15:34:30 RRSAgent has joined #dnt 15:34:30 logging to http://www.w3.org/2014/06/04-dnt-irc 15:34:32 RRSAgent, make logs world 15:34:34 Zakim, this will be TRACK 15:34:34 ok, trackbot; I see T&S_Track(dnt)12:00PM scheduled to start in 26 minutes 15:34:35 Meeting: Tracking Protection Working Group Teleconference 15:34:35 Date: 04 June 2014 15:34:52 chair: justin, schunter 15:35:14 regrets: carlcargill, fielding, johnsimpson 15:38:06 Nielsen__Raymond_ has joined #dnt 15:38:47 Zakim, mute me 15:38:47 sorry, Nielsen__Raymond_, I don't know what conference this is 15:39:21 Zakim, mute me please 15:39:21 sorry, Nielsen__Raymond_, I don't know what conference this is 15:39:50 W3C Tracking Protection Working Group Call 15:41:57 Nielsen__Raymond_. upi 15:41:57 Nielsen__Raymond__ has joined #dnt 15:43:01 s/Nielsen__Raymond_. upi// 15:43:20 Zakim, mute me please 15:43:20 sorry, Nielsen__Raymond__, I don't know what conference this is 15:43:35 W3C Tracking Protection Working Group Call 15:44:17 Nielsen__Raymond_ has joined #dnt 15:51:33 dsinger has joined #dnt 15:52:19 T&S_Track(dnt)12:00PM has now started 15:52:25 + +1.646.654.aaaa 15:53:17 Zakim, pmute me please 15:53:17 I don't understand 'pmute me', Nielsen__Raymond_ 15:53:49 Zakim, mute me please 15:53:49 sorry, Nielsen__Raymond_, I do not know which phone connection belongs to you 15:53:59 zakim, call ninja-office 15:53:59 ok, ninja; the call is being made 15:54:01 +Ninja 15:54:55 zakim, aaaa is Nielsen__Raymond_ 15:54:55 +Nielsen__Raymond_; got it 15:55:12 Nielsen__Raymond_ you should now be able to mute yourself 15:56:15 +WaltMichel 15:57:12 Chris_Mejia has joined #dnt 15:57:37 Hi Ninja, do you have a second? 15:58:19 JackHobaugh has joined #dnt 15:58:48 +[Apple] 15:59:17 zakim, [apple] has dsinger 15:59:17 +dsinger; got it 15:59:22 + +1.425.366.aabb 15:59:34 zakim, who is here? 15:59:34 On the phone I see Nielsen__Raymond_, Ninja, WaltMichel, [Apple], +1.425.366.aabb 15:59:36 [Apple] has dsinger 15:59:36 On IRC I see JackHobaugh, Chris_Mejia, dsinger, Nielsen__Raymond_, RRSAgent, schunter, Zakim, ninja, npdoty, walter, trackbot, wseltzer 15:59:45 Alan_ has joined #dnt 16:00:35 +Jack_Hobaugh 16:00:45 justin has joined #dnt 16:00:49 vinay has joined #dnt 16:00:56 +vinay 16:01:02 +Peder_Magee 16:01:17 +??P15 16:01:18 Just joined the call from a private line 16:01:22 moneill2 has joined #dnt 16:01:38 +Wendy 16:01:40 magee has joined #dnt 16:01:50 +Amy_Colando 16:01:59 +Chris_Pedigo 16:02:25 zakim, aabb is Alan(IAB) 16:02:25 +Alan(IAB); got it 16:02:30 +[IPcaller] 16:02:43 Zakim, ??p15 is Chris_Mejia 16:02:43 +Chris_Mejia; got it 16:02:45 zakim, [IPCaller] is me 16:02:45 +moneill2; got it 16:02:46 sidstamm has joined #dnt 16:02:51 +[CDT] 16:02:56 zakim, cdt has me 16:02:56 +justin; got it 16:03:16 Brooks has joined #dnt 16:03:20 volunteer to scribe today? 16:03:21 +??P28 16:03:25 hi all, I can't dial in today but will monitor IRC 16:03:25 Zakim, ??P28 is schunter 16:03:25 +schunter; got it 16:03:27 zakim, who is on the phone? 16:03:27 On the phone I see Nielsen__Raymond_, Ninja, WaltMichel, [Apple], Alan(IAB), Jack_Hobaugh, vinay, Peder_Magee, Chris_Mejia, Wendy, Amy_Colando, Chris_Pedigo, moneill2, [CDT], 16:03:30 ... schunter 16:03:30 [Apple] has dsinger 16:03:30 [CDT] has justin 16:03:35 + +1.212.941.aacc 16:03:50 zakim, choose a scribe 16:03:50 Not knowing who is chairing or who scribed recently, I propose schunter 16:04:07 +hefferjr 16:04:11 I can, sure 16:04:16 scribenick: ninja 16:04:16 scribenick: ninja 16:04:22 ChrisPedigoOPA has joined #dnt 16:04:27 q+ 16:04:39 https://www.w3.org/wiki/Privacy/TPWG/Change_Proposal_Service_Provider 16:04:49 +npdoty 16:04:55 zakim, aacc is brooks 16:04:57 +brooks; got it 16:05:05 zakim, take up agendum 1 16:05:05 agendum 1. "Service Providers" taken up [from ninja] 16:05:26 justin: This issue has been on the agenda for some time now. 16:05:40 WileyS has joined #dnt 16:05:44 ... In the last calls most people seemed fine with Roy's proposal. 