16:58:41 RRSAgent has joined #DNT 16:58:41 logging to http://www.w3.org/2013/03/06-DNT-irc 16:58:57 peterswire has joined #dnt 16:59:20 phildpearce has joined #dnt 16:59:55 Wileys has joined #dnt 17:00:01 moneill2 has joined #dnt 17:00:17 Joanne has joined #DNT 17:00:23 jchester2 has joined #dnt 17:00:49 ninjamarnau has joined #dnt 17:00:49 dwainberg has joined #dnt 17:00:52 zakim, [ipcaller] is me 17:00:52 sorry, moneill2, I do not recognize a party named '[ipcaller]' 17:00:58 zakim, mute me 17:00:58 sorry, jchester2, I don't know what conference this is 17:01:10 David_MacMillan has joined #dnt 17:01:32 Oh No. We have driven Zakim crazy. Maybe it has taken a position on the Charter! 17:01:37 Zakim, this is dnt 17:01:37 ok, Yianni; that matches T&S_Track(dnt)12:00PM 17:01:37 peterswire, the Adobe folks (including me) are all at the Adobe Summit (digital marketing convention) today and unable to join by phone. 17:01:40 + +1.415.920.aagg 17:01:44 zakim, [IPCaller] is me 17:01:45 +moneill2; got it 17:01:48 johnsimpson has joined #dnt 17:01:50 Zakim, who is here? 17:01:50 On the phone I see +1.703.740.aabb, +1.703.861.aaaa, +1.540.822.aacc, +1.650.787.aadd, Joanne, dwainberg, moneill2, WileyS, jchester2, Yianni, +1.301.365.aaee, +49.431.98.aaff, 17:01:53 ... +1.415.920.aagg 17:01:53 On IRC I see johnsimpson, David_MacMillan, dwainberg, ninjamarnau, jchester2, Joanne, moneill2, Wileys, phildpearce, peterswire, RRSAgent, Zakim, Richard_comScore, jeffwilson, 17:01:53 ... Yianni, justin, fielding, robsherman, JamesB, efelten, rigo, schunter 17:01:56 zakim, aabb is robsherman 17:01:56 +robsherman; got it 17:01:56 zakim, mute me 17:01:57 Yianni should now be muted 17:02:01 + +44.772.301.aahh 17:02:01 +??P12 17:02:04 dan_auerbach has joined #dnt 17:02:07 anyone willing to scribe? 17:02:17 zakim, aaaa is jeffwilson 17:02:17 +jeffwilson; got it 17:02:33 zakim, aaff is ninjamarnau 17:02:37 +ninjamarnau; got it 17:02:38 Chris_IAB has joined #dnt 17:02:42 sidstamm has joined #dnt 17:02:52 just joined via phone from a blocked number 17:03:00 +[Mozilla] 17:03:03 Zakim, Mozilla has sidstamm 17:03:03 +sidstamm; got it 17:03:05 + +1.917.974.aaii 17:03:11 zakim, aaii is justin 17:03:11 +justin; got it 17:03:28 +johnsimpson 17:03:40 hefferjr has joined #dnt 17:04:10 +hefferjr 17:04:30 -hefferjr 17:04:32 + +1.202.681.aajj 17:04:42 npdoty has joined #dnt 17:04:54 zakim, code? 17:04:54 the conference code is 87225 (tel:+1.617.761.6200 sip:zakim@voip.w3.org), rigo 17:05:03 rrsagent, make logs public 17:05:05 +hefferjr 17:05:16 +Chris_Pedigo 17:05:21 hefferjr, can you scribe for us, Ronan? 17:05:27 ChrisPedigoOPA has joined #dnt 17:05:27 BerinSzoka has joined #DNT 17:05:31 scribenick: hefferjr 17:05:32 +??P49 17:05:41 zakim, ??P49 is Rigo 17:05:41 +Rigo; got it 17:05:47 vincent has joined #dnt 17:05:49 zakim, mute me 17:05:49 Rigo should now be muted 17:05:55 Chapell has joined #DNT 17:06:10 + +1.650.465.aakk 17:06:14 ack yianni 17:06:30 swire: Before going into the substance, Nick Doty, can you tell us about the face-to-face in May? 17:06:54 doty: looking a hosting option in CA bay area for 2-3 days in week of May 6 or May 13 17:07:07 just remember that May 12 is mother's day. some of us might be busy--the good sons and daughters, at least 17:07:11 npdoty, can you send a doodle around re those dates? 17:07:12 aleecia has joined #dnt 17:07:15 +Susan_Israel 17:07:25 + +1.949.483.aall 17:07:26 doty: hope to have more details soon 17:07:47 susanisrael has joined #dnt 17:07:47 +1 on the Doodle idea! 17:08:10 +Aleecia 17:08:20 I suggest NOT doing this on the 13th or 10th 17:08:25 doty: if we have multiple hosting options, will send a Doodle. 