15:32:42 RRSAgent has joined #dnt 15:32:42 logging to http://www.w3.org/2014/06/25-dnt-irc 15:32:44 RRSAgent, make logs world 15:32:46 Zakim, this will be TRACK 15:32:46 ok, trackbot; I see T&S_Track(dnt)12:00PM scheduled to start in 28 minutes 15:32:47 Meeting: Tracking Protection Working Group Teleconference 15:32:47 Date: 25 June 2014 15:33:08 chair: justin 15:33:23 regrets: sidstamm, schunter 15:52:58 JackHobaugh has joined #dnt 15:54:55 moneill2 has joined #dnt 15:55:04 T&S_Track(dnt)12:00PM has now started 15:55:11 +[IPcaller] 15:55:18 zakim, ipcaller is me 15:55:18 +walter; got it 15:56:06 npdoty has joined #dnt 15:57:00 +[IPcaller] 15:57:14 zakim,[IPCaller] is me 15:57:14 +moneill2; got it 15:57:24 WaltMichel has joined #DNT 15:57:48 zakim, call ninja-office 15:57:48 ok, ninja; the call is being made 15:57:49 +Ninja 15:58:13 +WaltMichel 15:58:17 zakim, who is here? 15:58:17 On the phone I see walter, moneill2, Ninja, WaltMichel 15:58:19 On IRC I see WaltMichel, npdoty, moneill2, JackHobaugh, RRSAgent, Zakim, ninja, walter, hober, trackbot, wseltzer 15:58:54 johnsimpson has joined #dnt 15:59:06 eberkower has joined #dnt 15:59:15 +Jack_Hobaugh 15:59:32 +Carl_Cargill 15:59:54 chair+ Carl_Cargill 16:00:21 +npdoty 16:00:35 +Chris_Pedigo 16:00:39 justin has joined #dnt 16:00:55 + +1.650.362.aaaa 16:00:56 + +1.310.292.aabb 16:00:56 +RichardWeaver 16:01:08 Richard_comScore has joined #dnt 16:01:13 + +1.646.654.aacc 16:01:18 +WileyS 16:01:26 Zakim, aacc is eberkoweer 16:01:26 +eberkoweer; got it 16:01:34 Zakim, aabb is johnsimpson 16:01:34 +johnsimpson; got it 16:01:36 WileyS has joined #dnt 16:01:45 Zakim, mute me please 16:01:45 sorry, eberkower, I do not know which phone connection belongs to you 16:02:04 Zakim, eberkoweer is really eberkower 16:02:04 +eberkower; got it 16:02:10 Zakim, mute eberkower 16:02:10 eberkower should now be muted 16:02:21 vinay has joined #dnt 16:02:34 Max has joined #dnt 16:02:43 mecallahan has joined #dnt 16:02:43 Zakim, aaaa is Max_Turn 16:02:43 +Max_Turn; got it 16:02:47 +MECallahan 16:02:49 zakim, aaaa is MaxOchoa 16:02:49 sorry, ninja, I do not recognize a party named 'aaaa' 16:02:50 ChrisPedigoOPA has joined #dnt 16:02:57 Brooks has joined #dnt 16:03:01 Thank you, Nick 16:03:04 dsinger has joined #dnt 16:03:07 +[CDT] 16:03:07 +vinay 16:03:08 zakim, cdt has me 16:03:09 +justin; got it 16:03:12 +Brooks 16:03:13 zakim, who is on the phone? 16:03:13 On the phone I see walter, moneill2, Ninja, WaltMichel, Jack_Hobaugh, Carl_Cargill, npdoty, Chris_Pedigo, Max_Turn, RichardWeaver, johnsimpson, eberkower (muted), WileyS, 16:03:17 ... MECallahan, [CDT], vinay, Brooks 16:03:17 [CDT] has justin 16:03:17 +kulick 16:03:31 thanks for talking to Zakim for me.... 16:03:35 Carl_Cargill has joined #dnt 16:03:47 zakim, choose a scribe 16:03:47 Not knowing who is chairing or who scribed recently, I propose johnsimpson 16:03:56 zakim, choose a scribe 16:03:56 Not knowing who is chairing or who scribed recently, I propose [CDT] 16:03:58 kulick has joined #dnt 16:03:58 zakim, choose a scribe 16:04:00 Not knowing who is chairing or who scribed recently, I propose RichardWeaver 16:04:08 +Peder_Magee 16:04:16 ii am not in good position do that, sorry 16:04:28 magee has joined #dnt 16:04:28 +dsinger 16:04:30 scribenick: ninja 16:04:43 +SusanIsrael 16:04:51 susanisrael has joined #dnt 16:05:12 topic Last Call feedback 16:05:25 Topic: Last Call feedback 16:05:25 justin: We received feedback from 24 commenters 16:05:32 Chapell has joined #DNT 16:05:46 ... team started to sort these and will have a call with editors tomorrow to discuss them. 16:06:13 ... Looking for input to tackle the technical once and then bring them all to the group. 16:06:33 ... Could take one or two more weeks. 16:06:33 +Chapell 16:06:39 the public list is archived, if you've been wanting to review them: http://lists.w3.org/Archives/Public/public-tracking-comments/2014Jun/thread.html 16:06:56 https://www.w3.org/wiki/Privacy/TPWG/Change_Proposal_Limitations_on_use_in_Third_Party_Context 16:06:59 ... Would like to make some progress on text proposals for TCS meanwhile. 