16:06:06 +WileyS 16:06:22 q? 16:06:25 ... Some folks argued for siloing of customer data. Will follow up with an email to the mailing list. 16:06:33 q- ninja 16:06:33 ack ninja 16:06:50 ... Roy is not online today. I will send out a note. 16:06:51 https://www.w3.org/wiki/Privacy/TPWG/Change_Proposal_First_Party_Compliance 16:06:52 q+ 16:06:59 zakim, take up agendum 2 16:06:59 agendum 2. "Data Append and First Parties" taken up [from ninja] 16:07:20 cOlsen has joined #dnt 16:07:26 justin: More controversial issue. Let me walk you through the proposals on the wiki page 16:07:59 +kulick 16:08:11 kulick has joined #dnt 16:08:19 +[FTC] 16:08:46 that's correct, justin 16:09:14 ... We may be down to two options here. Vinay's and Susan's proposal could be combined to one. 16:09:37 ... The other proposal would be from John Simpson and Mike O'Neill 16:10:13 ack npd 16:10:52 npdoty: Wanted to ask whether to add Roy's proposal on service providers to the draft now? 16:11:01 +Susan_Israel 16:11:09 I have no objection to not taking an action item at this time. 16:11:09 justin: Hold it off until we made sure there is no disagreement. 16:11:12 This group has been historically resistant to requirements on the UI of a UA. For example, Alan and I (and others) proposed a set of requirements on the UI for UAs setting/sending DNT:1. We had proposed that the user be properly informed about the choice they were making before setting DNT:1. Essentially what we were proposing was the choice be "clearly and comprehensively explained" before the DNT:1 signal was set. As I recall, our proposal was lar[CUT] 16:11:26 So now, as I understand it, folks who rejected our similar proposal for the setting of DNT:1, want those rules applied for the setting of DNT:0, to servers? 16:11:27 susanisrael has joined #dnt 16:12:14 Moneill2: My proposal is based on Rigo's idea of having DNT;0 as a consent mechanism. 16:13:05 hober has joined #dnt 16:13:11 wseltzer, I see it 16:13:16 ... Suggested some extra language to Matthias to convey that a consent needs to rely on specific information. 16:14:14 REPOSTING: This group has been historically resistant to requirements on the UI of a UA. For example, Alan and I (and others) proposed a set of requirements on the UI for UAs setting/sending DNT:1. We had proposed that the user be properly informed about the choice they were making before setting DNT:1. Essentially what we were proposing was the choice be "clearly and comprehensively explained" before the DNT:1 signal was set. 16:14:27 As I recall, our proposal was largely rejected. So now, as I understand it, folks who rejected our similar proposal for the setting of DNT:1, want those rules applied for the setting of DNT:0, to servers? 16:14:45 wouldn't that be a condition of when you ask for a user-granted exception? when you present that explanation to the user, you should do what you said. 16:14:50 ... Depending on the privacy policy the site needs to have some mechanism to differentiate between DNT;0 and more specific consent of UGE (not sure if I got Mike correctly) 16:15:21 justin: If the law requires you to provide clear information, what is the benefit in stating it here in TCS? 16:15:44 q? 16:15:47 q+ to say that the requirements on the quality of explanation for an exception belongs in the exception section 16:15:57 moneill: clearly and comprehensively should not be controversial. 