working Group (TPWG) on Do Not Track (DNT) as well as related and future standards initiatives. This workshop was an opportunity to take a step back from day-to-day standards work and to look at efforts from a higher level perspective.
See also: minutes from November 26th and November 27th.
Summary and key takeaways
The workshop was held at a time when the TPWG's Recommendation-track work was in full swing. The workshop reaffirmed the foundational assumption of a co-operative approach between the different stakeholders. It was apparent that a number of views were widely shared, about DNT:
- A key concern for current DNT work is to remain supportive of the "long tail" of the Web, including blogs and smaller Web sites.
- Do Not Track should consider the mobile context and the shift towards Web "apps".
... and about W3C work in privacy more generally:
- W3C standards (like most technical standards) tend to have policy implications, as they have architectural dimensions which interact with policy.
- There is a need for standards in further increasing transparency in privacy, such as improving privacy notices with supporting icons or reputation mechanisms.
- Client-side enforcement of privacy might evolve as a topic for further deliberation.
Areas of discussion
Introduction and policy
Chairs of the workshop (Nick Doty, W3C and Jan Schallaboeck, ICPP) asked for introductions around the room, along with the guiding question: What is, can and should be the role of standards in policy? Amsterdam researcher Frederik Borgesius (paper, slides) highlighted the regulatory framework in Europe.
Our discussion showed a variety of views but surprisingly little controversy on the topic. There was a common understanding that technical standards do impact areas of public policy and shape relevant practices. Consequently these implications need to be addressed, ideally when scoping the standard to avoid controversy during subsequent work. If regulation covers areas within scope, those regulations should be taken into account, as failing to do so may foster non-compliance or undermine decisions made by policy bodies with democratic legitimacy. Some concerns were raised (at the event and in position papers) over what process is best to address those public policy implications and whether technical standards processes are an appropriate venue.
Impacts
In the following session we raised the question: what impacts can Do Not Track and privacy standards have on the Web? David Wainberg, Network Advertising Initiative, (paper), highlighted the long tail and potential negative impact on business models of smaller or niche websites. Frank Wagner, Deutsche Telecom, (paper, slides), showed examples of the difficulties in opting out of tracking currently. Reed Freeman, ESPC, (paper), provided some context on email senders, supported having a forum for discussion but cautioned against expanding the scope of Do Not Track work too soon.
User Studies and User Concerns
To start our second day, we welcomed a panel to discuss research on users' privacy concerns. What can those studies tell us about user behaviors and how should we learn from them?
Chris Hoofnagle, (paper), presented an overview of surveys at Berkeley Law of what users want and expect, and a new project to establish a regular Web Privacy Census. Workshop participants have pointed out NAI's recently published compliance report as useful additional reading on current self-regulatory approaches. Pedro Leon and Blase Ur described work at Carnegie Mellon, (paper, slides), explaining users' understandings and misunderstandings of behavioral targeting and tracking and analyzing the usability (and un-usability) of existing opt-out and blocking tools. Max Kilger gave a different perspective via Experian's large national survey of privacy attitudes (paper). Finally, Berin Szoka (paper) raised questions about what we can gain from consumer surveys, given problems with economic allocations.
The afternoon of the second day saw discussion of tools, technologies and standards for online privacy. This was addressed from two perspectives: user control and transparency.
Tools for User Control
Discussion pointed to potential further research using privacy enhancing technologies to allow for better user control, while at the same time retaining valid business opportunities for advertising, including the "long tail". Mike Perry presented progress on Tor browsing, (paper, slides), while Nicholas Weaver demonstrated the Priv3 plugin for controlling social plugin cookies, (paper). Joe Hall from the Center for Democracy & Technology discussed the UI implications for user agents (paper). Cookie management and blocking tools may provide less discretion to online services in their use of online behavioral data, but also don't require the same level of consensus among all stakeholders.
Mechanisms for Transparency
In the area of transparency two different approaches were presented. Mark Lizar and Ashkan Soltani, presenting the Open Notice project (paper, Mark's slides, Ashkan's slides), gave an introduction to the various activities underway to facilite understanding privacy policies, asking for standards in the area of communicating reputation information on such policies. We heard support in the room for improving on past privacy policy standardization efforts, perhaps in the area of icons or short notices.
On the other hand, Mark Frigon, IBM, (paper, slides) proposed a somewhat complementary standardization proposal: By reorganizing the way in which personal data are shared between different Web applications, more structured data sharing might facilitate improved privacy management. The following discussion welcomed the effort, but also highlighted the need to include work on defining access control through technologies like sticky policies directly attached to the data in question.
Future Directions
How should we chart our future work for privacy, standards and the Web? Frank Dawson of Nokia described a process of Specification Privacy Assessment throughout the lifetime of a specification or piece of software (paper, slides); a process under consideration by the W3C Privacy Interest Group (PING). The PING co-chairs, Christine Runnegar and Tara Whalen, discussed ongoing work items and presented questions to consider, among others: what privacy design principles make sense for the Web?, how do we make sure privacy concerns are raised early?, how should privacy reviews be conducted?
Thomas Roessler of W3C gave us a wrap-up summary (slides) and we heard last thoughts around the room, about the values of discussion, the strengths and weaknesses of different fora, and what we can learn from past and present efforts.
We would like to thank all the attendees again for their participation. Our diverse community — researchers, developers and lawyers within advocacy, industry and academia — benefits not only from sharing ideas but also from understanding each other's positions.
— Nick Doty, W3C; Jan Schallaböck, ICPP
Reactions
Blog post reactions we've seen in response to the workshop discussions are included below. (If you have links to add, please let us know.)