16:07:01 schunter has joined #dnt 16:07:15 zakim, take up agendum 1 16:07:15 agendum 1. "Context Separation" taken up [from ninja] 16:07:31 Due date for responses? 16:07:49 justin: Hope I updated Walter's proposal in a way that everybody is happy. Last minute friendly amendments. 16:07:52 I ask as many people will be out on vacation next week in the US so we should move any deadlines to be after next week. 16:08:26 Could we please move that out one week? 16:08:32 q+ 16:08:36 ... Answering Shane's comment: The open CfO on Issue 170 runs until next week. 16:08:37 fielding has joined #dnt 16:08:39 Also question if we should hold a meeting next week - perhaps a straw poll. 16:09:00 +q 16:09:09 ack WileyS 16:09:10 ack wileys 16:09:13 +Fielding 16:09:14 ... Regarding the new CfO two weeks seems like sufficient time. But will discuss with other chairs. 16:09:41 WileyS: Next week many colleagues will take the whole week off. 16:09:53 chapell out next week 16:09:53 I'm off next week as well 16:09:55 +[IBM] 16:09:58 I think July 2 is deadline for current call for objection. 16:10:09 AnnaLong has joined #dnt 16:10:32 ... If we have most of the WG unavailable it could make sense to skip the WG call. And push the CfO deadline. 16:10:52 +Amy_Colando 16:11:06 may well be out 16:11:06 justin: Nothing against it. Will take it back to the Chairs to decide. But seems reasonable. 16:11:11 i'm out 16:11:20 np 16:11:28 ... Strawpoll on who is missing the call next week. 16:11:31 not sure if can make next week, not clear uet. 16:11:39 I will be out the week after the 4th (MPEG meeting) 16:11:45 Up to 8 people either out or possibly out 16:12:17 justin: Back to context separation... 16:12:21 https://www.w3.org/wiki/Privacy/TPWG/Change_Proposal_Limitations_on_use_in_Third_Party_Context 16:12:22 Chris_M has joined #dnt 16:12:22 kj has joined #dnt 16:12:56 +??P64 16:13:08 Sorry to be late, I just joined the call 16:13:20 ... I think I managed to combine all friendly amendments into one text proposals (Walter, Alan, Mike) 16:13:31 ... Alan, are you ok with this? 16:13:35 cOlsen has joined #dnt 16:13:55 the updated language makes things clearer 16:14:04 ... Seeing none angry on the queue 16:14:08 +[FTC] 16:14:31 , thats fine 16:14:46 agree the updated language does what I want 16:14:48 ... Mike did a third revision including unique identifiers. I would rather keep this separate in data minimization. 16:15:00 ... Mike, are you ok with that? 16:15:20 Moneill2: Agreed. 16:15:37 q? 16:15:46 q+ 16:15:59 q- walter 16:15:59 q- 16:16:27 nick and ninja will set up a Call for Objections on issue-219 to go out today 16:16:30 ack fielding 16:16:46 fielding: I would prefer if the part about “first party” would be less ambiguous 16:16:56 or in a a first party quality 16:17:11 I'm assuming editorial fixes (like, we typically use language like "third party to a given user action") 16:17:13 fielding, Could you type that. I was too slow? 16:17:15 if that isn 16:17:19 Can you post the updated text with Roy's proposal? 16:17:21 't proper English, apologies 16:17:31 the third party MUST NOT use data gathered in another context about the user, including when that party was a first party. 16:17:46 the third party MUST NOT use data gathered in another context about the user, including data collected as a first party. 16:17:49 vincent has joined #dnt 16:17:50 justin: typed the text suggested by fielding. 16:18:14 yes, first one I think 16:18:15 looks fine to me 16:18:22 +1 to "that party was a first party" 16:18:32 first one seems clearer 16:18:32 justin: Agree with Nick that this is an editorial issue. 16:18:45 ... thanks for drawing attention to that. 16:18:52 q? 16:19:09 https://www.w3.org/wiki/Privacy/TPWG/Change_Proposals_on_data_minimization 16:19:24 ... Close the discussion on this now. 16:19:35 zakim, take up agendum 2 16:19:35 agendum 2. "Data Minimization" taken up [from ninja] 16:20:11 oh, and that should be collected instead of gatehered, since we have only defined collected 16:20:13 from mike: http://lists.w3.org/Archives/Public/public-tracking/2014Jun/0075.html 16:20:30 ... Mike sent an email on 5:31 regarding unique identifiers. 