16:16:18 ... The user should be able to understand the circumstances. 16:16:42 ack ds 16:16:42 dsinger, you wanted to say that the requirements on the quality of explanation for an exception belongs in the exception section 16:17:03 If there is a law around DNT, then the law would prevail, and don't need to be incorporated here. 16:17:04 justin: Chris had reminded the group that we did not want to be overly prescriptive on how UAs present information. 16:17:40 agree with dsinger's point here 16:17:43 dsinger: This is the wrong place to talk about requirements for exceptions. This should go in the section on exceptions 16:18:09 q? 16:18:22 justin: Roy also made a point about testability. This would also be a case of difficult testability. 16:18:36 dsinger: those who ask for exceptions will ask for "permission to track" generally, not specific reasons 16:18:52 The issue is that when a DNT:0 is set, it is not possible to determine whether the user set it with the intent of granting an exception or the “user prefers to allow tracking on the target site.” Even if the user had granted an exception previously, how do we know whether the user has started sending the DNT:0, not as an exception signal but as a preference to allow tracking? Accordingly, I believe it is not a good idea to overload the DNT:0 signal. 16:18:57 ... The existing language by vinay would not prohibit data append. Mike's would. So this may be the main difference 16:18:58 +1 on dsinger. I think we have existing text on exceptions requiring explicit consent on the page before being stored in the user agent. 16:19:02 s/reasons/ability to track particular data items/ 16:19:25 WaltMichel has joined #DNT 16:19:36 ... Ask Mike whether he would be willing to move the second sentence to the section about requirements on exceptions and DNT;0 16:19:44 right, could we discuss the first paragraph/sentence as a proposal for issue-170 and then separately discuss the conditions of exceptions if need be? 16:19:50 Just to clarify my language, I wasn't taking a stand one way or the other on data append. Instead, my language was cleaning up the existing text (which doesn't talk about data appends either) 16:19:54 Mike, I think it's already in there, under UGEs 16:19:54 Mike: If there is a better place to put it I will take a look at that. 16:20:18 I don’t mind it saying that IF the DNT:0 is a resilt of an exception, THEN you can only track to the extent you asked for permission to when the exception was granted. But I don’t think it will have any useful effect, since I expect sites will ask to track you generally. 16:21:17 And anyway, it’s clearly true whether we state it or not. “I want to remember your IP address” and then it turns out they remembered a whole load of other data, they’re in trouble whether or not this sentence exists in our spec. 16:21:22 What Chris is pointing at is that we jumped through a lot of hoops by putting up requirements for this special case that are not reflected in other sections that address consent in general. 16:21:34 q? 16:21:51 the 170 proposal seems overly prescriptive and a bit misplaced. 16:22:01 ... If these don't align we have a problem. So please take a look at the text regarding consent in TPE and TCS. 16:22:03 The law should determine if Consent was valid - not our spec 16:22:11 TCS currently refers at a high level to "explicit and informed consent". TPE refers to "user's intention to grant an exception ... reflects informed consent". 