16:53:33 RRSAgent has joined #dnt 16:53:33 logging to http://www.w3.org/2014/01/08-dnt-irc 16:53:35 RRSAgent, make logs world 16:53:37 Zakim, this will be TRACK 16:53:37 ok, trackbot; I see T&S_Track(dnt)12:00PM scheduled to start in 7 minutes 16:53:38 Meeting: Tracking Protection Working Group Teleconference 16:53:38 Date: 08 January 2014 16:54:05 chair: cargill, justin, schunter 16:55:59 fielding has joined #dnt 16:56:40 Chris_IAB has joined #dnt 16:57:36 T&S_Track(dnt)12:00PM has now started 16:57:43 +npdoty 16:57:44 +??P5 16:57:57 zakim, call ninja-mobile 16:57:57 ok, ninja; the call is being made 16:57:58 +Ninja 16:58:00 WaltMichel has joined #DNT 16:58:16 I just joined via a private number 16:58:28 +WaltMichel 16:58:35 Zakim, ??p5 is Chris_IAB 16:58:35 +Chris_IAB; got it 16:58:45 zakim, call ninja-mobile 16:58:45 ok, ninja; the call is being made 16:58:47 +Ninja.a 16:58:49 +Jack_Hobaugh 16:58:51 dwainberg has joined #dnt 16:58:53 +RichardWeaver 16:59:05 Richard_comScore has joined #dnt 16:59:16 +Wendy 16:59:17 +[Apple] 16:59:23 -Ninja 16:59:23 zakim, [apple] has dsinger 16:59:24 +dsinger; got it 16:59:28 WileyS has joined #dnt 16:59:36 zakim, agenda? 16:59:36 I see 9 items remaining on the agenda: 16:59:37 1. Confirmation of scribe. Volunteers welcome! [from ninja] 16:59:37 2. Offline-caller-identification [from ninja] 16:59:37 3. ISSUE-153 What are the implications on software that changes requests but does not necessarily initiate them? http://www.w3.org/2011/tracking-protection/track/issues/153
 16:59:37 ... http://www.w3.org/wiki/Privacy/TPWG/Proposals_on_limitations_for_add-ons [from ninja] 16:59:39 4. ISSUE-151 User Agent Requirement: Be able to handle an exception request http://www.w3.org/2011/tracking-protection/track/issues/151 16:59:39 ... http://www.w3.org/wiki/Privacy/TPWG/Proposals_on_UA_requirement_to_handle_exceptions [from ninja] 16:59:39 5. ISSUE-240 Definition of context https://www.w3.org/2011/tracking-protection/track/issues/240 http://www.w3.org/wiki/Privacy/TPWG/Proposals_on_the_definition_of_context [from 16:59:39 Ari has joined #dnt 16:59:40 ... ninja] 16:59:43 6. ISSUE-239 Should tracking status representation include an array of links for claiming compliance by reference? http://www.w3.org/2011/tracking-protection/track/issues/239 [from 16:59:43 ... ninja] 16:59:43 7. ISSUE-197 How do we notify the user why a Disregard signal is received? http://www.w3.org/2011/tracking-protection/track/issues/197 [from ninja] 16:59:47 8. Current status of TPE spec: Signals for internal / external usage of site elements (the signals formerly called "1" and "3") [from ninja] 16:59:47 9. AoB [from ninja] 16:59:54 +dwainberg 17:00:02 +Ari 17:00:12 -Ninja.a 17:00:14 +WileyS 17:00:19 +Peder_Magee 17:00:36 +ninja 17:00:40 +Fielding 17:00:50 +Carl_Cargill 17:00:58 eberkower has joined #dnt 17:01:00 justin has joined #dnt 17:01:09 <_538> _538 has joined #dnt 17:01:40 any volunteers to scribe? (we can split halves of the call, if it helps) 17:01:44 zakim, mute ninja 17:01:44 ninja should now be muted 17:01:46 +schunter 17:01:56 + +1.813.366.aaaa 17:01:58 +[CDT] 17:01:59 zakim, cdt has me 17:01:59 +justin; got it 17:02:03 zakim, who is on the phone? 17:02:03 On the phone I see npdoty, Chris_IAB, WaltMichel, Jack_Hobaugh, RichardWeaver, Wendy, [Apple], dwainberg, Ari, WileyS, Peder_Magee, ninja (muted), Fielding, Carl_Cargill, schunter, 17:02:06 ... +1.813.366.aaaa, [CDT] 17:02:06 [Apple] has dsinger 17:02:06 [CDT] has justin 17:02:10 Zakim, aaaa is eberkower 17:02:10 +eberkower; got it 17:02:32 Zakim, mute me please 17:02:32 eberkower should now be muted 17:02:35 moneill2 has joined #dnt 17:02:36 Brooks has joined #dnt 17:02:48 vinay has joined #dnt 17:02:48 Zakim, please choose a scribe 17:02:48 Not knowing who is chairing or who scribed recently, I propose dwainberg 17:02:54 Joanne has joined #DNT 17:03:11 bryan has joined #dnt 17:03:16 +Andrew_Kirkpatrick 17:03:20 +Bryan_Sullivan 17:03:22 Zakim, please choose a scribe 17:03:22 Not knowing who is chairing or who scribed recently, I propose Ari 17:03:44 zakim, Andrew_Kirkpatrick is vinay 17:03:44 +vinay; got it 17:03:50 Zakim, please choose a scribe 17:03:50 Not knowing who is chairing or who scribed recently, I propose Wendy 17:03:53 +[IPcaller] 17:03:54 +Joanne 17:04:09 hwest has joined #dnt 17:04:12 cOlsen has joined #dnt 17:04:13 kj has joined #dnt 17:04:23 +hwest 17:04:33 Zakim, please choose a scribe 17:04:33 Not knowing who is chairing or who scribed recently, I propose vinay 17:04:33 zakim, [ipcaller] is me 17:04:34 +moneill2; got it 17:04:48 Sure, I can do the first half and hand it off to Wendy 17:04:56 scribenick: vinay 17:05:01 johnsimpson has joined #dnt 17:05:10 +[Apple.a] 17:05:12 Zakim, Apple.a has me 17:05:12 ChrisPedigoOPA has joined #dnt 17:05:12 +hober; got it 17:05:12 susanisrael has joined #dnt 17:05:25 Zakim, agenda? 17:05:26 I see 9 items remaining on the agenda: 17:05:26 1. Confirmation of scribe. Volunteers welcome! [from ninja] 17:05:26 2. Offline-caller-identification [from ninja] 17:05:26 3. ISSUE-153 What are the implications on software that changes requests but does not necessarily initiate them? http://www.w3.org/2011/tracking-protection/track/issues/153
