W3C

- DRAFT -

Tracking Protection Working Group teleconference

08 Aug 2012

Agenda

See also: IRC log

Attendees

Present
npdoty, +1.646.654.aaaa, eberkower, aleecia, ifette, Chris_IAB, +1.609.310.aabb, felten, +1.714.852.aacc, fielding, BrendanIAB?, adrianba, Dabiano_Nielsen, +1.916.641.aadd, +1.650.308.aaee, robsherman, Joanne, +1.540.822.aaff, WileyS, rvaneijk, +1.202.345.aagg, samsilberman, jeffwilson, [Microsoft], cblouch, RichardWeaver, justin_, +1.202.695.aahh, Lia, +1.202.642.aaii, tl, hwest, vincent, alex, +1.919.388.aajj, johnsimpson, AnnaLong, jmayer, ChrisPedigoOPA, BerinSzoka, dsinger, +1.646.666.aakk, +1.866.317.aall, bilcorry, [Mozilla], dsriedel, +aamm, +1.202.326.aann, Chapell, Brian_Amazon, Chris, Peder, +1.415.520.aaoo, KevinT, +1.425.455.aapp, +1.917.934.aaqq, +1.425.455.aarr
Regrets
Susan, susanisrael
Chair
aleecia
Scribe
vincent

Contents


<npdoty> chair: aleecia

<aleecia> done, nick

<aleecia> why that didn't over-write the agenda already there is a mystery, but a happy one

<aleecia> regrets?

<aleecia> ah, so that's why I've struggled with it and given up.

<eberkower> = eberkower

<eberkower> aaaa = eberkower

<Chris_IAB> just joined via Skype

<ifette> some days I feel like Don Quixote...

<ifette> or maybe Sancho, I'm not sure

<ifette> (nielsen)

sure

<npdoty> scribenick: vincent

<aleecia> http://www.w3.org/2011/tracking-protection/track/actions/overdue?sort=owner

Review of overdue action items: http://www.w3.org/2011/tracking-protection/track/actions/overdue?sort=owner

<npdoty> action-196?

<trackbot> ACTION-196 -- Justin Brookman to draft text on whether url shorteners are first or third parties -- due 2012-08-03 -- OPEN

<trackbot> http://www.w3.org/2011/tracking-protection/track/actions/196

aleecia: move action 196 move to pending review correct?

justin: added a couple of sentence should wait for next week

aleecia: action 212 on ifette

ifette: its more a UI question item, not agreement yet within Google

aleecia: someone would like to take this on
... no voluter, close this action
... action 222 also on ifette

ifette: 222 has been emailed to the list, so is 201
... moved to pending review

<Chris_IAB> Hi Aleecia, I think we'd like to keep 212 open

<aleecia> 212 -> close; 222-> pending review, 201 -> pending review, 200 -> comments on dlist, +1 week.

<Chris_IAB> Brendan and I will volunteer

aleecia: chris, would someone would like to volunter on 212, IAB being not member you can not volunter

<Chris_IAB> I did sign the IP agreement, btw

<WileyS> I'll take it on

<npdoty> action-212?

<dsinger> action-212?

<WileyS> Please assign 212 to me

aleecia: resuming the situation on 212 which is more related to UI

<Chris_IAB> regarding my/our "invited expert" status, I have submitted several inquiries that have not been replied to... status?

<WileyS> Principle based approach - not prescriptive UI directions :-)

<ifette> ACTION-212 on shane

<WileyS> 2 weeks please

<fielding> I am trying to do the updates online

<justin_> WileyS, didn't you already draft text on this? I added language based on your proposal to the new User Agent Compliance section.

action-214?

<JC> I'm having trouble dialing in

<WileyS> Justin, yes - I'm going to revisit it to make sure its well structured enough

<sidstamm> JC, me too

aleecia: chris, action 229

<justin_> WileyS, yes, this could be fleshed out a bit more: http://www.w3.org/2011/tracking-protection/drafts/tracking-compliance.html#user-agent-compliance

<npdoty> JC, sidstamm you can try *0 to talk to someone and ask for 87225

Chris: i need a little bit ore time to get feedback, many people out of town

<sidstamm> npdoty, I get a busy tone on the main number and don't get the prompts

aleecia: postpon for two weeks

<JC> +1

aleecia: dsinger for action 227

actuin-227?

