15:56:23 RRSAgent has joined #dnt 15:56:23 logging to http://www.w3.org/2014/10/15-dnt-irc 15:56:25 RRSAgent, make logs world 15:56:25 Zakim has joined #dnt 15:56:27 Zakim, this will be TRACK 15:56:27 ok, trackbot; I see T&S_Track(dnt)12:00PM scheduled to start in 4 minutes 15:56:28 Meeting: Tracking Protection Working Group Teleconference 15:56:28 Date: 15 October 2014 15:57:14 justin has joined #dnt 15:59:04 fielding has joined #dnt 15:59:19 T&S_Track(dnt)12:00PM has now started 15:59:27 +npdoty 15:59:30 +Fielding 16:00:10 +hefferjr 16:00:12 schunter has joined #dnt 16:00:23 +??P30 16:00:30 +Carl_Cargill 16:00:33 Zakim, ??P30 is schunter 16:00:33 +schunter; got it 16:00:43 Zakim, clear agenda 16:00:43 agenda cleared 16:00:49 moneill2 has joined #dnt 16:00:54 Carl_Cargill has joined #dnt 16:00:55 WileyS has joined #DNT 16:00:56 WaltMichel has joined #DNT 16:00:57 agenda+ TPE Last Call 16:01:03 agenda+ Compliance issues 16:01:06 agenda+ AOB 16:01:30 +justin 16:01:33 +[FTC] 16:01:34 zakim, who is on the phone? 16:01:34 On the phone I see npdoty, Fielding, hefferjr, schunter, Carl_Cargill, justin, [FTC] 16:01:47 +WileyS 16:01:52 +WaltMichel 16:01:55 +[IPcaller] 16:02:04 zakim, [IPCaller] is me 16:02:04 +moneill2; got it 16:02:32 vinay has joined #dnt 16:02:41 + +1.917.934.aaaa 16:02:52 zakim, aaaa is vinay 16:02:52 +vinay; got it 16:03:07 scribenick: moneill2 16:03:23 Zakim, take up agendum 1 16:03:23 agendum 1. "TPE Last Call" taken up [from npdoty] 16:03:31 last few issues 16:03:36 vincent has joined #dnt 16:03:54 justin, issue 262 16:03:55 issue-262? 16:03:55 issue-262 -- guidance regarding server responses and timing -- pending review 16:03:55 http://www.w3.org/2011/tracking-protection/track/issues/262 16:03:59 +vincent 16:04:21 dsinger has joined #dnt 16:04:27 justin, real time bidding 16:04:44 http://lists.w3.org/Archives/Public/public-tracking/2014Oct/0064.html 16:04:45 +[Apple] 16:04:51 zakim, [apple] has dsinger 16:04:51 +dsinger; got it 16:05:11 shane, how do we deal with dnt in environs where downstream has no access to\ UA 16:05:37 shane, in EU Rigo talked abour "transative" requirement 16:06:13 shane, receiver must forward DNT / TK toupstream/downstream 16:06:38 s/shane,/shane:/ 16:06:40 s/shane,/shane:/g 16:06:55 shane, could be conflict if use passes DNT 1 but direct domain has DNT:0 16:07:20 q+ 16:07:26 shane, makes sense that processor must relay that in status response 16:08:05 shane, dont know how technically to make it work 16:08:36 in most cases, though, the status response isn't an immediate response from the server. would we expect all servers to make TSR requests and then construct TSR responses on their behalf? 16:08:53 shane: a bid goes to 10 server, each will respond with bid, ad exchange sent forward its DNT signal 16:09:45 shane: other parties may have different UGE, if win bid their ad goes forward. So theie tr: should go to UA 16:10:07 shane: UA gets conflicting signals 16:10:49 q+ is this entirely server-to-server, or does the winning bidder ever interact with the end user via HTTP? 16:10:50 shane: not at same time. server to server. the last transaction applies 16:10:51 would like to understand, does the exchange act as a proxy to the winning bidder, or does it re-direct the UA? I assume the problem is the former, and the winning bidder (thinks it) has an exception, while the exchange does not 16:11:00 q+ to ask is this entirely server-to-server, or does the winning bidder ever interact with the end user via HTTP? 16:11:13 justin: how will exception gets revoked 16:11:38 shane: then no last transaction, 16:12:03 is it at all likely that the winning ad bidder has a web-wide exception? 