13:07:07 RRSAgent has joined #dnt 13:07:07 logging to http://www.w3.org/2016/09/21-dnt-irc 13:07:07 frodek has joined #dnt 13:07:12 Zakim has joined #dnt 13:07:22 vincent_ has joined #dnt 13:07:25 present+ aleecia, matthias_matthiesen, nataliia_bielova, rvaneijk, wseltzer, barryleiba, dsinger, moneill2_ 13:07:43 schunter: Background 13:07:56 ... we published 2 CRs, TPE and TCS 13:08:12 ... TPE: If you're browsing the web, you can tell your browser to send signals about your tracking preference 13:08:16 JoeHallCDT1 has joined #dnt 13:08:16 ... that's the easy part 13:08:32 ... controversy: if a site receives "I don't want to be tracked," what should they do? 13:08:39 ... most sites today do nothing 13:08:48 ... status: we're at CR, waiting for implementations and use cases 13:09:06 [slide: TPE] 13:09:40 Can someone please send a link to the slides in irc? 13:09:41 schunter: the DNT header and the Tracking Status Object 13:10:47 -> https://lists.w3.org/Archives/Public/public-tracking/2016Sep/att-0015/W3C-TPAC-TPWG-Breakout-Intro-v03.pptx Matthias's slides 13:11:05 [slide: User-granted exceptions] 13:11:19 wseltzer has changed the topic to: https://lists.w3.org/Archives/Public/public-tracking/2016Sep/att-0015/W3C-TPAC-TPWG-Breakout-Intro-v03.pptx Matthias's slides 13:11:54 schunter: negotiation, we discussed in the WG that this negotiation can be used in the European context 13:12:02 ... for consent to cookies, stored in the browser 13:12:20 ... so when I revisit a site, my preferences can be recalled 13:12:30 ... site-wide or web-wide excptions 13:12:48 ... moneill2_ will tell you a bit about how it works in practice 13:12:57 ... vincent_ will talk about regulatory context 13:13:16 schunter: other document, little uptake, is Compliance spec 13:13:19 ... that's not interesting 13:13:38 ... Implementation uptake: signal is supported in most browsers 13:13:47 ... most sites ignore the signal 13:14:52 Topic: Demo 13:15:11 moneill2_: edge doesn't have the API, IE did 13:15:54 moneill2_: I'll show you a test page 13:16:02 https://baycloud.com/dntapi 13:16:44 moneill2_: bouncer lets you grant or block behaviors, expires cookies 13:17:22 https://baycloud.com/bouncerDownload 13:18:19 moneill2_: you can consent, revoke 13:20:03 present+ dka, cargill, Axel, frankwagner, francois, JimBell, JoeHallCDT, mkwest, jeff, DanDruta, marta 13:20:35 jeff has joined #dnt 13:20:35 moneill2_: this plugin gives transparency as well as user control 13:20:52 ... showing you the trackers, letting you consent per-site 13:21:51 schunter: Consent registration is the main point 13:22:05 ... saying "please change your mind" to the customer, and recording that consent 13:22:09 The Tracking Status Resource (TSR) is an essential element in terms of the mandatory information requirement in the EU legal framework 13:22:19 ... to let us move away from cookie banners 13:22:36 Topic: Regulatory Context 13:23:34 schunter: Vincent will give us a quick overview of the European regulatory landscape 13:23:59 ... initial impetus to the WG came from EU Commission and US FTC, saying please do something 13:24:10 ... now their regulations are increasing 13:24:39 Cargill: while this was underway, we had Snowden's PRISM disclosures that took some attention away from consumer tracking 13:24:50 ... but consumer regulation might be coming back to attention 13:24:58 ... we want approach to be based in science 13:25:07 ... this group had a good technical approach. 13:25:28 present+ Benedikt, Chad 13:25:49 schunter: it's not an accident that we're aligned with Europe; we were talking about the problem and to regulators 13:25:58 vincent_: current status in EU 13:26:18 ... Data Protetion Directive and ePrivacy Directive 13:26:31 ... as directives, they must be adapted to 28 countries 13:26:52 ... vary. Some countries think cookie IDs is "personal data" 13:26:57 ... others "PII" 13:27:11 ... different ideas of consent 13:27:13 schunter has joined #dnt 13:27:29 ... e.g. in France, users must interact with web page to consent to cookie being set on browser 13:27:39 ... to try to harmonize regulation, art 29 published opinions 13:27:52 ... art 29 = group of 28 DPAs in Europe 13:28:05 ... differences = why we need a regulation 13:28:17 ... May 2016, GDPR. Will be fully applicable May 2018 13:28:25 artikel 29 of EU Directive 96/46/EC "establishes" the working group. 13:28:32 ... a Reg, not a Directive, means same text applies in 28 countries 13:28:54 ... new: persona data definition includes "online identifiers" indlucing cookie ids 13:29:06 ... you need consent to collect and process data 13:29:31 ... several legal bases, of which consent and "legitimate interests" are most important 13:29:49 ... 