17:08:31 + +1.917.318.aamm 17:09:04 + +33.6.50.34.aann 17:09:08 ack ri 17:09:15 Zakim, mute me 17:09:15 Yianni should now be muted 17:09:22 swire: rigo will be attending meeting in Berlin this Mon-Tues, update 17:09:22 zakim, mute me 17:09:23 johnsimpson should now be muted 17:09:28 zakim, aann is vincent 17:09:28 +vincent; got it 17:09:32 zakim, aamm is chapell 17:09:32 +chapell; got it 17:09:51 rigo: have 22 registrations for meeting, some who announced participation won't be able to attend due to lack of time, including Berlin DPA 17:09:57 tedleung has joined #dnt 17:10:03 to repeat on IRC, the weeks we're looking at are May 6th-10th and (perhaps less ideal) May 13th-17th 17:10:07 + +1.609.258.aaoo 17:10:09 will there be a phone bridge? 17:10:13 Zakim, aaoo is me 17:10:13 +efelten; got it 17:10:40 ... I'm following up with tentative offers, but I would love to follow up with people who might know organizations in the SF Bay Area that could provide hosting 17:10:44 +TedLeung 17:10:44 rigo: negotiating with Peter Shaw? to get a DPA collaborator. have a pretty good mix of industry. everyone is expecting Rob to report back to the other DPAs. hosting is in German Telekom labs outside of Berlin. 17:10:49 http://www.w3.org/2011/tracking-protection/130311-gloco.html 17:11:02 ... and let me know (npdoty@w3.org) if there are common meeting conflicts you know of 17:11:25 rigo: if any feedback on agenda, please notify me. Discussion ongoing about goals. 17:11:37 will there be a phone bridge to berlin? 17:11:45 yes 17:11:45 Vinay has joined #dnt 17:11:46 s/Peter Shaw/Peter Schaar 17:12:24 swire: circulated all links and defintions about service provider and first party, this morning. i've been struck by how related these three definitions are. one of them is the definition of first party. Justin and Heather have been working to get the barebones draft on the website. 17:12:39 amyc has joined #dnt 17:12:45 johnsimpson, the agenda page notes that there will be a dial-in option, and we'll need to update more closely on the exact phone number (we can probably use this regular conference code) 17:12:46 +[Microsoft] 17:13:44 swire: I think the langauge that has been discussed, Some folks have views that the text is hard to verify (user intent). The definition was in the materials that Rob (Microsoft?) posted. 17:14:38 swire: In many websites there is only one party the users intend to interact with, but some sites the users expect to interact with multiple parties. "Reasonably expect" definition. 17:15:02 Zakim, who is on the phone? 17:15:02 On the phone I see robsherman, jeffwilson, +1.540.822.aacc, +1.650.787.aadd, Joanne, dwainberg, moneill2, WileyS, jchester2, Yianni (muted), +1.301.365.aaee, ninjamarnau, 17:15:05 ... +1.415.920.aagg, +44.772.301.aahh, ??P12, [Mozilla], justin, johnsimpson (muted), +1.202.681.aajj, hefferjr, Chris_Pedigo, Rigo, +1.650.465.aakk, Susan_Israel, +1.949.483.aall, 17:15:05 ... Aleecia, chapell, vincent, efelten, TedLeung, [Microsoft] 17:15:05 [Mozilla] has sidstamm 17:15:15 swire: there are additional details that Rob has proposed. Laura Gelman? expressed concern about too broad a loophole. 17:15:53 s/Laura/Lauren 17:16:24 http://lists.w3.org/Archives/Public/public-tracking/2012Nov/0076.html was me giving up in this discussion 17:16:36 Zakim, aadd is bscannell 17:16:36 +bscannell; got it 17:16:41 swire: third issue that is related gets back to issue of service provider or third party. in one case, they are operating a site jointly and there are 2 first parties. in other cases there is one operator with help from a data processor. 17:17:58 swire: to highlight what Chris did, he added a useful term "business associate" for one who has contracted to provide service. this is similar to HIPPA. non-normative language says that data can be used by service provider for "proper management" of the service (again, taken from HIPPA). 17:18:13 I am 540-822-xxxx 17:18:23 + +1.215.480.aapp 17:18:47 Zakim, aacc is Richard_comScore 17:18:47 +Richard_comScore; got it 17:18:49 WaltM_Comcast has joined #DNT 17:18:50 Chris_IAB has joined #dnt 17:18:57 swire: how do we let the data processor run its business, but still have the safeguards that the group wants to have in place? 