16:12:10 dsinger, it seems to me that Shane is suggesting this just for the server-to-server case, not the 301/302 redirect situation 16:12:14 ack vincent 16:12:27 Correct - just in server-to-server 16:12:46 vincent: question, i send DNT: 1 to server, server should not be allowed to share 16:13:10 shane: just facilitating delivery of ad, no info shared 16:13:14 to npdoty: right, in the re-direct case the winning bidder ends up communicating directly with the UA. It’s where the exchange stays in loop (like a proxy) that we have an issue 16:13:39 shane, how do downstream servers know who the user is (w/o UID sharing) 16:14:27 vincent: if ad exchange respects DNT, but down stream dony, third-party would hav eto honoure 16:14:49 q? 16:14:55 -schunter 16:14:59 q+ to ask how likely this is 16:15:02 shane: ad exchanhe actingh as data processor, endpoints are controllers 16:15:34 +??P3 16:15:38 Zakim, ??P3 is schunter 16:15:38 +schunter; got it 16:15:51 shane: within same transacrtion primary endpoint is processor not controller 16:16:26 shane: loss rules and win rules. bidding 16:17:09 shane: contractually endpoints not allowed to keep data 16:17:14 it sounds like the suggestion is that the ad-exchange is a processor or even our "service provider" to the other parties [?] 16:17:46 shane: scenraio processor acting as frontend to many controllers 16:17:50 but if the exchange promises to honor it, it had better (a) relay it to (b) servers that will also honor it 16:17:58 shane: not goal of DNT 16:18:44 ack npd 16:18:44 npdoty, you wanted to ask is this entirely server-to-server, or does the winning bidder ever interact with the end user via HTTP? 16:18:47 justin: we are not trying to defaet ad exchange system, ad might need to collect info for billing purposes 16:19:06 nick: only talking about server- server convos 16:19:08 Correct - this is not meant to cover redirection 16:19:23 nick: question to shane 16:19:34 Correct - the Ad Exchange is a Service Provider 16:19:53 nick: ad exchange working on behalf od one of the endpoints i.e. the winner 16:20:23 nick: tpe designed tr rresponse not always real-time response 16:20:34 FWIW, I think it would be hard to argue under EU law that adx is a "processor." But I get the notion that they're acting as a pass-through here. 16:20:46 nick: ad exchjanhge has to check and get response? q to shane 16:21:21 I don't see any difference. The exchange receives the HTTP request. The exchange is responsible for its own TSR. If the exchange shares the data received with third parties, then the exchange is responsible for reporting the worst case to the user in its own TSR. 16:21:47 shane: difficulty is async process. some cases ad delivered by exchange, i agree stst resp not bbuilt to work for this use case 16:22:01 justin, indeed they would not qualify as a processor 16:22:04 shane: dont know how to deal with disconnect 16:22:40 ack dsinger 16:22:40 dsinger, you wanted to ask how likely this is 16:23:29 david: one of the winners supplies ad, thinks it has OOBC or would have received DNT:0 if it was talking directly 16:23:34 shane: yes 16:23:45 q+ 16:24:39 david: ad server has web-wide UGE. This is a little unlikely. If endpoints want to directly interface with user then they should, how ad is converyed is opache, 16:24:57 david: this is unsolved in first version of DNT 16:25:01 jeff has joined #dnt 16:25:03 ack fielding 16:25:26 +Jeff 16:25:43 roy: user has opportunity to interact with ad exchange and noone else. In this situation it is excahnges responsibility 16:26:02 service providers have to know how to respond on behalf of their contractees, right? 16:26:11 shane:ad exchange is neutral in transaction 16:26:32 david: if it promises to bey DNT it needs to get others to honour 16:27:14 shane: David is saying if it obeys DNT then all bidders must also 16:27:21 s/bey/obey/ 16:27:38 q+ to ask about tracking status response and timing, as was the original suggestion 16:27:41 shane: we cannot force them to take position 16:27:54 shane: dangerous for biz to do that 16:28:34 +q 16:28:46 roy: ad exchange is not neutral, it has to take responsibility, like any other company in biz, if they cant they cant support DNT that is the end of it 16:29:25 ack npd 16:29:26 npdoty, you wanted to ask about tracking status response and timing, as was the original suggestion 16:29:26 justin: how under current defintion can ad exchange sent any response 16:30:23 nick: back to timingh. in case of prefetch, ad exhange has to respond with sih=gnal reflecting union of its contractees 16:31:27 nick: ad exchanges cannot claim ahead of time, bur they can send after event indication 16:31:28 ack wiley 16:32:33 shane: all parties have contracts, in most cases ed exchanges cannot force changes or 100% coverage. lets adobe analytics as example 