2009 ePrivacy vs GDPR 13:30:02 ... GDPR recital 32 13:30:19 [[(32) Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement ... 13:30:25 ... or conduct which clearly indicates in this context the data subject's acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should not therefore constitute consent. Consent should cover all processing activities carried out for the same purpose or purposes. When the processing has multiple purposes, consent should be given for all of them. If the data subject's consent is to be given following a ... 13:30:31 ... request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided. 13:30:34 ]] 13:30:53 [highlighted: ilence, pre-ticked boxes or inactivity should not therefore constitute consent. 13:31:00 s/ilence/silence/ 13:31:20 REGULATION (EU) 2016/67 http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN 13:31:26 schunter: under this reg, you need explicit choice; so you have to click the cookie banner each time 13:31:49 schunter: or use technical means 13:32:04 vincent: and right to revoke 13:32:17 ... legitimate interest and right to object (art 21) 13:33:16 [[Art 21. 5. In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may exercise his or her right to object by automated means using technical specifications. 13:33:20 ]] 13:33:40 Cargill: can you object at any time? 13:33:49 ... e.g. way down-stream? 13:33:52 vincent: yes 13:33:59 moneill: and it should be erased 13:34:10 vincent: objection might be through automated means 13:34:23 dsinger (off-mic): how does the user object? 13:34:24 schunter: if you change DNT:0 to DNT:1 something has to happen 13:35:00 +q 13:35:18 matthias_matthiesen: IAB Europe. If user objects at any time, does that include after processing has commenced, or just before it starts? 13:35:35 Cargill: if halfway through processing, user objects, do you need to retract? 13:35:40 vincent: yes 13:35:52 schunter: there are reasonable limits, but you shoudl be able to withdraw consent 13:36:05 note that Jonas' sensemaking systems at IBM can redo past inferences once data is removed… not that everyone should go buy that stuff, but that is one technical accomodation to rescinding of processing consent 13:36:16 fwagner: another side condition for consent - ti needs transparent information. without context you cannot give consent. 13:36:29 "machine unlearning" 13:36:35 :) 13:36:44 schunter: If I revoke consent, at least tracking has to stop 13:36:48 s/ti/it/ 13:37:28 vincent: ePrivacy review 13:37:47 ... could result in a directive or regulation 13:38:11 ... could rely on DNT. coherent with previous directive 13:38:19 ... DPAs support DNT 13:38:34 ... could be used to obtain consent, not just object 13:38:49 [slide with lots of text] 13:39:10 [European Data Protection Supervisor; Article 29] 13:39:29 Slides Vincent: http://lists.w3.org/Archives/Public/public-tracking/2016Sep/att-0016/Slides_DNT-v4.pdf 13:40:04 Topic: Discussion 13:40:14 schunter: at least as of 2018, DNT will be useful 13:40:16 also note that some providers have created pretty neat dynamic tracking code exclusion based on DNT:1: https://lists.w3.org/Archives/Public/public-tracking/2015Oct/0007.html 13:40:18 ... what do we do next 13:41:04 fwagner: can you give us an indication whether DNT is compliant with European law 13:41:14 Chapter 10 of the GDPR grants the Commission the power to adopt delegated acts (as referred to in Article 12(8) in respect of standardised icons and in Article 43(8) in respect of certification mechanisms). 13:41:16 vincent: I don't know if there's one technical means we can say 13:41:48 schunter: regulators unlikely to say that DNT is only means, but could say DNT is a likely viable solution 13:42:12 fwagner: if I go to DPA and say I intend to use DNT in this way, can I get an answer that I'll be safe? 13:42:32 vincent: that DPAs are pushing for DNT in ePrivacy review is indication that it could comply 13:42:44 @rvaneijk are you saying that the EC could mandate some sort of machine-readable transmission of data practices? that seems to be a subset of DNT, now, I would think 13:42:46 schunter: DPs operate indpeendently 13:42:57 fwagner: GDPR is one-stop shop principel 13:43:12 s/principel/principle/ 13:43:30 aleecia: art29 WP has weighed in formally on prior drafts 13:43:40 ... we've gotten 2 rounds of guidance 13:43:54 ... I think companies in Europe will be able to get guidance 13:44:03 @JoeJallCDT Yes that is possible, but another route may be a decision through the data protection board. 