17:19:24 Zakim, who is making noise? 17:19:25 q? 17:19:35 npdoty, listening for 10 seconds I heard sound from the following: +1.301.365.aaee (79%) 17:19:55 yes: I`m calling from +44.772 17:20:02 swire: definition of first party is important in our document and sometimes organizations want to have more than one first party. having first-party status has certain advantages under the spec and having multiple first-parties could be a loophole or it could just be normal operation. 17:20:11 Zakim, aaee is peterswire 17:20:11 +peterswire; got it 17:20:12 swire: we need a clear definition of roles. 17:20:14 q/ 17:20:17 q? 17:20:18 Zakim, aahh is phildpearce 17:20:18 +phildpearce; got it 17:21:04 swire: Rob Sherman, briefly explain proposal and then have Justin explain concerns. 17:21:45 Sherman: this issue goes into the text from Jonathan Mayer. i don't feel strongly about the specific formulation. i think we should get this right and talk about general purpose. 17:22:15 sherman: the intent is not to say that every website has multipel first parties and that putting a logo on a website creates a first-party relationship. 17:22:28 Zakim, aall is probably JamesB 17:22:28 +JamesB?; got it 17:22:40 q? 17:22:58 att.yahoo.com 17:23:08 sherman: when there are mulitple operators of a site, we need to be able to express that. another example is Yahoo! and AT&T where Yahoo! provides functionality for AT&T customers. both privacy policies are on the website. 17:23:49 sherman: we need to be able to accommodate that example where both companies are present. a lot of what i heard in the email list were edge-cases, but we need to be able to figure out the basic concept. 17:24:02 What does it mean for a company to "be present 17:24:10 sherman: my suggestion is that we start with the broader concept, and then the edge cases. 17:24:12 "… on a site? 17:24:25 but I wonder how I can tell Facebook not to collect data while interacting with Macey's 17:24:29 AnnaLong has joined #dnt 17:24:30 +AnnaLong 17:25:09 justin: i don't love the idea of multiple first-parites, so I responded with language that tried to carve-out that Yahoo!/AT&T example. the platform example is a different question, like facebook.com/macys. 17:25:35 Is Adrian ok with this or does MSFT want to follow a traditional approach? We should keep the same across both docs. (I favor the multi-first, if we can work out details) 17:25:51 Rigo, I disagree - its not a simple matter to allow multiple 1st parties technically and brands do NOT want to be disintermediated with their users from a business perspective. 17:26:19 justin: this doesn't mean that there is no communication between parties. the platform is the first-party and the content-generator provides the content. privacy policies and branding don't really help here. I tried to carve-out something really specific, but it still needs some work. 17:26:39 q+ 17:27:06 swire: it helps to figure-out the data flows before working on language. let's try to understand the example where there is one first party or two first parties. 17:27:08 q? 17:28:13 swire: on facebook, facebook gets to measure what the user is doing on their site. in the US, facebook has a lot of latitude to share that information with Macy's (under their privacy policy). if there are limits on that, in that business relationship, Macy's would be blocked unless they have first-party status. 17:28:33 In this case, if Macy's has a business relationship with FB, what access to data does it get? 17:28:42 swire: what would facebook's general privacy rules be about sharing that data with Macy's? 17:28:45 samsilberman has joined #dnt 17:29:28 I'm fine with aggregate analytics going to the party that uses the platform, and the std wouldn't prohibit 17:29:35 the hosting provider is probably a classic service provider relationship, right? 