16:32:34 so we have TWO problems (a) ad exchanges don’t know if all their bidders support DNT and (b) the winning bidder might think it has OOBC or a web-wide exception 16:33:02 dsinger, I think the issue was asking about (a), though Shane's text is about (b) as well 16:33:03 shane: does adobe: respond as themselves or the party they are acting for 16:33:05 The only thing that TPE requires here is that the response from the exchange (the only HTTP server) reflects how that exchange deals with the data. If the exchange cannot control what its bidders do with the data in the presence of DNT:1, then they cannot claim in their own exchange TSR that they are obeying the restrictions of DNT:1. 16:33:43 shane: its not fair to say exchanges need to support DNT to relay their contractees responses 16:34:02 how much does the “?” tracking status help? 16:34:19 yeah, I think it does 16:34:43 justin: how about privacyBadger. What can an intermediary send back. No auditability. How does UA control who gets info 16:34:58 if the exchange sent a "?" in a pre-fetch request, and then sent a Tk header in response 16:34:59 q+ 16:35:15 shane: many ads today go through exchange so we need to deal with this 16:35:43 justin: can a winning bidder say they have consent 16:35:44 So, the tracking status of the exchange says “?”. When the ad is served, the actual status from the bidder is sent. 16:36:00 we need to cover the case of request-specific TSRs. Roy, can you help? 16:36:39 shane: winner selected, what is the response from bid winner or processor (ad exchange) wo received the DNT request 16:36:58 dsinger, I don't think request-specific TSRs is a problem. that's only if a response says, "use this particular code" 16:37:06 shane: bid winner can represent themselves directly to UA 16:37:36 justin: person serving this ad either honours DNT or has consent 16:37:57 shane: we might have to pass on the domain of the bid winner 16:38:27 shane: ad exchange does not want to be the middle man. 16:39:05 Shane, when acting as a service provider there is a contract that specifies who controls the data and we can respond with the TSR on behalf of that contractee (first party) according to their instruction. The only ways we can cover your use case is by the exchange sending the set of all potential TSRs for all potential bidders (which is known to be impossible) or by the exchange providing a worst-case TSR to the use based on its bidding agreement requirements. 16:39:27 I think the "?" is appropriate, and then send a Tk response header on behalf of the winning bidder 16:39:36 justin: we spent abunch of time on this, continue to think, iterate, understand issue. should TSV need updating etc. 16:39:40 s/use based/user based/ 16:39:41 Roy, Yikes - those are both horrible outcomes. Other options? 16:39:44 ... or if an ad exchange does have contract agreements ahead of time, it can give something more specific 16:39:48 yes, will follow up in email. 16:39:52 isssue-268? 16:39:59 Nick, I like that option better. :-) 16:39:59 issue-268? 16:39:59 Sorry, but issue-268 does not exist. 16:40:07 WileyS, yes -- when DNT:1 is received, do a redirect instead of a gateway. 16:40:09 issue-266? 16:40:09 issue-266 -- automatic expiration of a tracking preference exception via API parameter -- raised 16:40:09 http://www.w3.org/2011/tracking-protection/track/issues/266 16:40:12 scribenick: npdoty 16:40:36 …was trying to keep life simple. 16:40:37 justin: discussion on the list. pushback about whether it's necessary for interoperability 16:40:45 Roy, that would make the ad serve fail as there is nowhere to redirect to if the ad creative for that winning bid is housed on the ad exchange 16:41:23 ... nick said it was mostly applicable to web-wide exception 16:41:56 QileyS, wouldn't it then be covered by the exchange's TSR? You would only need to redirect to winning bidders that you do not trust. 16:42:07 dsinger: if the user sends a DNT:0 and a cookie used for expiry is absent, the non-javascript party can't determine whether the request should expire 16:42:13 s/QileyS/WileyS/ 16:42:28 ... could add an optional expiry parameter 16:42:29 s/WileyS/Shane 16:42:45 ... added complexity 16:43:27 moneill2: user agents have cookie-like expiry code already, for cookies 16:43:51 Roy, I don't believe this is a question of "trusting" my customers - its more a matter of the actual mechanics of serving ads from an ad exchange. If the creative is stored on the exchange there is never an option to "redirect" to ad delivery. 