<aleecia> 2 more days on 227

<trackbot> ACTION-212 -- Ian Fette to draft text on how user agents must obtain consent to turn on a DNT signal -- due 2012-07-25 -- CLOSED

<trackbot> http://www.w3.org/2011/tracking-protection/track/actions/212

<trackbot> ACTION-212 -- Ian Fette to draft text on how user agents must obtain consent to turn on a DNT signal -- due 2012-07-25 -- CLOSED

<trackbot> http://www.w3.org/2011/tracking-protection/track/actions/212

<trackbot> ACTION-214 -- Aleecia McDonald to issue a call for objections on symmetry/minimum number of choices -- due 2012-07-16 -- OPEN

<trackbot> http://www.w3.org/2011/tracking-protection/track/actions/214

sorry did not get it

<aleecia> action-228, one more week

aleecia: dwainberg for action 222

<adrianba> dsinger, i can also help with respec if you need

aleecia: final one hwest for action 225, alternative definition of third parties

hwest: in progress, one week should be enough

<aleecia> one more week on action-225

dsinger: can I talk about action 243

<susanisrael> susanisrael is on irc but not on call

dsinger: the action was simple, change the TPE doc

<JC> Just made it in

<jmayer> +q

dsinger: but the description about resource is about the resource is designed to be used
... the resource does not know if it is used in a third aprty context

<sidstamm> Zakim: Mozilla has sidstamm

<JC> +q

<JC> +q

<tl> +q to say: Isn't a first party someone who believe with high confidence....?

<fielding> no, that does not solve anything

jmayer: the best way to solve the issue is to address that in the compliance doc

<fielding> +q

JC: how do we deal aout the case of a third party becoming a first party due to interaction

<Chris_IAB> JC, good point

aleecia: not a problem touched by the problem we are toalking about

<fielding> -q

<Zakim> tl, you wanted to say: Isn't a first party someone who believe with high confidence....?

<jmayer> If there's no additional HTTP traffic, then there's no new response header. But there's also no new data collection. So that's OK.

<npdoty> JC, I believe parties can send a different header once they've had that interaction making them first party, that's an advantage of a header

aleecia: we're going to close the queue and see if someone volunter

<fielding> you want me to address Jonathan's point? It cannot be implemented -- simple enough

tl: if you beleive that you resoure is used in a context that we described, you should know that you are a third aprty

<dsinger> "A first party is any party, in a specific network interaction, that can infer with high probability that the user knowingly and intentionally communicated with it. Otherwise, a party is a third party.

<dsinger> "

fielding: if the origin serve can not know if it is a first or third party, it can not comply with the doc
... not going to write something in the TPE spec that can not be implemented

aleecia: how do you expect a party will answer if it is a first or third party

<jmayer> I think Tom and I are suggesting essentially the same thing - solve this in Compliance. We're pointing to two places in the text for doing that.

fielding: a origin server will say if a resource belong to a first aprty context or third party context
... the context come from the UA not from the server

<jmayer> I'm not at all following what Roy's objection is.

fielding: if the UA believe the resource is in a third party context and the server beielves it is in first party, that's an issue for the UA

<npdoty> so I think that's where we need text, that last part, fielding

aleecia: if given party does not know what it is, it should behave as a third aprty

<jmayer> +q

<ifette> +1 fielding

fielding: I'm objecting against that

<jmayer> Do we have agreement that this is a Compliance issue?

<amyc> aren't we just looking for volunteer for this action?

aleecia: we have an issue around this agaisnt the compliance spec

<npdoty> issue-60?

<trackbot> ISSUE-60 -- Will a recipient know if it itself is a 1st or 3rd party? -- open

<trackbot> http://www.w3.org/2011/tracking-protection/track/issues/60

jmayer: I think we may have an agreement that it is a TPE is notsue

<justin_> Compliance issue, vincent

aleecia: anyone interested in taking this action from dsinger

thx justin_ , jmayer

aleecia: checking unidentified caller

<Chapell> zakam, aakk is Chapell

<damiano> I'm on Google talk, not sure what area code shows up

Quick check that callers are identified

aleecia: F2F meeting we have an offer in Amsterdam from IAB europe

Update on face-to-face meeting

aleecia: right now we are looking at october 3,4 and 5th

<npdoty> October 3rd, 4th and 5th in Amsterdam

aleecia: if you are an observer you should not be booking yet
... we will have to check the room capacity
... currently most likely location, Amsterdam

ifette: are those date pretty solid?
... probably going to miss that week

<npdoty> from Doodle, there are a couple people who will be a new conflict

aleecia: should be confirmed soon (withn 24h?)
... yes we are affected by it
... thank you to Google and IAB europe for helping
... now going to look at the editors draft

<aleecia> http://www.w3.org/2011/tracking-protection/drafts/tracking-compliance.html#user-agent-compliance

aleecia: specifically seciton 5 &6
... going to look for feedback about what you can't live with if we publish this as a working draft

Editors Draft towards Public Working Draft

aleecia: when there are options, we will keep the options available
... section 6 has information about permitted uses based on the discussion in seattle
... looking for volunter to take the text and extend it within two weeks (should eb in spec language)

<WileyS> Aleecia - I thought our draft was already incorporated into the C&S doc?

