Tracking Protection Working Group Teleconference -- 08 Apr 2015

<npdoty> trackbot, start meeting

<trackbot> Date: 08 April 2015

<trackbot> Meeting: Tracking Protection Working Group Teleconference

<trackbot> Date: 08 April 2015

<justin> Can someone scribe what should hopefully be a very short call today?

sure, I’ll do it

<npdoty> scribenick: dsinger

<scribe> scribenick: dsinger

justin: short call, only one issue.

<fielding> https://lists.w3.org/Archives/Public/public-tracking/2015Apr/0002.html

<justin> https://lists.w3.org/Archives/Public/public-tracking/2015Apr/0002.html

justin: working off Roy’s email; we need to address ‘tracking data’ as we use the term and it’s not defined

… there are a handful of places in TCS. Walter has concerns on the changes

<WileyS> My concerns were that Walter's language expands scope

… today we’ll walk through this. This discussion include ‘de-identification’.

<npdoty> these are non-normative considerations, I believe

… Roy wanted to remove ‘tracking data’ from the text, Walter objected, we would like to understand why.

…notes that Walter is not on the phone to explain. Nick volunteers to try

npdoty: shares the confusion. Doesn’t see what the problem is; merging with ‘original tracking data’ changed seems to make sense

<npdoty> I'm fine with removing the text in that section, per fielding's latest email

justin: anyone else object to removing the term ‘tracking data’ from de-identification?

<fielding> Yep, it is just another example (which happens to contradict the definition, which might lead people tp think they can retain the original tracking data)

… no-one seems to object for the other two changes: permitted uses (changed to ‘that data’)…

<npdoty> +1

… the other example was a qualifier for permitted uses: tracking data -> data about that activity

… neither seem controversial.

<npdoty> yeah, that was just an example I drafted; I'm fine with changing it.

… the other place is 3rd party compliance. “must not collect, share…tracking data”

… Roy found this vague or contradictory. Prefers to re-write. (we need a link to the email).

<fielding> https://lists.w3.org/Archives/Public/public-tracking/2015Apr/0002.html

npdoty: “collecting data that would result in” seems problematic

<vincent> my concern is about the "*this* particular user's activity to have been collected across multiple distinct contexts"

… it’s not clear who is doing the tracking (it’s expressed in the passive): what happens if I convey data that doesn’t, to someone else, and the result is that they do?

<fielding> so we should say "party" again?

justin: seems like that is addressed. you’re not allowed to share outside the context, and you’re not allowed to track cross contexts yourself. is there a hole? is there language to address that?

<npdoty> https://lists.w3.org/Archives/Public/public-tracking/2015Mar/0028.html

<WileyS> Then they are the party responsible for honoring DNT signals, if any, as there was no way for the first party which responded they were not tracking to preconceive a future party to leverage shared data for a tracking purpose.

npdoty: what I suggested is to add a prohibition on sharing, to stop the 4th party problem

justin: but Roy does prohibit sharing (2nd bullet)

npdoty: maybe I am confused by retain…share

fielding: I am trying to use the same words as the definition

… if a 4th party (?) is collecting in a single context, that doesn’t violate tracking

justin: you can share within that context, but not with a random data broker out of context,

<vincent> my understanding is that Roy's proposal would allow collection of different user's activities accross different context

fielding: and you can’t retain youself across multiple contexts

justin: to Vinecent

<npdoty> maybe fielding's second bullet could just be "share", and then it makes more sense to me

Vincent: my concern is about this user’s activity, doesn’t seem related to the current interaction. Not sure if you’re allowed to collect data about the user, but different activities in different contexts.

justin: you can’t collect data that results in you haveing data [about that user] about multiple contexts: that puts you in violation

… seems tighter than the use of the words ‘tracking data’

… do you have an example that this does not prohibit?

vincent: for example if the user visits two web sites, two activities, that would seem allowed

<npdoty> I think there was confusion about the scope of "particular"

fielding: we have an english ambiguity, the scope of ‘activity’, so maybe say ‘activity by this user’?

justin: maybe I don’t fully understand the concern

<npdoty> "data regarding this particular user" -- do we even need "activity"?

fielding: depends on how you parse the sentence.

[silence]

<fielding> regarding activuty by this particular user?

npdoty: how about “data from this particular user being associated across multiuple contexts"

<npdoty> collect data from this network interaction that would result in

<npdoty> > data regarding this particular user to have been

<npdoty> > collected across multiple distinct contexts

<vincent> sounds good to me

fielding: fine by me

justin: then we’ll do that

<WileyS> Its the mixing of the contexts that are the issue - not if the data is managed within only the context in which it was collected originally, correct?

dsinger: if I remember I served an ad to a user who visited say the NYT, isn’t that two contexts?

<npdoty> WileyS, I think the "share" bullet is about limiting the sharing of data about one context with other parties

<WileyS> Frequency capping is carved out

fielding: yes, but it’s a permitted use.

<WileyS> Nick, but this change is about "collected data...across multiple distince contexts"

dsinger: but generally, except for permitted use, an ad server can remember it served an ad to a user, but not that it was on the NYT; or it can remember the BYT and the ad, but not the user

npdoty: not sure that’s my understanding;

justin: is there an example of an ambiguity?

dsinger: list the thread in the process of scribing

<npdoty> npdoty: if I'm embedded in the NYT and remember the user's visit to the NYT, that's not by itself tracking, I think.

justin: we’ll send around the revised proposed edit

… no-one seemed to echo Walter’s concern

… otherwise, at least for this call, we seem aligned on the text

… any other substantive issues outstanding?

<WileyS> What is left on TCS?

… is everything ironed out, Nick?

npdoty: I think so

<npdoty> fielding, perhaps offline, I'm not sure I understand "retain, use or share" in that second bullet, rather than just "share"

justin: we can check that there is nothing outstanding
... sent out a list of issues that are either closed or superseded

<WileyS> Roy responded - and we agreed with his statements so didn't respond.

… only Roy responded, noting we are still dealing with user tracking

<npdoty> I'll mark 203 as pending review once I've made remaining changes about tracking data

… another can be closed, was open for future ref.

… what else do we need to do on TCS?

<WileyS> Should we do one full clean read like we did with the TPE?

<justin> Right that.

npdoty: I think when we were wrapping up TPE, we made the changes, and then we gave people 2 weeks to review for LC

<WileyS> We did a full read - then a few weeks wait - then went for public comment

<fielding> npdoty, can we change the citation for TPE to [TPE] instead of [TRACKING-DNT]? It reads better.

justin: so we’ll send an email saying this is a LC candidate, give people 2 weeks to review

… timeframe when that will be ready?

<npdoty> sure, fielding, can you send me an email reminder about that

npdoty: no later than Monday next (apr 13)

<WileyS> What volume of meaningful comment/push-back will it take to abandon the TCS (and only move forward with the TPE)?

justin: we don’t need to do a call; we’ll send it out and invite comment to the list

<fielding> I can do it myself if you like … easy global replace.

… will also send a summary of today’s call, to make sure Walter is informed

… AOB?

[silence]

… hearing none, we’ll talk again soon

adjourned

<justin> thanks dsinger for scribing

<npdoty> trackbot, end meeting

- DRAFT -

Tracking Protection Working Group Teleconference

08 Apr 2015

Attendees

Contents

Summary of Action Items

Scribe.perl diagnostic output