 17:05:27 ... http://www.w3.org/wiki/Privacy/TPWG/Proposals_on_limitations_for_add-ons [from ninja] 17:05:28 4. ISSUE-151 User Agent Requirement: Be able to handle an exception request http://www.w3.org/2011/tracking-protection/track/issues/151 17:05:28 ... http://www.w3.org/wiki/Privacy/TPWG/Proposals_on_UA_requirement_to_handle_exceptions [from ninja] 17:05:28 5. ISSUE-240 Definition of context https://www.w3.org/2011/tracking-protection/track/issues/240 http://www.w3.org/wiki/Privacy/TPWG/Proposals_on_the_definition_of_context [from 17:05:29 ... ninja] 17:05:31 6. ISSUE-239 Should tracking status representation include an array of links for claiming compliance by reference? http://www.w3.org/2011/tracking-protection/track/issues/239 [from 17:05:31 ... ninja] 17:05:31 7. ISSUE-197 How do we notify the user why a Disregard signal is received? http://www.w3.org/2011/tracking-protection/track/issues/197 [from ninja] 17:05:32 8. Current status of TPE spec: Signals for internal / external usage of site elements (the signals formerly called "1" and "3") [from ninja] 17:05:32 9. AoB [from ninja] 17:05:32 +hefferjr 17:05:33 Zakim, drop agendum 1 17:05:34 agendum 1, Confirmation of scribe. Volunteers welcome!, dropped 17:05:38 Zakim, drop agendum 2 17:05:39 agendum 2, Offline-caller-identification, dropped 17:05:48 ISSUE-153? 17:05:48 ISSUE-153 -- What are the implications on software that changes requests but does not necessarily initiate them? -- pending review 17:05:48 http://www.w3.org/2011/tracking-protection/track/issues/153 17:05:48 Zakim, take up agendum 3 17:05:48 agendum 3. "ISSUE-153 What are the implications on software that changes requests but does not necessarily initiate them? 17:05:50 ... http://www.w3.org/2011/tracking-protection/track/issues/153
 http://www.w3.org/wiki/Privacy/TPWG/Proposals_on_limitations_for_add-ons" taken up [from ninja] 17:05:50 +Chris_Pedigo 17:05:56 schunter1: first issue -- issue 153 17:06:07 vincent has joined #dnt 17:06:12 +SusanIsrael 17:06:13 +[FTC] 17:06:14 ... already have several proposals. today is the day to announce the CfO and pick one of the options 17:06:39 Justin: Brad reach out to him; Brad is working with singer to see if they can merge/come up with new language 17:06:43 ... has asked for another week 17:06:55 The links posted don't work 17:07:01 +q 17:07:12 hefferjr has joined #dnt 17:07:12 dsinger: exchanged some emails, but was inconclusive. singer is trying to find the emails 17:07:23 is Bryan on the call? 17:07:24 wileys: Brad is on vacation, but will put a draft to David when he's back for vacation 17:07:28 I suggested "A user-agent that permits an extension or plug-in to configure or inject a DNT header is jointly responsible, with the plug-in or extension, for ensuring that the rules are followed." but we are waiting for Brad 17:07:33 ... should be back and able to respond in time for next week's call 17:07:34 +Brooks 17:07:36 Brooks has joined #dnt 17:07:44 Justin: fine pushing it back a week in hopes of avoiding a CfO 17:07:56 +vincent 17:07:58 Thank you 17:08:02 ... will ping Brad on Monday about it 17:08:12 +johnsimpson 17:08:15 when will the draft text be shared? can it be shared with me in the meantime? 17:08:20 ... if the gap isn't bridged by next week, then we'll move to CfO 17:08:40 ShaneWiley has joined #dnt 17:08:55 ... if anyone else wants to be involved on the issue, let Singer or Brad know 17:08:59 http://www.w3.org/wiki/Privacy/TPWG/Proposals_on_UA_requirement_to_handle_exceptions 17:09:04 WileyS has joined #dnt 17:09:06 Justin: For issue 151, we have been static for a while 17:09:15 q+ to ask Bryan on consolidating proposals on 153 17:09:20 -q 17:09:43 -WileyS 17:09:46 npdoty: we've heard a couple proposals from Bryan; and that the first proposal is just the current text. Is that right? 17:10:09 bryan: its probably pretty close. will check offline (with npdoty) 17:10:50 I think listed Proposal 3 is the same as the Editors' Draft text, modulo editorial fixes 17:10:53 bryan: current text is a bit more wordy, but it says the same thing as Bryan's proposal 3 17:11:48 Justin: thanks to Shane and Jack for merging their proposals, there are now 2 options 17:11:54 one by john simpson, and one by shane/jack 17:11:55 robsherman has joined #dnt 17:12:01 s/now 2 options/now 3 options/ 17:12:02 +RobSherman 17:12:09 Going to start the CfO today 17:12:09 ... and the existing text 17:12:19 (got it -- thanks Nick!) 17:12:34 think the options are clear... 17:12:35 FPFJoeN has joined #dnt 17:12:46 no change is still an option, yes 17:12:48 ... Shane's existing text is no longer part of the CfO 17:12:56 but option 1 is the existing language in the draft 17:13:07 Zakim, agenda? 17:13:07 I see 7 items remaining on the agenda: 17:13:08 3. ISSUE-153 What are the implications on software that changes requests but does not necessarily initiate them? http://www.w3.org/2011/tracking-protection/track/issues/153
 17:13:08 ... http://www.w3.org/wiki/Privacy/TPWG/Proposals_on_limitations_for_add-ons [from ninja] 17:13:08 4. ISSUE-151 User Agent Requirement: Be able to handle an exception request http://www.w3.org/2011/tracking-protection/track/issues/151 17:13:12 ... http://www.w3.org/wiki/Privacy/TPWG/Proposals_on_UA_requirement_to_handle_exceptions [from ninja] 17:13:12 5. ISSUE-240 Definition of context https://www.w3.org/2011/tracking-protection/track/issues/240 http://www.w3.org/wiki/Privacy/TPWG/Proposals_on_the_definition_of_context [from 17:13:12 ... ninja] 17:13:15 6. ISSUE-239 Should tracking status representation include an array of links for claiming compliance by reference? http://www.w3.org/2011/tracking-protection/track/issues/239 [from 17:13:15 ... ninja] 17:13:15 7. ISSUE-197 How do we notify the user why a Disregard signal is received? http://www.w3.org/2011/tracking-protection/track/issues/197 [from ninja] 17:13:16 8. Current status of TPE spec: Signals for internal / external usage of site elements (the signals formerly called "1" and "3") [from ninja] 17:13:16 9. AoB [from ninja] 17:13:18 Zakim, close agendum 3 17:13:18 I see a speaker queue remaining and respectfully decline to close this agendum, npdoty 17:13:20 Justin: Issue 240 17:13:22 q? 17:13:23 q- 17:13:25 +FPFJoeN 17:13:25 Zakim, close agendum 3 17:13:26 agendum 3, ISSUE-153 What are the implications on software that changes requests but does not necessarily initiate them? 17:13:26 ... http://www.w3.org/2011/tracking-protection/track/issues/153