16:22:22 zakim, take up agendum 3 16:22:22 agendum 3. "Context Separation" taken up [from ninja] 16:22:22 https://www.w3.org/wiki/Privacy/TPWG/Change_Proposal_Limitations_on_use_in_Third_Party_Context 16:23:10 justin: The existing text does not limit what a first party could do with its data in third party context 16:23:48 I remember the folks from NAI and Walter said that this would be surprising to a user. 16:23:57 can we consolidate proposals on that? I think Walter's is particularly concise. 16:24:55 ... the other idea currently on the wiki was from Yanni and I is based on the idea of more transparency and is somewhat in the middle ground. 16:25:01 q+ on use in 3rd party context: I thought we cared about privacy, not evidence of data collection? 16:26:02 ... Following up on Nick's comment, yes agree that Walter's proposal is more concise. We should encourage merging. 16:26:12 ... Will talk to Alan offline. 16:26:17 q+ 16:26:28 dsinger: I don't see the privacy concern in this issue. 16:26:29 ack ds 16:26:29 dsinger, you wanted to comment on use in 3rd party context: I thought we cared about privacy, not evidence of data collection? 16:26:34 +1 dsinger 16:26:45 ... we are talking about data that was legitimately collected. 16:27:00 ack ws 16:27:14 +q 16:27:53 I don't think we are going to solve EVERY privacy concern with this spec... nor should we attempt to boil that ocean. 16:28:16 ack mo 16:28:18 wseltzer: Coming back to our definition of tracking and many definitions of privacy - use of data outside the context it occurred in could be seen as a violation of privacy 16:28:19 Nielsen__Raymond__ has joined #dnt 16:28:30 (I have tended to avoid bringing in academic discussions of privacy definitions, but there's a certainly a variety of them and the "conextual integrity" one is common) 16:28:41 why should you not recognize the user? 16:29:04 they logged on or otherwise identified themselves, didn’t they? 16:29:07 sometimes academics can say useful things... 16:29:08 moneill2: To recognize the user in a third party context you need to have a unique ID, cooke etc. People would see that as tracking 16:29:12 I really don't think we can go back in history 16:29:20 ... They would feel cheated when sending DNT;1 16:29:24 not sure Alan Chappell would agree with that statment 16:29:59 q+ to suggest specific concerns, e.g. ads tracking across public browsing 16:30:10 moneill2, was the concern about having an identifier at all from a party you previously interacted with as a first party? 16:30:17 justin: I don't think it is limited to users being logged on to the first party. I could see some argument for bigger trust there. 16:30:29 +[Microsoft] 16:30:37 amyc has joined #dnt 16:30:38 -Amy_Colando 16:30:38 Not sure I'm following on this one but don't disagree with that position - but would argue if the data was collected while logged-in a company would argue they had consent for use. 16:30:41 ... Right now the spec does not limit data collection to a logged-on state. 16:30:48 correct. we don't refer to "logged in" status in the Compliance doc at the moment, I believe. 16:30:53 ack ws 16:30:53 wseltzer, you wanted to suggest specific concerns, e.g. ads tracking across public browsing 16:30:59 if the identifier is there it should at least not be used, preferably deleted if DNT:1 16:31:02 ... Any first party could use the data in a third party context and it could confuse users. 16:31:32 it seems like we are talking about this idea of "the right to be forgotten" 16:31:41 vincent has joined #dnt 16:31:46 wseltzer: Giving an example. User has been bra shopping and an ad pops up during presentation. 