<WileyS> Why are we doing this again?

<fielding> earthquake

aleecia: also have the two main proposal (Shane and Jonhatan) to propose draft

<fielding> okay, only a smallish one

<WileyS> +q

<hwest> WileyS, that was my understanding as well

npdoty: I'm happy to volunter, trying to merge things together

<justin_> It would be helpful to hear what needs to be "extended" in sections 5 and 6.

aleecia: anyone would like to work with npdoty on that?

<johnsimpson> Glad to work with Nick'

<amyc> +1 justin

<npdoty> you don't have to commit right now, email is great

WileyS: I'm a bit confused, though we completed that in the last f2f
... what we're tryign to do with this redo vs the last f2f

<amyc> Aleecia, can you explain what you mean by fully fleshed out?

aleecia: it's not fully fleshed out righ now to have proposal complete to compare

WileyS: should we take the current working draft and make edit from there or start from the two proposals?

aleecia: fleshing out the middle ground exs: SOX compliance and financial loging

WileyS: why would not focus on the independant issue then?

<justin_> +1 to WileyS

<hwest> +1

<npdoty> I thought I was still hearing a good-sized gap in the group on the permitted uses as a whole in Bellevue, was that not the case?

aleecia: not trying to do a complete redo, just focusing on the permitted uses
... not at the level where we can publish this

<WileyS> Nick - not the case, there were nits on the break outs but in general we were moving in a good direction

aleecia: some sections are not quite there yet

justin_: echo what WileyS said, we should focus on specific issues
... I would like more guidance

<aleecia> 6.2.1.4 Frequency Capping

<aleecia> For limiting the number of times that a user sees a particular advertisement.

<aleecia> Example

<aleecia> A user visits ExampleNews with DNT:1 enabled. ExamplesNews uses the third party ExampleAds to serve content and advertisements on its site. ExampleAds is not an outsourcing partner of ExampleNews. ExampleAds has previously shown the user an ad for ExampleCars fives times in the past week on other sites. ExampleCars' contract with Example Ads states that Example Ads will be paid less for impressions where the user sees an ad more than five times in a week.

<aleecia> ExampleAds may opt not to show the user the ad for ExampleCars because the user has already seen the ad five times on other sites.

<aleecia> In Seattle, we discussed specifically limiting how data was stored for frequency capping.

<aleecia> Server-side frequency capping is allowed if the tracking identifier is only retained in a form that is unique to each super-campaign (e.g., one-way hashed with a campaign id) and does not include retention of the user's activity trail (page URIs on which the ads were delivered) aside from what is allowed for other permitted uses.

<npdoty> WileyS, if there are only minor points of disagreement on permitted uses, that's great! that wasn't my understanding after the breakouts in Bellevue

aleecia: we do not have something which is implementable or testable and that's what we're looking at

<WileyS> The Policy document is not "testable" in general - if that is now the bar we'll need a complete rewrite

<WileyS> Aleecia, could you please enumerate the contentious items?

<aleecia> amyc

aleecia: not looking at all section 5 & 6 but only to the things that are more contentious

amyc: still confused, you want more technical details about frequency capping would occur

<aleecia> specifically 6.2.1

aleecia: we should give some clues about implementation, more technical details
... curretnly they are at very high level, need to be made so that it can be imlemented

<justin_> I still believe that the policy spec should not be overly technically prescriptive, and it's especially hard to do so without agreement on what types of data can be collected and retained when DNT:1 is on.

amyc: we should make sure every body is ok on the defintion of collect/use,...

<WileyS> Why are adding technical details to the C&S document? Its specifically in a different document to avoid that.

<WileyS> Those saying they can't live with permitted uses are those that don't actually need to implement DNT as a 3rd party.

npdoty: I though after Bellevue that there was no agreement on tracking cookies

<WileyS> +q

npdoty: if there is an agreement that's news to me

<tl> Anonymous != pseudonymous.

<tl> The terms are well-defined.