16:20:43 s/gatehered/gathered/ 16:21:29 I've changed gathered to collected on the wiki, which I believe is editorial (+1 to fielding's comment) 16:21:34 Moneill2: Broke it into two bits unique identifiers outside of permitted uses and storage in the browsers. 16:21:58 editorial: “the users explicit consent” -> “the user’s explicit consent" 16:22:17 justin: could be less controversial than I thought. So you don't want to prohibit unique identifiers for permitted uses. 16:22:17 q+ 16:22:26 isn't this more of limitation or what is permitted by permitted uses? 16:22:35 or qualification rather 16:23:23 +q 16:23:40 q+ to ask if this is just an example of data minimization 16:23:45 limited to the extent needed is already a general requirement on permitted uses 16:23:55 ack walter 16:24:03 the mode of tracking should be irrelevant for the DNT spec 16:24:17 Moneill2: The part about storage in the browser is intended to limit the use to the duration necessary for permitted uses. 16:24:32 q? 16:24:53 tracking can be used for a variety of permitted uses: security, site-user state maintenance (shopping cart, etc.)... 16:24:55 walter: Mike's proposal would be explanatory language to add to the editor's draft 16:25:04 ack wileys 16:25:17 walter: I would support Mike's Proposal but might be too technical. Maybe Pending Review. 16:25:50 WileyS: Think Mike's proposal is too broad. Would like to draw in de-identification. 16:26:05 not sure why we need talk about "device fingerprinting" in this spec? 16:26:18 +q 16:26:19 eh, points 16:26:30 ... If you have no need for permitted use or timeframe has expired we need to take up de-identification. 16:27:09 q+ 16:27:12 ack npdoty 16:27:12 npdoty, you wanted to ask if this is just an example of data minimization 16:27:13 matt has joined #dnt 16:27:14 ack npd 16:27:39 justin: Valid point. Could also be valid under HiPAA standards. 16:27:48 "After there are no remaining permitted uses for given data, the data MUST be deleted or deidentified. " 16:28:01 fielding, thank you --- replaced gathered with collected 16:28:14 npdoty: The general requirement for permitted uses is data MuST not be stored longer than necessary. 16:29:06 ack mon 16:29:19 justin: Mike' what do you think about Shane's point? 16:29:58 Moneill2: Even pseudonymous data is identifiable as it is linked to a specific device. 16:30:13 regarding the text, would Mike be supportive of using this as an Example rather than additional requirements? 16:30:24 ...Privacy friendly opt-out cookies don't include a user ID 16:30:55 justin: I think there is a distinction between pseudonymous data and de-identified data. 16:31:27 current definition on deidentified is present here: http://www.w3.org/2011/tracking-protection/drafts/tracking-compliance.html#deidentified 16:31:32 Moneill2: If you collect a unique bit pattern this cannot be de-identified. Can of worms. 16:31:59 q? 16:32:02 (we have an issue on that, but something like those requirements would make that definition) 16:33:00 ack walter 16:33:01 justin: Suggest more high-level language. Ask Mike to take a look at section ? and see whether he wants additional text. 16:33:42 Opinion noted - lets move to CfO 16:34:19 for what it's worth, moneill2, it looks like Dan Auerbach's proposal was to be a general requirement to apply to all permitted uses, which would have been in this section of general requirements / minimization 16:34:21 walter: De-identification as anonymization is much much harder than we think it is. 16:34:46 Most Working Group members support the concept of de-identification. I would always argue companies shouldn't release de-identified data publically - to remove the NYC Taxi scenario 16:34:48 ninja: also, it should not be part of the conversation on minimal use in the context of permitted uses 16:35:07 ninja: it is put in as a get-out-of-jail-free card 16:35:31 justin: We have a separate issue on de-identification. So let's keep it apart. 16:36:04 https://www.w3.org/wiki/Privacy/TPWG/Change_Proposals_on_link_shorteners_and_ID_providers 16:36:08 zakim, take up agendum 4 16:36:08 agendum 4. "Link shorteners/ID providers" taken up [from ninja] 16:36:22 Chris_M has joined #dnt 16:36:32 justin: Ninja included some old text proposals on ID providers. 