 http://www.w3.org/wiki/Privacy/TPWG/Proposals_on_limitations_for_add-ons, closed 17:13:26 I see 6 items remaining on the agenda; the next one is 17:13:26 4. ISSUE-151 User Agent Requirement: Be able to handle an exception request http://www.w3.org/2011/tracking-protection/track/issues/151 17:13:30 Zakim, take up agendum 5 17:13:30 ... http://www.w3.org/wiki/Privacy/TPWG/Proposals_on_UA_requirement_to_handle_exceptions [from ninja] 17:13:30 agendum 5. "ISSUE-240 Definition of context https://www.w3.org/2011/tracking-protection/track/issues/240 http://www.w3.org/wiki/Privacy/TPWG/Proposals_on_the_definition_of_context" 17:13:31 ... taken up [from ninja] 17:13:35 202-587 is me 17:13:36 Zakim, drop agendum 4 17:13:36 agendum 4, ISSUE-151 User Agent Requirement: Be able to handle an exception request http://www.w3.org/2011/tracking-protection/track/issues/151 17:13:38 ... http://www.w3.org/wiki/Privacy/TPWG/Proposals_on_UA_requirement_to_handle_exceptions, dropped 17:13:43 zakim, mute me 17:13:43 FPFJoeN should now be muted 17:13:54 Want clarifying language on context, since many (including one of the editors) is unclear on it 17:14:09 oh! nice. 17:14:13 Justin -- we could just define context as party and be done, but nobody proposed it 17:14:22 Mike and Rob both submitted language for context 17:14:29 ... alternatively, we could have it undefined 17:14:31 q+ to talk about context 17:14:49 +q 17:14:54 ack dsinger 17:14:54 dsinger, you wanted to talk about context 17:14:55 sorry, link is somehow broken - http://www.w3.org/wiki/Privacy/TPWG/Proposals_on_the_definition_of_context 17:14:56 ack ds 17:15:24 singer: we risk having confusion. we've thus far used context to distinguish between 1st party and 3rd party. Leaving it undefined may cause confusion 17:15:37 +1, we are overloading "context" by using it sometimes in different ways 17:15:41 q? 17:15:52 ack moneill 17:16:24 rvaneijk has joined #dnt 17:16:35 moneill: ambiguity over issue of multiple contexts. concern over 'data collected in a 3rd party context can still be collected in a 3rd party context.' (I'm not sure I got this right) 17:16:59 ... should have a definition of across multiple contexts 17:17:38 Justin: I was a little confused over your definition of context in a place where you can express consent. 17:17:59 q? 17:18:03 Zakim, who is making noise? 17:18:15 npdoty, listening for 11 seconds I heard sound from the following: Ari (12%) 17:18:28 WileyS has joined #dnt 17:19:13 moneill: we are not talking about parties, we are talking about context. and so the consent should be done in context. there is ambiguity when we're talking about things collected across multiple contexts (doesn't want things combined across unrelated contexts) 17:19:19 +rvaneijk 17:19:38 Sorry Nick, it should be on mute but let me try using a diff headset 17:20:02 adrianba has joined #dnt 17:20:21 Rob V: Wants to offer a user-centric definition. feels right now its too industry focused 17:20:33 +[Microsoft] 17:20:37 q? 17:20:38 zakim, [Microsoft] is me 17:20:38 +adrianba; got it 17:20:39 rvaneijk, I don't understand defining "context" in a way that includes permitted uses 17:20:50 q+ 17:21:11 q? 17:21:13 ack fielding 17:21:15 +WileyS 17:21:32 Roy: The way context is used here, its talking about the environment in which the user is making decisions 17:21:49 ShaneWiley has joined #dnt 17:22:00 ... hoping someone can further explain Rob V's definition. The proposal by Mike is the opposite of context in Roy's position 17:22:09 ... hoping for further discussion before a decision is made 17:22:11 I think there needs to be discussion on the mailinglist as well. 17:22:18 Tracking is the collection of data regarding a particular user's activity across multiple distinct contexts and the retention, use, or sharing of data derived from that activity outside the context in which it occurred. 17:23:01 -WileyS 17:23:24 +q 17:23:31 Justin: I believe context is used only in the definition of tracking. Is it used elsewhere, or does it impact other definitions? 17:23:36 q+ to ask if we can use party 17:23:38 ack mo 17:24:49 Mike: There should be some idea of context in the user's experience. trying to get across the idea of the user's relation 17:24:51 Contextual advertising is a form of targeted advertising for advertisements appearing on websites or other media, such as content displayed in mobile browsers. The advertisements themselves are selected and served by automated systems based on the content displayed to the user. http://en.wikipedia.org/wiki/Contextual_Advertising 17:24:58 ... we need to come up with something better than what we have 17:25:10 Justin: Roy's definition is narrower than the definition of party that we agreed to 17:25:16 isn't context well defined in prior art? 17:25:39 My proposal was "For the purpose of this definition, a context is a set of resources that share the same data controller, same privacy policy, and a common branding, such that a user would expect that data collected by one of those resources is available to all other resources within the same context." 