WileyS: implementation is a goal, we need to get beyond the philisophical issue of are unique id cookie permitted (is that correct?)

aleecia: we're nto going to close that in a 1h30 call
... looking for specific for specific text, we're not get a consensus on this text on the call
... we have two text that arrived in Seattle and a lot fo progress made in Seattle

<dsinger> I think we should try to manage 'tracking', and be silent about what technologies you do or don't use to do or not do tracking (e.g. cookies, local storage, remote storage, cloud storage, …)

<WileyS> The issues with the current text are not with the text itself - but rather with the philosophy of allowing a unique ID cookie. Revamping text is not going to solve the issue in my opinion.

aleecia: if the authors of the proposal would like to merge the proposal to what s already be doe, that's great progress

<felten> There's a spectrum of views in the group, right?

WileyS: the otehr proposal has an hard line on the use of unique ID cookies
... revamping text will not bring use beyond that

aleecia: I'm looking to have a series of text that are concrete to put them side by side

<npdoty> I'm willing to work on a compromise to try to address that big question

<WileyS> Jonathan - this is discussion is on the agenda

aleecia: and find where we have consensus and we move forward
... should be complete before the f2f

<WileyS> Its already nailed down but let's churn if that makes everyone happy

aleecia: right now we have two proposal and new things from Seattle, looking to have something we can contrast

<fielding> please delete 3.3.2.3

aleecia: tryign to get somebody on the call to speak about sox compliance
... probably in two weeks

<Chris_IAB> somebody, as in an expert on SOX compliance?

<WileyS> SOX is only one financial legal standard in the world - we'll need to look at others as well.

<WileyS> Aleecia, we'll focus on the C&S document at this point.

<WileyS> I won't go back to the original document.

<WileyS> +q

WileyS: not going to restart from the initial text
... if you could help iterate where you see contention that'd be helpful and we will provide additional text

<jmayer> Sure.

aleecia: jmayer do you think that you'll have time to make change that you'd like to do based on seattle

<WileyS> We have text is the spec now

aorry did not get that

<npdoty> ACTION: mayer to update proposal on permitted uses based on Seattle [recorded in http://www.w3.org/2012/08/08-dnt-minutes.html#action01]

<WileyS> "in" the spec

<trackbot> Created ACTION-234 - Update proposal on permitted uses based on Seattle [on Jonathan Mayer - due 2012-08-15].

<aleecia> <p class="option"><b>0:</b> silence. (Keep paragraph above that "MUST reflect the user's choice")</p>

<aleecia> <p class="option"><b>3:</b>

<fielding> and delete 3.3.2.4 and 3.3.2.5 and 3.3.2.6 (I already wrote objections to all of those -- they should never have been added)

<aleecia> A user agent MUST take equal effort to configure their agent to each of a minimum of three choices for a Do Not Track preference: on, off or unset.

<aleecia> </p>

<npdoty> ACTION: doty to draft middle way draft on permitted uses [recorded in http://www.w3.org/2012/08/08-dnt-minutes.html#action02]

<trackbot> Created ACTION-235 - Draft middle way draft on permitted uses [on Nick Doty - due 2012-08-15].

aleecia: one more piece on choices offered by the UA
... in seattle we had sevaral option
... UA should reflect the user choices

<jmayer> +q

<justin_> (1) captures my point of view.

aleecia: other possibility DNT:On, DNT:off unset

<dsinger> can someone briefly explain why I would ever config to say dnt:0 always?

<npdoty> action-235: as WileyS points out, divide on unique tracking cookies might be key question to address

<trackbot> ACTION-235 Draft middle way draft on permitted uses notes added

<npdoty> dsinger, if you're happy with tracking and targeted ads and don't want to be asked even in your jurisdiction, you might install a DNT:0 extension

<fielding> ACTION-235?

<trackbot> ACTION-235 -- Nick Doty to draft middle way draft on permitted uses -- due 2012-08-15 -- OPEN

<trackbot> http://www.w3.org/2011/tracking-protection/track/actions/235

jmayer: there could eb more options, how many options should be avialble and waht consitute an informed choice

aleecia: we're just getting how many choices should be presented to the user

<justin_> A user agent must offer a control to express a tracking preference to third parties. The control must communicate the user's preference in accordance with the [[!!TRACKING-DNT]] recommendation and otherwise comply with that recommendation. A user agent must not express a tracking preference for a user unless the user has given express and informed consent to indicate a tracking preference.

<dsinger> npdoty, I don't think I follow

<jmayer> I think we need to do a lot to clarify "must reflect a user's choice," but that's not under discussion now.

aleecia: I'll make sure in the mailing list that we have the section referenced

<npdoty> jmayer, I think this was a question *in addition to* existing language on MUST user choice, no default

<Zakim> dsinger, you wanted to ask why I have to offer dnt:0; who would use it?

johnsimpson: I was reading the TPE and there is already language about waht the UA must do (offer DNT:1, Unset and 0 is optional)

<ifette> A surprising amount of non-consensus language seems to make it into the document

<aleecia> (thought David was going to, sorry -)

<jmayer> (Some participants think that language requires an explicit choice, some think it only bars an unchangeable setting in a browser, some think it's between.)