16:43:53 ... and have to track the UGEs already, in an object model 16:44:20 ... transparency, UAs can show that detail to the end user 16:44:31 ... if you try to do it with cookies, nightmare of synchronicity 16:44:34 -schunter 16:44:45 ... have the UA implement the complexity, rather than spreading it out 16:45:03 q? 16:45:22 fielding: no harm for it, except for complexity for the browser 16:45:35 ... might as well include the cookie-like behaviors 16:45:35 EU Laws will likely change in the near future - I think we can manage with existing technology and come back to this if the EU Data Protection Regulation requires Expiry as the A29WP believes the current ePrivacy Directive strongly recommends. 16:45:43 it was just complexity and respecting people who have already implemented, on my part 16:46:23 npdoty: What is the likelihood this will be implemented? Will the browsers implement and will websites use? Will user agents push back on the complexity? 16:46:44 I agree with Shane. Websites either already are, or have, built out solutions to address current laws. Since there is no support for this now within browsers, websites will not be able to rely on this for at least the immediate future. 16:47:14 npdoty: We could add expiration like cookies, but we can't cover every possible use case (login, privacy policy changes, etc.). It will be up to the site to order expiration --- API is just about storing. 16:47:16 Honestly, I would still prefer to ditch the whole exceptions framework and just use specially-named cookies that browsers can avoid clearing if so configured. 16:47:35 scribenick: npdoty 16:47:57 cookies don’t cover site-wide. I agree, I think web-wide is very questionable 16:48:10 justin: could get rid of exceptions entirely (per fielding) 16:48:20 q? 16:48:40 ... could try to hear more from dsinger or adrian regarding UA implementation? 16:48:42 q- 16:48:50 Roy, wouldn't this require a change to the HTML standard to support non-clearable cookies - and in turn wouldn't that break EU guidance? 16:49:21 dsinger: could remove web-wide exception (and just expect it to be handle by cookies), or add expiration parameters to both versions of the call 16:49:30 Pure 3rd parties need web-wide exceptions! 16:49:43 justin: please send in email. 16:50:01 justin: on dsinger's remaining TPE LC issues 16:50:25 dsinger: responses from anne notes using an older style, cookie-like and cross-origin matching restrictions 16:50:38 Any suggestion to remove UGEs entirely or remove web-wide exceptions will further doom the DNT standard. If the target of the standard (almost entirely 3rd parties) have left with no tools to provide balance in the standard no one will adopt DNT. 16:50:41 ... but I haven't heard what a better way would be, with the more modern model 16:50:44 WileyS, alternatively (regarding earlier conversation) 16:50:45 , ensure that the bidders are not given enough information to track the user 16:50:53 ... it sounds like the dynamic matching wouldn't work 16:50:54 s/have/are 16:51:13 q? 16:51:21 nick, i can do it agin now if you want 16:51:26 scribenick: moneill2 16:51:41 Zakim, next agendum 16:51:41 agendum 2. "Compliance issues" taken up [from npdoty] 16:51:42 issue-148? 16:51:42 issue-148 -- What does DNT:0 mean? -- raised 16:51:42 http://www.w3.org/2011/tracking-protection/track/issues/148 16:51:52 action-460? 16:51:52 action-460 -- Nick Doty to Add language on dnt:0 re scope of consent preference -- due 2014-10-15 -- OPEN 16:51:52 http://www.w3.org/2011/tracking-protection/track/actions/460 16:51:52 justin: 3 issues i want to talk about, issue 148 16:52:11 justin: question to nick 16:52:15 Roy, that breaks the concept of bidding. For a bidder to understand the full context of the transaction to place the most accurate bid we need to give them enough information that arguably could be used to "track" the user. That's why all exchange contracts carry very specific clauses on "bid loss" rules. 