17:25:49 ... it does require a degree of branding which helps for experience 17:26:41 Justin: I don't think we're trying to be that precise to keep experience to one page 17:26:42 Chris_IAB, that would be context as the content of a single page, right? 17:26:51 WileyS has joined #dnt 17:26:54 Chris M: Put in definition of contextual advertising (from google search) 17:27:17 ... to the port of the use case from the advertising perspective that its an ad served against the context of the content available to the user at that page 17:27:26 ... has nothing to do with historical record of context 17:27:37 +q 17:28:00 Justin: using that concept of context is more consistent with the rejected definition of tracking 17:28:16 -hwest 17:28:22 ... we're not trying to restrict what we generally think of as first party advertising 17:28:27 ack npd 17:28:27 npdoty, you wanted to ask if we can use party 17:28:32 Please note that "context" is a general term that is intended to fit many many use cases -- much like "set". Contextual is certainly based on the same notion, but that definition of contextual advertising is far more constrained than actual contextual ads. 17:28:47 npdoty: Roy's definition refers to party. Can we re-use the definition pf party? 17:28:49 +hwest 17:28:51 npdoty, that's correct 17:28:59 +WileyS 17:29:07 +1 to Nick: surely a context is at least 'a party' with maybe some extra text 17:29:13 q+ 17:29:16 no 17:29:20 q+ 17:29:22 +1 to nick 17:29:40 q? 17:29:46 +MECallahan 17:29:59 Roy: Our definition is limited. it avoids service providers and contractors vs employees 17:30:18 party already refers to "easy discoverability", "intends to interact", "context of a given user action" etc 17:30:29 Justin: Would that be solved if we revised party to add the concept of service provider in TPE? 17:30:31 mecallahan has joined #dnt 17:30:36 ... and doesn't require a new definition, or rely on data controller 17:31:20 Roy: Tried to do that for months but the group didn't go that way. There are valid reasons to keep corresponding party = legal entity; so context is needed to perform something similar. Although for context we're talking about user expectation 17:31:33 ... the user is browsing disney jr (for example), the user knows they're interacting with a disney site 17:31:55 ... may be questions on whether they're interacting with other disney sites. not claiming to know the answer to what a reasonable understanding is 17:32:14 ... but it is clear/fair to understand that the user expects to operate with the owner/brand of the site (in this case, Disney) 17:32:18 q? 17:32:22 ack fielding 17:32:23 q- fi 17:32:24 +Chapell 17:32:26 ack moneill 17:33:04 +LeeTien 17:33:17 sidstamm has joined #dnt 17:33:45 Mike O: I think the problem we got now is multiple context. I believe we're already down a path where we understand the concept of a processor 17:33:45 NO, WE ARE NOT GOING TO REVISIT ISSUE-5 17:33:54 +[Mozilla] 17:34:00 Zakim, Mozilla has me 17:34:00 +sidstamm; got it 17:34:07 ... we should focus on defining context and keep the definition of tracking into the compliance spec (or another forum) 17:34:15 Note: I'm not sure I got Mike's points correctly 17:34:48 ack dw 17:34:48 Justin: Lets keep as parameters the language we've adopted 17:34:50 ack dwainberg 17:35:03 David W: Shocked that we're discussing the definition pf party as the definition of context 17:35:16 q+ to express shock 17:35:18 ... neither the definition of tracking included parties (instead, they included contexts) 17:35:26 +q 17:35:37 ... sees it as a bait-and-switch to now use the parties of definition of party as context 17:36:23 ... can't support adopting the party definition as the definition of context 17:37:12 Justin: Roy proposed a definition to support the definition of tracking. He understands why you don't like the definition of party. As an alternative, lets try to further flush out the language 17:37:13 the notes that went along with the definition of tracking when we chose it refer to party concepts 17:38:09 Singer: an approach that takes no more than the party (but more narrow than the party may be acceptable) 17:38:10 q- ds 17:38:13 ack chap 17:38:28 q+ chapell 17:38:31 ack mo 17:38:32 Note that my proposal does not use the word "party" 17:38:44 Mike O: We did say in option B to refer to parties (not context) 17:39:13 if you choose a definition which has a key reliance on an undefined term, have you really chosen a definition? 17:39:25 q? 17:39:28 q- chap 17:39:40 perhaps it should say "data controller(s)" instead of "data controller" 17:39:51 Justin: At least three people on the call expressed interest of linking to party. 17:40:15 ... others have expressed that it isn't a good idea 17:40:27 ... invites people to suggest language/proposals to the group 17:41:00 +1 17:41:38 Brooks: Would say fundamentally that if tracking relies on context, the CfO for tracking may re-open itself if we define context at one end of the spectrum that results in a change in the definition of tracking 17:41:56 +1 Brooks 17:41:57 ... undermines that there was credible work done on the definition of tracking if the definition of tracking is still wide open 17:42:43 Justin: Rather than say 'this is all messed up', would prefer a concrete proposal on how to handle this 17:43:18 so is that not a concrete proposal? 