16:31:48 that's been a very controversial concept 16:32:10 ... We need to decide whether protection against this is within scope of DNT 16:32:18 third party cookie blocks by browsers addresses this issue 16:32:44 justin: Don't see us to coming to easy consensus here 16:32:58 sure, no problem 16:33:03 scribenick: amyc 16:33:05 scribenick: amyc 16:33:46 Justin: two positions (yes, never) calling for middle ground, perhaps clarifying that you need to be logged in in order to use data in another context 16:34:02 q? 16:34:05 for people who have supported existing text (maybe Rob or Shane), would a branding or other proposal work for you? 16:34:06 .. encourages finding middle ground, or will need to go for call for objections 16:34:17 q+ 16:34:20 ... last issue is data minimization 16:34:24 https://www.w3.org/wiki/Privacy/TPWG/Change_Proposal_Unique_Identifiers 16:34:32 ack npdoty 16:34:46 https://www.w3.org/wiki/Privacy/TPWG/Change_Proposal_Retention_Permitted_Uses 16:35:06 Nick: any action items on context separation? 16:35:46 Justin: will follow up with Alan to see if OK with adopting Walter's proposal, and then Rob's proposal is clear cut. Call for middle ground proposal, up to WG members to come up with proposal 16:36:07 thanks, just wanted to get a summary of our milestones/action items on that issue. 16:36:15 zakim, take up agendum 4 16:36:15 agendum 4. "Data Minimization" taken up [from ninja] 16:36:54 Justin: existing text from June draft - quoting text 16:37:29 WaltMichel has joined #DNT 16:37:30 Too broad - highly subjective determination of "where available" 16:37:44 ... Dan Auerbach had proposed no unique identifiers, then Mike fleshed out no persistent identifiers, focus on browser fingerprinting, text is available on wiki 16:38:09 Yes - to existing draft text - this is from the Swire/W3C Staff Draft 16:38:15 +vincent 16:38:51 justin, ndoty, a suggestion: since we are working on a compliance doc that ties to the TPE, it would be great to post the pertinent TPE section with the proposals we are considering (so we view these proposals in proper context) 16:39:13 Justin: has there been text submission to modify that text? Would be helpful to submit language or remind of previously submitted alternative language 16:40:15 -Susan_Israel 16:40:19 We have not talked about data minimization for months. If the text proposals on the wiki are not up to date, please let us know (mail to me or the mailing list) 16:40:38 justin, npdoty, my suggestion would be to tie the compliance doc back directly to the TPE, calling out the relevant sections in the TPE. Does that make sense? Otherwise we risk these docs diverging. 16:40:46 Justin: does anyone want approach of hard numbers for specific purposes for data minimization? 16:41:09 +Susan_Israel 16:41:11 q+ 16:41:29 Chris_Mejia, is that a suggestion for the wiki pages and change proposals? or adding notes in the Compliance doc itself with links to TPE sections? 16:41:30 ack chris 16:41:30 ... responding to Chris suggestion - not sure I can do this real time, but will try to do this on wiki 16:41:43 (okay, the former, thanks.) 16:41:54 Chris: hard to match up compliance sections with pertinent TPE section 16:42:21 ... would also be helpful in final doc for implementers 16:42:50 Justin: agrees generally, but not seeing direct connection on data minimization 16:43:06 ... between TPE and Compliance 16:43:23 Chris: need this from engineering perspective, we should make this clear 16:43:33 I'm willing to do the general review to make sure the documents (TPE & Compliance) are in sync. (I've done some of those things already particularly around language / defined terms, but I think there are some additional things that need to be done.) 16:43:41 npdoty, both 16:44:42 action: doty to do review of Compliance to make sure it's in sync with TPE LCWD 16:44:42 Created ACTION-451 - Do review of compliance to make sure it's in sync with tpe lcwd [on Nick Doty - due 2014-06-11]. 