ACTION-161: work on issue-49

<Normative>

A Third-Party MAY operate as a First Party if the following conditions are met:
• Data collected is separated for each First Party by technical means and organizational process, AND
• The Third Party has no independent rights to the collected information outside of Permitted Uses (see Section X.Y), AND
• A contractual relationship exists between the Third Party and the First Party that outlines and mandates these requirements.

A Third-Party acting on the behalf of a First Party is subject to all of the same restrictions of a First Party.

<Non-Normative>

Third Parties that act purely as vendors for their customers (First Parties in this context) are not the intended target for the Tracking Preference Expression but it’s important there are no unintended activities that are extended to a Third Party through this allowance. In all cases, its expected a Third Party acting on the part of a First Party follows all of the same restrictions placed on a First Party.

For the data separation requirement, Third Parties have technical options to achieve appropriate separation but in each the critical element is that data is never reconstituted for users that have shared a Tracking Preference. On possible approach would be to leverage a per partner hash against a common cookie identifier, ensuring the resulting identifier is consistent for a specific First Party but is unable to be linked with another First Party’s identifier.

Contractual requirements that enforce data rights and responsibilities for separation are a critical element of establishing a Third Party as acting on a First Party’s behalf. Contracts may occur directly through parties (for example, a Publisher in an Ad Network) or between intermediaries (for example, an Ad Network acting through an Ad Exchange). In either case, data separation and removal of independent rights are necessary elements that must survive intermediary contractual constructs.

Re-open to include suggestions from call on August 1st.

Changed "A Third-Party MAY operate as a First Party if..." to "A Third-Party MAY operate under the rules for a first party if..."

<Normative>

A Third-Party MAY operate under the rules for a first party if the following conditions are met:
- Data collected is separated for each First Party by technical means and organizational process, AND
- The Third Party has no independent rights to the collected information outside of Permitted Uses (see Section X.Y), AND
- A contractual relationship exists between the Third Party and the First Party that outlines and mandates these requirements.

A Third-Party acting on the behalf of a First Party is subject to all of the same restrictions of a First Party.

<Non-Normative>

Third Parties that act purely as vendors for their customers (First Parties in this context) are not the intended target for the Tracking Preference Expression but it's important there are no unintended activities that are extended to a Third Party through this allowance. In all cases, its expected a Third Party acting on the part of a First Party follows all of the same restrictions placed on a First Party.

For the data separation requirement, Third Parties have technical options to achieve appropriate separation but in each the critical element is that data is never reconstituted for users that have shared a Tracking Preference. On possible approach would be to leverage a per partner hash against a common cookie identifier, ensuring the resulting identifier is consistent for a specific First Party but is unable to be linked with another First Party's identifier.

Contractual requirements that enforce data rights and responsibilities for separation are a critical element of establishing a Third Party as acting on a First Party's behalf. Contracts may occur directly through parties (for example, a Publisher in an Ad Network) or between intermediaries (for example, an Ad Network acting through an Ad Exchange). In either case, data separation and removal of independent rights are necessary elements that must survive intermediary contractual constructs.

As per http://www.w3.org/2012/08/22-dnt-minutes, Shane was to update this text to reflect third parties acting on behalf of third parties. We mistakenly left this as pending review without a new due date, so it dropped out of sight. It should have been due last week, but I've set it due for 5 Sept with a note to Shane. Since the due date was wrong, he'll have an automatic extra week if he is unable to get this done by the 5th.

Shane's updated text is here, with a typo correction from Vinay: http://lists.w3.org/Archives/Public/public-tracking/2012Sep/0150.html