17:29:56 One would hope 17:29:57 fb: whatever privacy policies apply dictate the practice. our practice would be to provide aggregate analytics about the users on their page. we would not be providing user-level information to Macy's. even on facebook, users expect that when they go to Macy's page, they expect that they are interacting with Macy's 17:29:58 Wileys, we still miss the control - tool for users in case they want to give Information to Macey's but not to Facebook 17:30:10 (who was speaking from facebook?) 17:30:22 Rob Sherman 17:30:25 I don't think this provides the granular info we need on Macy/FB data flows, including when it involves offline/online purchasing data for subsequent targeting. 17:30:30 peterswire, what if Macey's is my first party I want to interact with? 17:30:43 s/fb:/robsherman:/ 17:31:02 npdoty, i think if you have a hosting provider with no visible brand, merely hosting on behalf of the publicly disclosed first party, then yes, the hosting provider would be a service provider, I think. 17:31:13 swire: until the user actually click to go to Macy's site to make a purchase, they would not expect to interact with Macy's. if Macy's were also a first-party then something that would be different. 17:31:14 +q 17:31:17 Users have no idea that they would be subject to extensive and different data collection regimes. 17:31:23 You don't need multiple first parties for that. FB's terms as the sole first party dictates. 17:31:33 sherman: when the user is on the Macy's page, there is an expectation that the user would know that. 17:31:36 jmayer has joined #dnt 17:31:48 susanisrael, right. and in fact, even if I could include the logo of my hosting provider in the footer of my page, I consider them a service provider, not an independent first party with which visitors are intentionally communicating 17:31:51 swire: if we label Macy's as a first-party then they get user-leve 17:32:05 +Jonathan_Mayer 17:32:09 -JamesB? 17:32:10 sherman: if you go to Macy's page and comment or like, Macy's would be able to see user-level info on thoat 17:32:13 q? 17:32:15 It doesn't matter if they're a first party. 17:32:24 q? 17:32:28 +??P74 17:32:34 robsherman was describing the current state of Facebook functionality there 17:32:38 ack Chris_IAB 17:32:52 npdoty, I agree 17:32:52 +q 17:32:54 zakim, unmute me 17:32:54 jchester2 was not muted, jchester2 17:32:56 laurengelman has joined #dnt 17:33:00 q? 17:33:26 chrismaheia: we are trying to find a definition for first-party that is dependent on our definition of service provider. a chicken-and-egg problem. we have to think about service providers with respect to first-party. cannot silo the definitions. have we nailed-down service provider? 17:33:28 Also, to be clear, Facebook is *not* Macy's service provider in my scenario. Or if they are, it doesn't matter, since Macy's is a third party . . . 17:33:47 once again, if we don't define what tracking is then this entire discussion about what the user wants is meaningless. 17:33:52 swire: i agree. in the memo from this morning I stacked the definitions for first-party, multiple-first-party, and service provider. 17:34:05 tedleung1 has joined #dnt 17:34:34 fielding, on FB there is no tracking, ever, as there is always a first party 17:34:56 swire: if Macy's is a service provider for facebook or facebook is a service provider for Macy's then there would be something that would surprise business people and facebook would silo the data (or Macy's would), and the service provider would be limited in how to use the data. 17:35:06 Rigo, there is tracking. We just don't care under DNT 17:35:17 q? 17:35:26 swire: i think one of the companies would be considered a third-party, since neither would be a service provider under our current def. 17:36:12 I think Roy is at least as interested in scope as a definition of tracking. 