16:36:51 WileyS: what I argue is that the NYC taxi scenario was data that people thought was deidentified while it wasn't 16:36:56 ... This is about the FB connect use case 16:37:06 justin: I thought I'd have more than one week for that proposal, sorry for that misunderstanding 16:37:23 ... Two proposals from Ian Fette and Rob van Eijk. 16:37:39 ... Not sure if anyone wants to continue the discussion on this. 16:37:42 I don’t see anything about link shorteners here 16:38:10 ... Walter did you want to suggest text on link shorteners? Maybe you could manage this week? 16:38:38 q? 16:38:42 ... The sooner we get ideas for the group the better. 16:38:42 q+ 16:38:45 WileyS: basically data is only properly deidentified when you're comfortable publishing it, and probably not even then 16:38:56 I think we need a discussion document on identity providers. So, I logon to a newspaper site using my FB ID. Is FB a first party now? 16:39:00 Walter: we can agree to disagree 16:39:21 Collect and use - perhaps not share 16:39:39 ninja: I went through the old discussion threads on this. Shane seemed to agree that ID providers can anyway get permission to track despite being third-parties. 16:39:40 dsinger: am I an heretic for thinking that FB may be one during the login procedure? 16:39:46 Can we separate the two? ID providers really has nothing to do with link shorteners. There should also be an issue about third party referral trackers. 16:39:58 OpenID requires direct user authentication we agreement to both terms and PP - so this will trump anything this group says 16:39:59 how can the identity provider NOT know that you are trying to logon to the newspaper? 16:40:00 fielding: agree, they are very different from link shorteners 16:40:06 justin: Yes, they could ask for permission. 16:40:17 I would like to split link shorteners and identity providers, yes 16:40:24 ... fielding's request to separate is fair. 16:40:42 q? 16:40:44 agree with Roy on the third also 16:40:45 s/we/with 16:40:48 q- ninja 16:40:55 ... we grouped them as a number of edge cases. But there may be no text to merge them into one case. 16:41:01 they share a wiki page, but already have two different issues in the tracker 16:41:08 can we have a refresh/discussion piece on identity providers? 16:42:19 justin: Under Ian's proposal if you log on to NYT via Facebook, FB would be a first party. 16:42:30 +1 to David! 16:42:33 Duh 16:42:38 q+ 16:42:46 that's right dsinger 16:43:03 ... Under Rob's proposal FB would only authenticate and stay a third party 16:43:11 dsinger, there are proposals (like Persona/BrowserID) to enable signing on without telling the authorizer where you're signing in 16:43:27 dsinger: Don't understand the use-case. How can FB not know I log onto NYT. 16:43:44 thx Nick, that should be in the discussion piece. I (we?) need education and a refresh 16:44:10 If the Like button is on those pages, then yes 16:44:24 maybe the question is: is FB a 1P or 3P in the case where their authentication tool was used 16:44:30 justin: If I authenticate via FB do they need to know every page I read? 16:44:32 q- 16:44:38 Please read their privacy policy - if you are logged into Facebook then they recognize you against your registered persona on that page 16:44:52 ... Does not work well with FB example 16:44:55 To turn this off, you simply log out of FB 16:45:05 schunter has joined #dnt 16:45:09 DNT does not trump authentication 16:45:10 what happens with the "keep me logged in" option in the FB authentication? 16:45:30 I think this is distinct from rules around the ‘like’ button. They are not linked; the question of whether the ‘like’ button can track me even if I am logged in should be separate 16:45:37 justin: That is how Twitter reacts to DNT currently via their widgets 16:45:50 q+ 16:45:51 A user has logged-in: they agree to Terms and a PP in doing so. 16:46:00 I suspect that none in the group would argue that when you authenticate with a party, you're engaged in a first-party interaction with them. the question just seems to be whether an authenticated session cookie to additional interactions should make those interactions first-party 16:46:07 ... This is not meant as DNT trumps authentication or consent based on terms of service. 