17:43:22 Exactly right; we punted 17:43:56 +1 the definition of tracking is not set due to an open end to what context means.. 17:44:06 Brooks: Wants people to recognize that the definition of tracking is unset. 17:44:10 +1 17:44:13 q+ 17:44:20 (he is echoing one of my main complaints about this definition when the CfO happened, but that's water under the bridge) 17:44:23 -vincent 17:44:24 Justin: Invites all concrete proposals to further define/refine it 17:44:35 Wseltzer - you ready to take over? :) 17:44:45 Brooks: Is leaving it undefined an option? 17:44:55 -SusanIsrael 17:45:28 Justin: If everyone on the group agrees we don't need to define context, then that's what we'll do 17:45:35 I would have no problem with no definition other than the English connotation. 17:45:57 Rob V: Vialbe way forward would be to have more discussion on the mailing list to get clarity on the definitions proposed 17:46:08 .... agree that the definition of tracking is not set; but it is becoming clearer 17:46:37 -rvaneijk 17:46:49 My only real concern was that people understand we are referring to the user's activity context, rather than any of the million other contexts that can be considered. 17:46:49 ... tracking definition is a two-step process. First step was for the previous CfO, but we do need more time to get clarity on context to get it right. Ultimiately, this could lead to a workable solution 17:47:00 my skype dropped 17:47:07 scribenick: wseltzer 17:47:36 +rvaneijk 17:47:39 Justin: It's an open matter before the group. If people think we need to define, propose definitions; if people think we can leave it undefined, propose that. 17:47:48 Ray - that's the issue to me - that in the current definition "context" can be interpreted in many different ways - not only the user's activity context. 17:47:49 -Peder_Magee 17:47:55 ... Let's work to try to make it as clear as possible 17:48:09 ... I do think our definition of tracking moved the group forward. 17:48:31 Zakim, agenda? 17:48:31 I see 5 items remaining on the agenda: 17:48:32 5. ISSUE-240 Definition of context https://www.w3.org/2011/tracking-protection/track/issues/240 http://www.w3.org/wiki/Privacy/TPWG/Proposals_on_the_definition_of_context [from 17:48:32 ... ninja] 17:48:32 6. ISSUE-239 Should tracking status representation include an array of links for claiming compliance by reference? http://www.w3.org/2011/tracking-protection/track/issues/239 [from 17:48:32 ... ninja] 17:48:35 zakim, drop agendum 5 17:48:36 7. ISSUE-197 How do we notify the user why a Disregard signal is received? http://www.w3.org/2011/tracking-protection/track/issues/197 [from ninja] 17:48:36 8. Current status of TPE spec: Signals for internal / external usage of site elements (the signals formerly called "1" and "3") [from ninja] 17:48:36 9. AoB [from ninja] 17:48:37 zakim, take up agendum 6 17:48:40 agendum 5, ISSUE-240 Definition of context https://www.w3.org/2011/tracking-protection/track/issues/240 http://www.w3.org/wiki/Privacy/TPWG/Proposals_on_the_definition_of_context, 17:48:40 ... dropped 17:48:40 agendum 6. "ISSUE-239 Should tracking status representation include an array of links for claiming compliance by reference? 17:48:40 ... http://www.w3.org/2011/tracking-protection/track/issues/239" taken up [from ninja] 17:48:47 ... Turning it over to Matthias. 17:49:09 zakim, take up agendum 6 17:49:09 agendum 6. "ISSUE-239 Should tracking status representation include an array of links for claiming compliance by reference? 17:49:11 ... http://www.w3.org/2011/tracking-protection/track/issues/239" taken up [from ninja] 17:49:47 schunter1: Roy proposed a pointer to a compliance regime, allowing multiple compliance regimes 17:49:58 fielding, apologies, my response just went out this morning; I got stuck on a delayed flight 17:50:08 +q 17:50:23 http://www.w3.org/2011/tracking-protection/drafts/tracking-dnt.html#dfn-compliance 17:50:24 ... some discussion on the list. Some saying it's good to be specific, others, it's good to have multiple options. 17:50:28 ack next 17:50:50 ack r 17:51:17 q? 17:51:19 ack moneill2 17:51:21 ack moneill 17:51:59 moneill: General idea of multiple compliance links a good one; if there's a clash, what is the user to think? 17:52:24 ... perhaps need some non-normative text saying what happens in case of conflicting compliance policies 17:53:09 schunter1: good to think about conflict resolution 17:53:10 right, if you can't comply with both, you wouldn't want to claim compliance with both 17:53:24 npdoty, the main reason why qualifiers are only in the representation is because they need the compliance pointer to define what they mean. Also, sending more information in the header field needs compelling evidence that they won't be wasted bytes. 17:53:55 ... current state: if you have multiple links, you have to comply with all of them 17:53:57 Roy: that's right 17:54:18 schunter1: That's good, puts the conflict-resolution on the site, not the end-user. 17:54:19 q+ 17:54:25 ack d 17:54:31 ... the site needs to make sure all promises are consistent; that's best for end users. 17:54:41 dsinger: I'd thought these would be token strings 17:55:03 right, they are just federated names 17:55:12 ... so UA could check on user's behalf 17:55:14 -hwest 17:55:14 This only works if they cannot override each other 17:56:01 -Chapell 17:56:33 Usecase: A user looks up whether _one_ of the regimes is acceptable (and can then ignore the other regimes). 