17:36:18 ack efelten 17:36:20 sherman: could be multple roles at the same time. someone who has come to facebook and viewed (or clicked) on a Macy's ad, they have interacted with Macy's so facebook could be considered a service provider for Macy's, but they are still a first-party 17:36:25 q? 17:36:31 s/sherman/Chris_IAB/ 17:36:41 i you don't define what it means, telling me that it exists or not is pointless -- I can't tell you what we do (or not) without a concrete definition. 17:36:48 ack Chris_IAB 17:37:09 felton: user expectations about who they are interacting with is a big part of the definition and it is important to think about when the user forms that expectation. does the user form the expectation when they click on an ad? data collection has already happened before that. 17:37:29 efelten: What happens with a URL that doesn't mention the name of *any* entity? 17:37:33 s/felton/efelten/ 17:38:06 Ed - this is the same issue with the ePrivacy Directive - how do you request consent prior to a page load? this is why most countries have moved to "informed consent" where branding, transparency, and notice achieve the desired outcome. 17:38:20 I think we assume the resulting page is the first party even if the URL was masked for the user (a href="http://firstparty.org">click here 17:38:36 felton: if you use a URL to go to facebook.com it is clear that you are interacting with facebook. a "like" button is also clear. the second point is about how the parts of the standard disclosing back to the user would work. we have the well-known URI with first-party/third-party. how would that work if there are multiple first parties? there is not necessarily a URL where the UA would know to look. 17:38:42 s/felton/efelten/ 17:38:54 q? 17:39:10 felton: this is both TPE and compliance spec. the compliance spec talks about what it means to say that you are a first-party. 17:39:15 s/felton/efelten/ 17:39:24 npdoty: I didn't mean the HTML anchor but the URL itself. What if the Washington Post ran a website called www.news.com? 17:39:35 sherman: does addding first parties as a concept require a change to TPE? 17:39:43 s/sherman/peterswire 17:39:48 Ed and Peter - I don't believe so - as being 1st party means you can simply ignore the DNT header 17:40:07 efelten: yes, it wouldn't be clear to the UA to go to Macy's to get URI. 17:40:10 You cannot ignore. You still ack. 17:40:15 I think it would require a change; the tracking status resource currently indicates the first party 17:40:20 And cannot share 17:40:31 Aleecia - Ack is fair 17:40:46 Aleecia - and the Ack would state 1st party 17:40:46 efelten: we need to think more broadly about how user exceptions work. we need to make sure that we don't break anything in the standard. 17:41:06 +q 17:41:16 q+ 17:41:22 Yes -- ok, you're doing shorthand for "ignore" and not literal. That's fine, we agree 17:41:41 q+ to comment on the current state of TPE 17:41:42 swire: if we want to have multiple first-parties it sounds like there is a way to fit this together with TPE. is there anyone who wants to take on that task (who supports having multiple first parties)? 17:41:44 Peter - Shane raises hand 17:41:55 ack Yianni 17:42:11 q- - 17:42:18 q- peter 17:42:32 ack npdoty 17:42:32 npdoty, you wanted to comment on the current state of TPE 17:42:49 doty: current state of the TPE contains an array for first-pary in case there are multiple parties claiming to be first party. the tracking status resource from facebook would need to indicate Macy's as another first-party. 17:42:52 The tracking status resource only indicates which set of requirements are being complied with -- no server can tell you whether a given interaction was invoked in a first party context. 17:43:11 Ed - can be used either way 17:43:12 Yes, as I u dersatnd 17:43:13 efelten: does that not indicate that all parties follow the same policy? 17:43:53 efelten: it is important to provide accurate compliance information. is facebook responsible for providing information about Macy's policy? 