16:45:06 action-451: we'll need to do this again at different stages, but now would be a good time to do another pass 16:45:06 Notes added to action-451 Do review of compliance to make sure it's in sync with tpe lcwd. 16:45:13 Justin: similarly, on advocate side, if anyone wants to run with hard limits on data uses, please speak up. Will send to list, otherwise not inclined to pursue if no one willing to work with this 16:45:14 action-451 due 2014-06-18 16:45:14 Set action-451 Do review of compliance to make sure it's in sync with tpe lcwd due date to 2014-06-18. 16:45:19 q? 16:45:37 zakim, take up agendum 5 16:45:37 agendum 5. "Next Steps" taken up [from ninja] 16:45:47 link to justin's email: http://lists.w3.org/Archives/Public/public-tracking/2014Jun/0003.html 16:45:48 ... any other questions on data minimization? no response 16:46:27 ... sent out old issues to mailing list earlier in week, believe that these are not controversial, but if anyone wants to discuss any of these, we will schedule time 16:46:42 q+ 16:46:46 ... hope people will be ok with closing 16:46:49 ack npd 16:47:26 nick: we have issue 233 with replacing limited with minimized, not sure if there is more of a text proposal 16:47:30 http://www.w3.org/2011/tracking-protection/track/issues/233 16:47:40 yes, will do 16:47:46 via Jack, that refers to changing "limited" to "minimized" 16:47:57 justin: asking ninja to merge wiki and add issue 233, call for Jack or others to submit text 16:48:11 ... will send note to group on mailing list 16:48:13 q? 16:48:16 (if it's just find/replace, that's easy and sounds good to me. if there's more detail, we should have it to compare against others while we're trying to update this section) 16:48:23 -[FTC] 16:48:28 -Chris_Pedigo 16:48:29 -Chris_Mejia 16:48:30 -Peder_Magee 16:48:31 -vincent 16:48:31 -kulick 16:48:32 -[Microsoft] 16:48:32 -[Apple] 16:48:33 -[CDT] 16:48:33 -brooks 16:48:34 -Alan(IAB) 16:48:34 -hefferjr 16:48:34 -vinay 16:48:35 -Jack_Hobaugh 16:48:35 -Wendy 16:48:35 -npdoty 16:48:35 -Susan_Israel 16:48:36 -WaltMichel 16:48:48 -Ninja 16:48:54 -moneill2 16:48:55 -WileyS 16:49:02 Zakim, list attendees 16:49:02 As of this point the attendees have been +1.646.654.aaaa, Ninja, Nielsen__Raymond_, WaltMichel, dsinger, +1.425.366.aabb, Jack_Hobaugh, vinay, Peder_Magee, Wendy, Amy_Colando, 16:49:05 ... Chris_Pedigo, Alan(IAB), Chris_Mejia, moneill2, justin, schunter, +1.212.941.aacc, hefferjr, npdoty, brooks, WileyS, kulick, [FTC], Susan_Israel, [Microsoft], vincent 16:49:10 rrsagent, please draft the minutes 16:49:10 I have made the request to generate http://www.w3.org/2014/06/04-dnt-minutes.html npdoty 16:53:44 -schunter 16:56:01 Nielsen__Raymond_ has joined #dnt 17:02:37 johnsimpson has joined #dnt 17:03:14 call still going? 17:03:46 johnsimpson has left #dnt 17:05:10 johnsimpson, no we already finished 17:05:40 johnsimpson, you can find the minutes on http://www.w3.org/2014/06/04-dnt-minutes.html and I will link them on the homepage asap 17:32:19 -Nielsen__Raymond_ 17:32:20 T&S_Track(dnt)12:00PM has ended 17:32:20 Attendees were +1.646.654.aaaa, Ninja, Nielsen__Raymond_, WaltMichel, dsinger, +1.425.366.aabb, Jack_Hobaugh, vinay, Peder_Magee, Wendy, Amy_Colando, Chris_Pedigo, Alan(IAB), 17:32:20 ... Chris_Mejia, moneill2, justin, schunter, +1.212.941.aacc, hefferjr, npdoty, brooks, WileyS, kulick, [FTC], Susan_Israel, [Microsoft], vincent 18:43:44 schunter has joined #dnt