17:56:38 q? 17:56:42 dsinger: if they're additive, the customer needs to look only to see that one he likes is present. 17:57:12 q+ 17:57:22 schunter1: currently, you make promises in all the URLs 17:57:24 ack npdoty 17:57:25 This works onlly iff the regimes cannot _override_ each other. 17:57:54 -[FTC] 17:57:56 npdoty: concern that we're talking about providing multiple regimes, users checking; but I'm not sure that's an outcome we expect or want. 17:58:06 ... harder to explain to users what they're getting. 17:58:11 +q to Nick 17:59:08 dsinger: If a site says "I comply with DNT" but the compliance regime is the Venezuelan Beaver Cheese Association @@ 17:59:15 ... what does that tell the user? 17:59:16 It is important that the number of compliance regimes is kept very low (lower than the root-level certification authorities ;-) 17:59:26 thinks that was +1 to Nick, rather than +q 17:59:26 -johnsimpson 17:59:28 (LeeTien agrees with David) 17:59:55 Carl: Agree with DavidS it's a problem, but think it's an intractable problem 17:59:56 You can't wish your way into a single universal compliance document. It is far better to at least make some progress toward documented compliance even if there is a (small) amount of variance in choice. 18:00:09 +johnsimpson 18:00:17 ... there's no solution of which I'm aware that can be implemented technically 18:00:26 q+ 18:00:37 ack ds 18:00:37 dsinger, you wanted to Nick and to 18:00:50 dsinger: We've worked hard to make this balanced and symmetric. 18:00:51 -Ari 18:01:04 i like that 18:01:04 ... One possibility would be for the user to say "this is the compliance regime I'm seeking" 18:01:11 DNT 2.0? Or intermediated at the browser level? 18:01:11 Sounds like P3P 18:01:24 +vincent 18:01:25 ... and have the site respond "I recognize and comply" or "I don't recognize and disregard" 18:01:30 q+ 18:01:49 ... then the user can be communicating what he wants to the site 18:01:54 they might just tell the UA 18:02:00 I don't know of any site that negotiates business compliance on the fly 18:02:03 +q 18:02:14 IOW, I can hear the lawyers cringe 18:02:15 Another solution would be a Javascript API where you can look up regimes that are acceptable (raises a privacy concern though) 18:02:16 ... doesn't have to be sent frequently 18:02:17 +1 18:02:19 +q 18:02:21 sorry David, not so much 18:02:32 Yes, it resonates with me. Is user centric. 18:02:32 LeeTien: I like the basic idea 18:02:35 David - are you looking for a well-known resource that calls out: Do I comply? If Yes, this is what I comply with. 18:02:36 Don't support that proposal 18:02:50 q? 18:02:55 q+ 18:02:58 ... having dialog is useful if we're not using a single W3C compliance regime. 18:03:08 I am suggesting that the user sends "is X in your compliance array, because that's what I seek" and get a simple yes/no 18:03:09 q+ 18:03:10 ack n 18:03:13 ack npdoty 18:03:33 no 'negotiation in the fly', just improving transparency 18:03:39 npdoty: Interesting. I've sometimes suggested it as a counterexample 18:03:55 David - couldn't a web browser build that level of functionality on its own outside of the standard? Since the compliance array is available, I don't see why we need to add any bloat here. 18:03:56 It's an interesting idea, but I still think it can be done at the UA level. If the UA gets back an untrusted compliance regime, it responds accordingly. 18:03:57 You can imagine this being completely static: The browser sends "the user likes compliance A", and the site's well-known resource contains compliances B and C. No behavior at either end has to change, but everyone (server and browser) are fully informed about what the actual mismatch is. 18:04:01 To be fair, there may be 12-19 users who would do that npdoty... 18:04:12 +1 Justin 18:04:16 ... We want standardization to let users express one thing, not a complicated mess of parameters 18:04:29 q- 18:04:30 Chris_IAB, Well, if the UA makes it a default . . . 18:04:36 I agree with Nick's concerns, by the way, but when we decided to split TPE and compliance this is (as Roy has said) an almost inevitable result. I am trying to roll with reality here 18:04:41 +1 to Nick 18:04:43 ... concerned about multiple compliance regimes 18:04:53 Carl: The point of standardization is implementability. 18:05:06 q? 18:05:09 I disagree that users will understand, globally, the same concept in the same way, regardless of whether there is a single standard for it. 18:05:10 I agree, I would like a less-complex schema, that's what I'm asking for 18:05:27 I say, let's make things less complicated (apply KISS) here, at least on v1.0 18:05:34 Privacy is contextual, including regional, and per many other aspects. 18:05:43 bryan, sure, there will always be variation on practices, but the purpose is giving a common choice 18:05:50 ... have to assume that people are willing to take charge of their own privacy 18:06:05 q- 18:06:08 I think the counterveiling concern is that if you can just point to the Venezuelan Beaver Cheese Association, have we accomplished a goal? 18:06:21 ack m 18:06:23 schunter: want to return to original issue of whether URLs are a good idea 18:06:29 (Not disparaging the VBCA, who has a strong privacy track record) 18:07:30 moneill: Darwinian selection of compliance documents 18:07:59 moneill2, But what does "fittest" mean in this context? 