13:44:04 ... In US, DNT is considered as opt-out 13:44:19 ah, ty, @rvaneijk 13:44:22 ... In Europe, users must consent else they must not be tracked 13:44:45 ... W3C documents allow DNT to be viable under European law. 13:44:51 q+ 13:44:55 ack fw 13:45:27 schunter: get companies interested, pilot, evaluate by companies and regulators 13:45:47 ... CR would stay CR through implementation experience 13:46:48 dka: I was curious 13:47:15 ... good to see regulatory interst; we've also seen companies like Medium that have seen ways to use DNT in their user experience 13:47:31 ... is anyone tracking the self-policing? can we provide positive feedback? 13:47:44 ... seems fragmented. all the engergy is on blockers. 13:47:47 FPF maintains a list of DNT respecting sites: https://allaboutdnt.com/companies/ 13:47:51 https://www.w3.org/wiki/Privacy/TPWG/TPE_Implementation_Report 13:47:59 moneill: there's a page on the wiki ^ 13:48:29 schunter: Google had done some anonymizing of users who had DNT set 13:48:45 vincent_ has joined #dnt 13:49:03 dka: at Samsung, we have a browser, that currently does not have DNT 13:49:18 ... I want to push it back to the engineering team; would like to have the argumentation to do it. 13:49:25 Samsung should consider to implement the JavaScript API :) 13:49:47 Cargill: vincent's last slide, there's no explicit reference to self-regulation 13:50:02 @rvaneijk, meaning that instead of just a dumb DNT:[1,0] setting, they should do the whole enchilada? 13:50:11 ... "how difficult is it to add this now rather than being penalized for not having" 13:50:15 s/enchilada/thing/ 13:50:29 moneill: quite a few sites in Europe using. 13:50:41 dka has joined #dnt 13:50:44 there some sites that actually block content loading based on DNT:1… not sure those are in the lists 13:50:51 ... several thousand sites in Europe 13:50:55 q? 13:51:03 present+ 13:51:21 JimBell: seems to me that unless we take some action, we'll end up regulated in some jurisdictions 13:51:33 ... suppliers declaration of conformance 13:51:51 ... SVOC, VPATS (?) 13:52:10 ... probably the only way we're going to avoid regulation 13:52:24 wseltzer: running down on time for the session... 13:52:33 … helpful to get the state of internal/external affairs 13:52:40 … question to w3c membership: 13:52:46 … what do you want us to do? 13:52:50 q+ 13:52:50 … what should be next 13:52:56 ack wseltzer 13:53:10 … working on a charter extesion so that we can work on what to do next 13:53:40 … we can allow the charter to lapse while maintaining CRs, will return later when we have indications of moving forward next steps to PR and imp. reports, testing usage 13:53:43 … we could re-charter 13:53:58 … under process, we need expression of support, and meet the conditions in the process 13:54:05 … and assure members we have a plan of a path forward 13:54:12 … we know how we are going to get from CR to PR 13:54:29 … Felipe in new role as w3c PM will insist that we have clear deliverables and milestones 13:54:38 schunter: working groups should work 13:54:48 s/Felipe/Philippe/ 13:54:48 … if we have a plan of what to do and support, we go forward 13:54:53 … if we do not, we will not 13:55:08 dka: what's stopping movement to PR? 13:55:16 … focusing on getting stuff to rec? 13:55:20 … waiting on imps? 13:55:27 … there are a few of them, why wait? 13:55:44 … getting something out there quickly would be much better 13:55:53 … then when the reg. is out, we decide what to do now 13:56:02 schunter: this is my evening job, I have a daytime job 13:56:11 … don't want to just create a document that only sits on a shelf 13:56:14 q? 13:56:26 dka: would point to SVG as an example 13:56:31 … was pushed out, considered dead 13:56:40 … and now is ubiquitous 13:57:06 fwagner: one possible way forward is to do a model implementation 13:57:19 … creating transparency for the users, working with EU regs 13:57:29 i/wseltzer: running/scribenick: JoeHallCDT 13:57:45 … from my perspective, theres [?] 13:57:54 ack fwagner 13:58:05 barryleiba has joined #dnt 13:58:08 ???: represent RT, aware of GDPR 13:58:24 s/???/Benedikt/ 13:58:24 … DNT is attractive because we can actually talk to regulators about this 13:58:32 s/RT/Thomson Reuters/ 13:58:37 … this is something we'd like to stay on the front of 13:58:43 … (vote for re-charter) 13:59:01 aleecia: Dan, we had a call where Jaffe agreed that we had enough imps to move forward 13:59:07 … could promote doc as it is now 13:59:20 … criteria for CR->PR have been fulfilled 13:59:24 … but still not enough 13:59:45 … Jaffe agrees go straight to PR 13:59:57 … agree with that, we'll have a document to work with when a crisis point comes 14:00:01 q+ to talk about the API 14:00:09 … if it's still bottled up in committee, it will be harder to get it done 14:00:30 … I see no policy or w3c impediment to putting the PR out there right now 14:00:37 Jaffe: to clarify: 14:00:43 …there are two issues: 14:00:49 +1 to putting the PR out there. 