17:44:07 doty: facebook would have to update the tracking status resource to indicate the other sites. 17:44:19 question: wouldn't the tracking status resource array on Facebook's site be giant, if it has to have information about ALL Macy's-like Facebook pages 17:44:20 efelten: i think you break that well-known URI scheme 17:44:29 q- shane 17:44:32 ack wileys 17:44:32 let me know when you want me to take over scribing Ronan 17:44:39 q? 17:44:50 agree with efelten, that it could be complicated 17:45:24 Joanne 17:45:24 Zakim, mute Yianni 17:45:24 Yianni should now be muted 17:45:40 shane: i was going to make similar comments to Nick, we put in the spec to accommodate multiple first parties. we might need to indicate multiple resources (change). 17:45:44 WileyS: go back to TPE and look at this 17:46:02 shane: it is also worth going through compliance spec to find instances of assuming that there is one first party. 17:46:05 Don't think that's a problem in compliance, but I could be wrong. 17:46:09 Efelten: worth going back through compliance spec to make sure we are not msissing casess 17:46:25 Sounds good - thanks. 17:46:34 swire: Rob, Ed, and Shane should work on this. 17:46:36 action: Shane to review TPE for updates necessary on multiple first parties (with Ed, Nick, RobS, possibly fielding) 17:46:36 Created ACTION-375 - Review TPE for updates necessary on multiple first parties (with Ed, Nick, RobS, possibly fielding) [on Shane Wiley - due 2013-03-13]. 17:46:37 I'd like to be involved 17:46:37 peterswire: thank you Shane for leading. Nick, Ed, and Rob to stay in close touch (may have missed some names here) 17:46:51 ...nick to assign action item. timeframe? 17:47:01 action-375 due 3/18 17:47:01 Set ACTION-375 Review TPE for updates necessary on multiple first parties (with Ed, Nick, RobS, possibly fielding) due date to 3/18. 17:47:06 wileys: 2 weeks due to number of folks involved 17:47:14 swire: 2-weeks but due on COB Monday (EST) so that people can review before the Wed meeting. 17:47:27 shane, i'd like to be in volved 17:47:29 Peterswire: would like it by COB Monday to give people time to read prior to call 17:47:40 q? 17:47:49 WileyS; will let group know if can;t meet timeframe 17:47:56 I would prefer to do more work on our mailing list. 17:47:58 efelten, do you want to take an action to review compliance spec for assumptions on single first party? /cc justin 17:48:10 John - please send me an email reminder and I'll include you in the email string. Note - I'm focused on the TPE side of the equation - NOT the compliance doc side. 17:48:27 action-375: loop in johnsimpson 17:48:27 Notes added to ACTION-375 Review TPE for updates necessary on multiple first parties (with Ed, Nick, RobS, possibly fielding). 17:48:30 chester: I think this discussion is helpful, but for user expectations there are distinct practices (data collection). One would not be aware of the facebook vs Macy's practices. Users interacting with widgets, we need to examine if users are induced to do so. 17:48:33 q? 17:48:35 zakim, mute me 17:48:35 jchester2 should now be muted 17:48:38 ack jchester 17:48:38 q+ 17:48:47 Zakim, mute jchester2 17:48:47 jchester2 should now be muted 17:48:48 JeffChester: discussion helpful. need to take user expectations into account. when interacting with widgets because they may be induced to do so and may not be aware of party's data collection practices 17:48:49 zakim, mute me 17:48:49 jchester2 was already muted, jchester2 17:49:33 sherman: it sounds like there are 2 buckets, combining the various comments. in the easier case, there are 2 companies providing the website. the other is the "platform" case. i am happy to work off-list. 17:49:37 RobSherman: suggest path forward. sounds like 2 buckets. easier cases of two companies to provide one site and then the platform case. will work with Justin on this 17:49:50 Peterswire: will COB Monday ET work 17:49:52 swire: Mon COB deadline for that also 17:49:55 RobSherman: yes 17:50:22 action: sherman (with justin) to propose updates on multiple first parties (distinguishing between the one site and platform) 17:50:22 Created ACTION-376 - (with justin) to propose updates on multiple first parties (distinguishing between the one site and platform) [on Rob Sherman - due 2013-03-13]. 