18:08:00 we could define a completely generic protocol: a sender to say I want X (for any X) and a server to reply I comply with Y (for any Y) ... 18:08:13 s/in this context/here 18:08:24 Roy: The best policies will win 18:08:36 ... let the user pick what's most interesting to them 18:08:42 +[CDT.a] 18:08:47 -[CDT] 18:08:47 zakim, cdt.a is me 18:08:48 -FPFJoeN 18:08:48 +justin; got it 18:08:53 -Joanne 18:08:53 justin, a list of compliance documents ordered by popularity 18:08:55 ... negotiation doesn't make sense; site won't negotiate but just ignore. 18:09:23 q+ 18:09:29 moneill2, But popularity by whom? Users or ad nets? 18:09:31 I'm not sure why we think this is a market or natural selection; we don't expect users to have detailed visibility or make lots of choices based on it 18:09:41 justin, users 18:09:44 ... having to send bytes in every header would be really annoying 18:10:03 Good point, Roy 18:10:03 q? 18:10:07 ack fielding 18:10:24 schunter1: Push this out to the implementation phase 18:10:26 ack ds 18:10:28 npdoty, this "generic protocol" sounds close to what P3P does right? 18:10:46 Matthias - we need to structure to communicate the compliance array - so we'll at least need that for implementation testing. 18:10:58 dsinger: I didn't suggest sending the request in every header; secondly, checking only on the user side doesn't give site transparency as to what the user wanted 18:10:58 vincent, it resembles the negotiation protocol of P3P that was ultimately dropped before publication because it was thought to be too complex 18:11:16 ... whereas a request "I'd like DAA compliance" suggests ways the site can change 18:11:22 ... balanced and symmetric. 18:11:42 fielding: Not realistic. We're talking about metrics on sites with millions fo r3equests/minute 18:12:01 ... if there's a significant drop in audience, they'll look into it and learn why. 18:12:03 agree with Roy, sites will be able to figure this out using their own internal analytics 18:12:17 roy, tracking via low entropy cache headers rather than UIDs 18:12:29 David, if consumers are asking for a specific compliance regime, then they're likely to actually ask for it via email or other feedback mechanisms 18:12:56 David, can't we leave that up to sites to implement on their own, IF THEY WANT? 18:13:01 q? 18:13:07 roy, some will though 18:13:14 Why do we need to make this a requirement, of v1.0? 18:13:16 -WaltMichel 18:13:19 dsinger, in such a model, would Apple choose a default compliance regime to set in its browsers? 18:13:42 do we prefer that browsers just block requests for ads and beacons and use that as the feedback mechanism? 18:13:55 q+ 18:14:06 schunter1: recommend a limited number of compliance regimes 18:14:25 to dwainberg: I don't know, but in this scenario we could at least explain to the user what we're asking for on their behalf (which is a longstanding request) 18:14:26 q- 18:14:55 To be clear, people can still argue *against* including a field for multiple complianc regimes. We could still just point to the existing (unfinished) compliance document. Though that obviously has its serious problems as well. 18:15:06 ... @@ browser-based lists 18:15:27 guys, let's get something out workable, and then iterate… we are trying to solve problems that don't yet exist, in v1 18:15:46 we will learn a LOT once we get v1 out 18:16:08 dsinger: give the site a way to learn what the user was looking for. I haven't yet proposed a mechanism. 18:16:18 can pointing to a compliance regime be optional in v1 and see whether industry implements that part of the spec 18:16:24 if dsinger thinks that's useful and wants it to be used rarely, it could be a parameter of loading the tracking status resource, which we expect to be uncommon 18:16:37 schunter1: so one way forward, keep multiple URLs, open issue asking whether we need mechanism for site to discover user privacy prefs. 18:16:54 dsinger: yes. open an issue. 18:17:06 dsinger, is there a president you can point to where this has been done ("conversation with users" on a site-by-site basis)? 18:17:17 sorry, on a transaction by transaction basis? 18:17:22 LeeTien: when you have multiple compliance regimes, user loses sight of what site is complying with. 18:17:33 ... vs single standard, user knows it's set by the standard. 18:18:01 ... With mult regimes, concern that users not be misled to think they're getting protection they're not. 18:18:01 LeeTien, +1 18:18:11 to Lee's point, user confusion is likely 18:18:19 joanne, the current array proposal is for an optional list of compliance pointers 18:18:30 Proposed conclusion on ISSUE-239: Send a mail to the list trying to close this issue and open a new issue on how/whether web-sites should be able to discover the preferred regimes by a user. 18:18:35 ... implementation isn't success if users arent' getting what they think 18:19:18 I don't think anyone expects it to be common for users to request and review the tracking status resource for detailed compliance information 18:19:40 q? 18:19:59 anyway, any site COULD do this on their own… why don't we leave it at that? 18:20:16 schunter1: propose close issue-239, open new issue. 18:20:19 -vincent 18:20:33 I don't think we should open another issue, but…. 18:20:40 ISSUE-197? 18:20:40 ISSUE-197 -- How do we notify the user why a Disregard signal is received? -- closed 18:20:40 http://www.w3.org/2011/tracking-protection/track/issues/197 18:20:40 zakim, drop agendum 6 18:20:40 agendum 6, ISSUE-239 Should tracking status representation include an array of links for claiming compliance by reference? 