16:52:17 nick: not yesty 16:52:33 justin: issue 24, 16:52:34 issue-24? 16:52:34 issue-24 -- Possible exemption for fraud detection and defense -- pending review 16:52:34 http://www.w3.org/2011/tracking-protection/track/issues/24 16:52:46 +kulick 16:52:57 from dsinger: http://www.w3.org/mid/65CF2BE9-E560-4904-BF66-AF7C2BFE9627@apple.com 16:53:00 justin: proposal ongraduated response 16:53:54 jjustin: shane said he was fine with, question to nick 16:54:09 +q 16:54:20 nick: if we can just note it is non-normative maybe were done 16:54:27 I am not wedded to my precise wording if Nick or anyone wants to suggest edits or an alternative 16:54:28 ack wileys 16:54:43 shane: give voice support to davids language. 16:54:55 Shane, I don't think people have figured out yet that looking up the tracking preferences before every request is a performance issue for browsers and will lead to UGE not being implemented. Cookies are already implemented and are already used for consent. Yes, it would require some update to browser cookie policy to allow certain cookies to not be cleared, but that won't be a problem if the cookie value is limited to a fixed value (0/1). 16:55:06 shane: all fixed, so supportive 16:55:18 justin: ok with mentioning term? 16:55:22 shane: yes 16:55:36 I don't think the current language is normative or prescriptive... 16:55:42 justin: q to nick to check this, 16:55:58 note that the proposal is 2-part: shorten the first paragraph and make the second one clearly examples and non-normative 16:56:06 Roy, has IE reported this as being a performance issue since they do it already today? I've not heard that issue raised yet from a browser vendor. 16:56:13 justin: we alo sounf to be on same page 16:56:33 nick: i can do a diff of mine and Davids langauge 16:57:18 Roy, I think the cookie path has other complexities related to 3rd party cookie blocking versus web-wide exceptions - and then the "non-clearing" elements from a regulatory perspective will likely create issues. 16:57:19 justin: if noone objects on principle, i incline to go with this, other folks take a look at at 16:57:28 Shane's concern: don't want it to be normative, want to emphasize that graduation can be in either direction, explicitly notes data minimization 16:57:35 I don't strongly prefer this - I'd still rather remove the whole non-normative section. 16:57:43 WileyS, did I get those changes right? 16:58:01 Nick, I believe so 16:58:04 thanks 16:58:07 issue-235? 16:58:07 issue-235 -- Auditability requirement in Reasonable Security section -- raised 16:58:07 http://www.w3.org/2011/tracking-protection/track/issues/235 16:58:12 2 mins :-) 16:58:13 justin: last issue 235 audibility 16:58:37 justin: shane he wanted to carry on with this 16:59:04 I want to remove the "auditable" element as I don't believe it has any value. 16:59:08 q? 16:59:08 justin: do group mambers still want clause about audibility 16:59:19 sentence in question: "That party SHOULD ensure that the access and use of data retained for permitted uses is auditable." 16:59:50 justin: lrts wraop up, nick send ideas on issue 262, 16:59:54 Shane, I don't know if Adrian has looked at the overhead issue. I know that the chrome and mozilla teams will, if they ever implement. Yes, the problem with cookies as a solution is the site-specific consent, unless someone institutes double-keyed cookies as well. 16:59:56 -vinay 16:59:58 -justin 16:59:58 thx 16:59:59 -kulick 16:59:59 -[FTC] 17:00:01 -vincent 17:00:02 -[Apple] 17:00:05 -Carl_Cargill 17:00:06 -npdoty 17:00:07 -WileyS 17:00:10 -moneill2 17:00:53 -Jeff 17:01:27 -hefferjr 17:01:55 -WaltMichel 17:05:48 npdoty, the problem with sending "?" is that the final response still has to be applicable to that same resource for 24 hours. perhaps we need to change that? 17:06:11 trackbot, end meeting 17:06:11 Zakim, list attendees 17:06:11 As of this point the attendees have been npdoty, Fielding, hefferjr, Carl_Cargill, schunter, justin, [FTC], WileyS, WaltMichel, moneill2, +1.917.934.aaaa, vinay, vincent, dsinger, 17:06:14 ... Jeff, kulick 17:06:19 RRSAgent, please draft minutes 17:06:19 I have made the request to generate http://www.w3.org/2014/10/15-dnt-minutes.html trackbot 17:06:20 RRSAgent, bye 17:06:20 I see no action items