16:46:10 authentication is usually done via 1st partry cooki, not 3sr p elements on apages 16:46:13 ack ds 16:46:50 dsinger: Whether the like button can track you is a different question. 16:46:53 Their Privacy Policy states they recognize you when you see the Like button on other sites. As you've choosen to login into Facebook, then you as the user understand this trumpts DNT 16:47:01 do not need fb like button for authentication to work 16:47:19 ... ID providers need to know what you want to log on to. 16:47:30 justin: Agreed. Let us keep the separate. 16:47:34 Agreed - OpenID and OpenAuth don't require a page level widget 16:47:41 that begs the question, is there a state where FB is NOT a first party under this spec? 16:47:53 ... Further work on the text proposals is necessary. 16:48:00 I think maybe we're getting into separate conversations about whether Terms of Service from other sites would count as express consent to override DNT. 16:48:06 WileyS: which won't fly in most civilised jurisdictions 16:48:19 If you're not logged-in, then FB is not a 1st party 16:48:21 (that was about the like button) 16:48:34 WileyS: even if you're logged in FB would be a 3rd party in my book 16:48:38 justin: To Alan's question: Rob's text proposal makes them a third party 16:48:49 Walter - the user has agreed to a different premise 16:48:51 q? 16:49:06 ... Question the terms of service and user information is sufficient for consent. 16:49:21 WileyS: no, the user hasn't. Under EU consumer law the user could not reasonably foresee this consequence and that line in FB's terms & conditions would be null and void 16:49:28 why does my login status on a different window impact my status with a like button when I go to a page which I don't know until after the fact has a like button? 16:49:30 ... I will reach out to Rob to review his old proposal. 16:49:35 WileyS, agree with walter, at most they have on OOBC (which should be revokable) but they still a third party 16:49:41 Walter, the Irish DPA disagrees with you :-) 16:49:45 ... If folks are interested in pursuing this, please do so. 16:49:47 ninja: Rob is unavailable this week due to family circumstances 16:50:02 WileyS: the Irish DPA tends to consistently get trashed in the CJEU 16:50:05 +1 to Brooks on that point, although again I don't think that's the current issue :) 16:50:10 WileyS: it is the most useless DPA around 16:50:11 zakim, take up agendum 3 16:50:11 agendum 3. "Use of "tracking" in compliance" taken up [from ninja] 16:50:25 Walter: we'll again agree to disagree 16:50:41 wiki: https://www.w3.org/wiki/Privacy/TPWG/Change_Proposal_Tracking_Third_Party_Compliance 16:50:51 I was mostly offline last week 16:51:20 ... Authors have not have a chance to review these old proposals yet. 16:51:29 q? 16:51:39 ... Let's take this offline hopefully won't be too controversial. 16:51:45 ... AoB? 16:51:46 dsinger has done some work to merge those two proposals, which we can take to the mailing list 16:52:11 thanks, bye 16:52:13 ... thanks everybody. Adjourned. 16:52:25 johnsimpson has left #dnt 16:52:50 Zakim, list attendees 16:52:50 As of this point the attendees have been walter, moneill2, Ninja, WaltMichel, Jack_Hobaugh, Carl_Cargill, npdoty, Chris_Pedigo, +1.650.362.aaaa, +1.310.292.aabb, RichardWeaver, 16:52:53 ... +1.646.654.aacc, WileyS, johnsimpson, eberkower, Max_Turn, MECallahan, vinay, justin, Brooks, kulick, Peder_Magee, dsinger, SusanIsrael, Chapell, Fielding, [IBM], Amy_Colando, 16:52:53 ... [FTC] 16:52:54 rrsagent, draft minutes 16:52:54 I have made the request to generate http://www.w3.org/2014/06/25-dnt-minutes.html ninja 17:25:35 robsherman has joined #dnt 17:39:27 schunter has joined #dnt 18:10:29 schunter has joined #dnt 20:03:15 schunter has joined #dnt 21:08:25 schunter has joined #dnt 22:02:09 schunter1 has joined #dnt 22:21:42 fielding has joined #dnt 22:37:28 schunter has joined #dnt 23:15:23 schunter has joined #dnt 23:59:00 npdoty has joined #dnt