14:00:49 … one is process, one is judgement 14:01:02 … might have said from a formal process view that when we have 2 imps, move forward 14:01:25 … also said there's a judgment call that there needs to be consensus from WG that there needs to be sufficient imp experience 14:01:46 … on the side of servers actually honoring what UAs request, there is work to do 14:02:01 schunter: we can jump through w3c hoops, but it's judgement and energy now 14:02:07 … a WG that consists of only chairs is boring 14:02:14 … can we get support 14:02:30 q? 14:02:31 q+ 14:02:32 … e.g., a company saying, we've implemented on a couple hundred sites 14:02:35 q? 14:03:02 dsigner: we could push it out… part of the spec we'd need to remove is the exception calls 14:03:09 … not enough server-side demand for that 14:03:13 … rest could be pushed out 14:03:17 ack dsing 14:03:17 dsinger, you wanted to talk about the API 14:03:30 dka: would be better to get it out there 14:03:45 … then the energy could be put into helping implementers and getting more of them 14:04:05 schunter: tomorrow we have a WG meeting 14:04:20 … important to know who in the room can join us in terms of implementation 14:04:30 … based on who wants to join compliance validation in EU 14:04:38 … we can decide to recharter for 6 months 14:04:45 present+ Frode, Glenn 14:04:53 … what slices of spec to push out when is a secondary consideration 14:05:01 q? 14:05:04 ack dka 14:05:22 wseltzer: this is not a formal WG meeting 14:05:35 … so can't take decisions, can get a sense of what people want to do 14:05:50 … from w3c Team perspective, want a very clear sense of what we want to do when extending charter 14:06:11 dsinger: don't see a practical difference between rechartering and not 14:06:25 schunter: if you don't have a charter, you don't exist 14:06:44 … to do active experiment studies need a charter 14:07:13 frodek has joined #dnt 14:07:15 Fellipe: difficult for me to judge having just walked in the room 14:07:38 … the charter will need to show that you can be successful 14:07:41 s/Felipe/Philippe/G 14:08:03 cargill: if we get a reference imp. acceptable to EU regulators, then we have something to go with 14:08:13 … if we get an imp and EU regulators say no, that's failure 14:08:20 schunter: way forward is clear… 14:08:28 … found new people interested in this work 14:08:32 mkwst has joined #dnt 14:08:44 … will take it to the WG and see what folks think about rechartering 14:08:55 .. morphs the group from a US marketing group to a EU compliance group 14:09:04 .. thanks everyone! 14:09:12 … any other stuff you want to know, ping schunter 14:09:16 rrsagent, make minutes 14:09:16 I have made the request to generate http://www.w3.org/2016/09/21-dnt-minutes.html wseltzer 14:09:21 rrsagent, make logs publis 14:09:23 rrsagent, make logs public 14:09:29 rrsagent, make minutes 14:09:29 I have made the request to generate http://www.w3.org/2016/09/21-dnt-minutes.html wseltzer 14:17:30 frodek has joined #dnt 14:18:04 frodek has left #dnt 14:21:45 dsinger has joined #dnt 14:24:02 s/Fellipe/Philippe/G 14:24:32 rrsagent, make minutes 14:24:32 I have made the request to generate http://www.w3.org/2016/09/21-dnt-minutes.html adrianba 14:29:08 Karima has joined #dnt 14:31:01 barryleiba has left #dnt 14:34:58 dka has joined #dnt 14:38:51 Karima has joined #dnt 14:45:19 Karima has joined #dnt 14:58:04 Karima has joined #dnt 15:23:14 Meeting: TPAC TPWG Breakout 15:23:15 rrsagent, make minutes 15:23:15 I have made the request to generate http://www.w3.org/2016/09/21-dnt-minutes.html adrianba 15:24:32 i/schunter: Background/scribe: wseltzer/ 15:24:46 chair: schunter 15:24:48 rrsagent, make minutes 15:24:48 I have made the request to generate http://www.w3.org/2016/09/21-dnt-minutes.html adrianba 15:35:29 schunter has joined #dnt 15:39:58 dsinger has joined #dnt 15:41:26 Karima has joined #dnt 15:48:37 Karima has joined #dnt 16:08:15 Karima has joined #dnt 16:40:37 Zakim has left #dnt 16:52:05 schunter has joined #dnt 17:09:48 dsinger has joined #dnt 17:22:26 Karima has joined #dnt 17:22:26 JoeHallCDT has joined #dnt 17:25:51 JoeHallCDT1 has joined #dnt 20:37:20 Karima has joined #dnt 20:56:31 schunter has joined #dnt 22:53:40 JoeHallCDT has joined #dnt 22:56:26 JoeHallCDT1 has joined #dnt 22:58:04 JoeHallCDT1 has left #dnt