17:50:42 q+ 17:50:51 action-376 due 3/18 17:50:51 Set ACTION-376 (with justin) to propose updates on multiple first parties (distinguishing between the one site and platform) due date to 3/18. 17:50:57 swire: incentive effects: today we have the web where there are multiple first-parties. in the future, under the spec, people might have an incentive to build multiple first parties to gain rights under the spec. how would these propsals create a compliance "trick"? 17:51:02 is there unfair advantage for FB company pages compared to a normal web scenario? 17:51:04 yes, thanks. 17:51:10 ack robsherman 17:51:15 scribenick: Joanne 17:51:25 Peterswire: descrbie incentive effect. people could get first party status if they do a, b, and c. How can proposal change incientive to gain first party status. Answer the question what is the incentive effect down the line 17:52:25 +1 - as I stated earlier, business dynamics resist multi-1st party scenarios 17:52:27 publishers let hundreds and hundreds of players in the advertising chain cookie their site now 17:52:42 Chris P; if I am pub, pubs may not allow third party to become first party because it may devalue first party. first party may be incentivized to push down third parties 17:52:42 q? 17:52:51 ack ChrisPedigoOPA 17:53:05 we can't develop a spec based on what publishers might do. Given the extensive data collection practices of publishers, working closely with major data providers, this is a serious issue. 17:53:08 Chris P: members incorporating cntract lang to limit what third parties can do 17:53:09 Yes, YouTube has an interest in not letting Fox get all their data. So maybe they'll be forced to stop letting them offer such clearly branded pages? Is that the right result? 17:53:24 Chris P brings up an interesting, perhaps unintended, consequence: competition issues re DNT 17:53:29 ...rules of the road to keep 3rd party as a third party 17:54:03 Peterswire: Shane to lead TPE review and Justin to write lang on compliance side (Nick did I capture that correctly) 17:54:20 Topic: Service Provider 17:54:27 who is talking 17:54:32 ChrisPedigoOPA: 17:55:15 Chris: lthought about including data controleer but includes other bagge. business associate terms seemed to work well there 17:55:25 Nick - wouldn't you have FB ack as first and Macy's ack as first, rather than share an array? 17:55:46 aleecia, I think there's only a single tracking status resource for a single HTTP response 17:55:48 *Joanne, Chris Pedigo is talking 17:55:59 ...included sentence data processors may merge and use data for fruad prevention and want to allow for that 17:56:15 q? 17:56:23 ...non-normative text refernce back to those allowances are allowed under existing laws today 17:57:01 Peterswire: to clarify. third party langauge has been deleted. Chris' email version correct. Memo version incorrect 17:57:31 And cached data was the issue for well-known URI. Hm. Is that likely a big issue here? (I fear yes) 17:57:33 q+ 17:57:43 not all associates are businesses, right? 17:57:57 ...pleads guilty to intro to business assicoate term. afraid it doesn't work. in HIPAA world - means service provider and its upside down for DNT context 17:58:23 ...don't want to use controller due to legal baggage. nedd to continue to look for right term 17:58:35 q? 17:58:37 aleecia, if who-is-within-the-first-party varies by response, the server will have to forgo caching in some cases 17:58:41 ack rigo 17:58:50 ..David W has open action item on de-bugging polus data security. Has two weeks versus one week 17:59:11 - +1.202.681.aajj 17:59:24 was "contracting party" suggested by Peter? 