18:20:42 ... http://www.w3.org/2011/tracking-protection/track/issues/239, dropped 18:20:49 I'm not comfortable closing the issue, but I'm fine with moving to email :) 18:20:50 zakim, take up agendum 7 18:20:50 agendum 7. "ISSUE-197 How do we notify the user why a Disregard signal is received? http://www.w3.org/2011/tracking-protection/track/issues/197" taken up [from ninja] 18:21:01 q+ 18:21:20 schunter1: we need frozen list of change proposals 18:21:38 npdoty: we spoke last time about non-normative text; dsinger sent a proposal, that's all I've seen. 18:21:47 ... if that's the only proposal, we're done. 18:21:52 can we send the proposal again, please? 18:21:57 (nick: do you have my text?) 18:22:00 Right, there was agreement with dwainberg to take out the language about the disregard signal being rare? Is that right? 18:22:14 This is the wiki page http://www.w3.org/wiki/Privacy/TPWG/Proposals_on_Disregard_signal - I will ad Dave's text 18:22:33 schunter1: push this to next week 18:22:51 dsinger on Disregard note: http://lists.w3.org/Archives/Public/public-tracking/2013Dec/0117.html 18:22:51 Justin - that's what I thought as well (remove "rare") 18:23:03 "Note: This specification was written assuming that the D tracking status value would be used only in situations that can be adequately described to users as an exception to normal behavior. If this turns out not to be the case, either the logic that is leading to the D signal may need re-examination, or this specification, or both." 18:23:26 Topic: 1st and 3d Party signals 18:23:45 +1 to a simple spec 18:23:47 schunter1: We'd had 1st and 3d party signals. Fielding removed them. I sent a proposal on the list 18:23:52 ... received push-back. 18:23:58 q? 18:24:02 q- 18:24:02 q+ 18:24:06 ack n 18:24:40 dsinger: Given that at least one compliance regime distinguishes between 1st and 3d parties, discoverability is at least harmless, potentially useful. 18:24:47 +q 18:24:54 q- 18:25:00 +1 to dsinger on that. it can be informative, even if not a compliance indicator 18:25:05 ack m 18:25:16 To Lee's earlier point, I think the TSR performs the role of transparency. I don't see how listing the set of things the site complies with would reduce transparency versus not listing any. I understand that having a universal compliance would be more transparent, but that's a pipe dream that, if ever comes true, can be reflected by the compliance array linking to that one compliance regime (and browsers ignoring all others). 18:25:54 -[Mozilla] 18:25:55 +q 18:26:14 ack mo 18:26:28 schunter: @@from email@@ 18:26:29 (I re-sent the Disregard suggestion, but for reference, it was previously ) 18:27:00 I see some value in uniformity of signalling for this common concept 18:27:37 schunter1: simplicity, or giving flags for compliance regimes that need them 18:28:27 ... continue discussion on-list 18:28:34 I don't think our main goal is helping site developers not make errors about re-use of resources 18:28:48 but it can be informative to users whether a resource is designed for first/third party use 18:29:02 -LeeTien 18:29:11 -dwainberg 18:29:14 -MECallahan 18:29:15 [adjourned] 18:29:16 -Chris_Pedigo 18:29:17 -Bryan_Sullivan 18:29:19 -Chris_IAB 18:29:19 -rvaneijk 18:29:19 Zakim, list attendees 18:29:20 As of this point the attendees have been npdoty, Ninja, WaltMichel, Chris_IAB, Ninja.a, Jack_Hobaugh, RichardWeaver, Wendy, dsinger, dwainberg, Ari, WileyS, Peder_Magee, Fielding, 18:29:20 ... Carl_Cargill, schunter, +1.813.366.aaaa, justin, eberkower, Bryan_Sullivan, vinay, Joanne, hwest, moneill2, [Apple], hober, hefferjr, Chris_Pedigo, SusanIsrael, [FTC], Brooks, 18:29:20 ... vincent, johnsimpson, RobSherman, FPFJoeN, rvaneijk, adrianba, MECallahan, Chapell, LeeTien, sidstamm, [CDT] 18:29:25 -RichardWeaver 18:29:25 -vinay 18:29:25 -adrianba 18:29:25 -WileyS 18:29:25 -johnsimpson 18:29:26 -RobSherman 18:29:26 -justin 18:29:28 -Carl_Cargill 18:29:30 -schunter 18:29:30 -[Apple.a] 18:29:30 thanks, bye, happy new year! 18:29:30 rrsagent, please draft the minutes 18:29:30 I have made the request to generate http://www.w3.org/2014/01/08-dnt-minutes.html npdoty 18:29:31 -Jack_Hobaugh 18:29:31 -moneill2 18:29:32 -ninja 18:29:32 -Fielding 18:29:34 -Brooks 18:29:36 -[Apple] 18:29:38 -npdoty 18:29:42 rrsagent, make minutes 18:29:42 I have made the request to generate http://www.w3.org/2014/01/08-dnt-minutes.html wseltzer 18:29:43 -eberkower 18:30:07 s/Roy:/fielding:/g 18:30:08 rrsagent, make minutes 18:30:08 I have made the request to generate http://www.w3.org/2014/01/08-dnt-minutes.html wseltzer 18:30:50 s/schunter1/schunter/g 18:31:19 rrsagent, make minutes 18:31:19 I have made the request to generate http://www.w3.org/2014/01/08-dnt-minutes.html wseltzer 18:31:45 -hefferjr 18:51:06 qchris has joined #dnt 19:05:01 disconnecting the lone participant, Wendy, in T&S_Track(dnt)12:00PM 19:05:03 T&S_Track(dnt)12:00PM has ended 19:05:03 Attendees were npdoty, Ninja, WaltMichel, Chris_IAB, Ninja.a, Jack_Hobaugh, RichardWeaver, Wendy, dsinger, dwainberg, Ari, WileyS, Peder_Magee, Fielding, Carl_Cargill, schunter, 19:05:04 ... +1.813.366.aaaa, justin, eberkower, Bryan_Sullivan, vinay, Joanne, hwest, moneill2, [Apple], hober, hefferjr, Chris_Pedigo, SusanIsrael, [FTC], Brooks, vincent, johnsimpson, 19:05:04 ... RobSherman, FPFJoeN, rvaneijk, adrianba, MECallahan, Chapell, LeeTien, sidstamm, [CDT] 20:34:47 schunter has joined #dnt 20:58:19 schunter has joined #dnt 21:09:33 schunter has joined #dnt