17:59:42 Rigo: we create more baggage, complexity for maybe political reasons becuase we turn explantory text into normative text. thinks Dsinger text is better 17:59:53 "counter party" often used in financial and other settings -- the other party to a contract 18:00:13 ...(not catching Rigo's point) 18:00:48 rigo, I think the idea is that the service provider cannot use the data on its own 18:00:57 rigo, do you have a link to text from dsinger on this? 18:01:03 Justin, answering your earlier question, yes - one outcome could be YouTube limiting Fox's ability to get data. 18:01:27 will fit better into political discussion and with advocates. 18:02:00 Rigo - can you provide link to David Singer's text? 18:02:29 Dynamic per-resource tracking status is already supported in TPE when it is needed. We can't cache any better than the complexity of how the server is implemented to adhere to DNT. 18:02:29 Rigo - so you agree that a Service Provider is granted the same Permitted Uses as a 3rd party, correct? 18:02:55 ....service provider can do security stuff but not permitted use 18:02:59 Nick would it be possible to just have multi-first party go with known URI? 18:03:09 peterswire: similar to EU law? 18:03:10 chrispedigoopa, isn't the better answer saying YT is the first party, and then they can set the terms for data sharing on their platform? 18:03:36 Rigo: huge difference. I can work on your behalf and still use what I did on your behalf for my own purposes 18:04:08 q? 18:04:15 Peterswire: what about routine maitenance and run there operations as allowed under HIPAA. current lang does not support this 18:04:26 I've forgotten by now why and when caching broke known URIs, despite having written about it, but it's been going on two years 18:04:52 aleecia, I believe we're discussing multiple first parties for a single HTTP request/response; there will only be a single tracking status resource for that response, which may be cached (if it's the same for all responses on that server) or not 18:04:54 Justin, under that scenario, the two parties could not share data without violating DNT 18:05:03 Rigo: that needs to be clarified. every party ahas duty to keep data secure. we all agree that service provider should not use data for its own purposes. only as dictated by first party 18:05:26 "no own rights" is just not "working on behalf" 18:05:48 q? 18:05:53 Peterswire: I think we agree on that. but routinue actions won't be spelled out in contract. How can those be permitted under current lang 18:06:03 Need to allow flexibility for multiple first parties, while understanding that companies aren't going to be rushing out to do this because they don;t always want to share data 18:06:17 I disagree -- a service provider is the first party as far as our requirements are concerned as long as the data retention is siloed or deidentified. 18:06:45 ...suggest Peter, Rigo, and Chris P follow up on this to get to an approach 18:06:58 Rigo: yes, its a small clarification 18:07:20 action: ChrisPedigoOPA (with rigo, peterswire) to follow up on service provider and independent rights clarification 18:07:20 Error finding 'ChrisPedigoOPA'. You can review and register nicknames at . 18:07:29 action: pedigo (with rigo, peterswire) to follow up on service provider and independent rights clarification 18:07:29 Created ACTION-377 - (with rigo, peterswire) to follow up on service provider and independent rights clarification [on Chris Pedigo - due 2013-03-13]. 18:07:36 action-377 due 3/18 18:07:36 Set ACTION-377 (with rigo, peterswire) to follow up on service provider and independent rights clarification due date to 3/18. 18:07:42 chrispedigoopa, No, it depends on what the site has messaged to users and what they've agreed to. YT could certainly clearly message frictionless sharing of passive site activity. Quora does that today, I think, and some of the social reading apps on FB. 18:07:43