<fielding> http://www.w3.org/2011/tracking-protection/drafts/tracking-dnt.html#determining

dsinger: only use case for DNT:0 is for juridication where trackign is not permitted and DNT 0 would allow it, not aware of such juridication

<jmayer> npdoty, yes, this current discussion is just on the #/type of options required.

aleecia: if that's something you can not live with you should mention during the poll

<fielding> I believe we were going to have an open issue about one of those paragraphs moving to the compliance document, namely

<fielding> … "A user agent must offer users a minimum of two alternative choices for a "Do Not Track" preference: unset or DNT:1. A user agent may offer a third alternative choice: DNT:0."

npdoty: we do have language on this, the question wether or not we have enough language
... about how easy it should be to select DNT 0

<justin_> ifette, There are additional options in that section based on WileyS's proposal.

aleecia: there is also a difference between what a site must accept and what the UA may send

<justin_> Never clear when we should revise the document based on disagreements on the mailing list.

aleecia: npdoty should set a poll on this

<npdoty> ACTION: doty to set up poll on objections regarding minimum choices for UA [recorded in http://www.w3.org/2012/08/08-dnt-minutes.html#action03]

<trackbot> Created ACTION-236 - Set up poll on objections regarding minimum choices for UA [on Nick Doty - due 2012-08-15].

aleecia: is a week enough for this process?

amyc: could you explain the process

<tl> +q

aleecia: it is about what you can live with (not about what you can't live with)

<npdoty> http://www.w3.org/2011/tracking-protection/decision-policy.html -- "Call for objections"

<robsherman> +q

it's the opptosite?

<justin_> yes, vincent, the opposite.

<amyc> thanks Nick

thaks justin_

<npdoty> aleecia: it's about what you can'tnot live with, if anything (not a count of how many people prefer)

tl: are also invited expert par tof this process

<npdoty> W3C groups generally gather consensus among all participants, which include Members who join the group and Invited Experts in the group

aleecia: yes, IEs and members are the same on this
... the only difference is on IP issue

<ifette> +1

<ifette> this is something i am going to have to float around

robsherman: I suggest at least two weeks, need to talk with stakeholders

aleecia: ok, fine with two weeks

<adrianba> two weeks is good

<npdoty> just a comparison between one paragraph and another

johnsimpson: you're talking about polling about a specific issue, not the entire document

aleecia: yes, it's just about a specifc and very small issue

<npdoty> action-236: give two weeks to respond

<trackbot> ACTION-236 Set up poll on objections regarding minimum choices for UA notes added

aleecia: we will also try to find a consistent subject line so that it is simple to find in the mailing list
... the question is how much time we need to process the polling

<aleecia> (a) ISSUE-21 PENDING REVIEW Enable external audit of DNT compliance

<aleecia> PROPOSAL: we have previously agreed upon an optional array of URIs to list any auditors, as included in the TPE document. Let us add a pointer from the Compliance document to the TPE document, and close this issue.

aleecia: couple of proposals came in for auditing, we decline the most complicated

<fielding> http://www.w3.org/2011/tracking-protection/drafts/tracking-dnt.html#status-representation

aleecia: we sad as a group that we could have an optional array of auditors

<jmayer> +q

aleecia: we never closed the issue
... proposition: have a pointer to the TPE section about that array
... objections?

I'm not getting the response from jmayer

<npdoty> jmayer: I support this change, originally the issue was about enabling auditing or compliance in general

aleecia: if you have an extra audit you could say the auditors are here

thx npdoty

<npdoty> ... which is now a concern that comes up across issues, but that's originally what this was

<npdoty> resolution: close issue 21 and editors add pointer text in Compliance spec

aleecia: justin_ and hwest can add a pointer to the section in the TPE spec

<WileyS> tlr - what does the BBL stand for? :-)

hwest: would be happy to do that within a week

<fielding> more specific, http://www.w3.org/2011/tracking-protection/drafts/tracking-dnt.html#dfn-audit

<WileyS> ahhh - thank you

<jmayer> Thanks npdoty. I think concerns about guaranteeing compliance are now sufficiently cross-cutting that they shouldn't be a standalone ISSUE. Just wanted to be clear that we're not suggesting "Mission Accomplished" on compliance because there's a magic auditor field.

<aleecia> (b) ISSUE-45 PENDING REVIEW Companies making public commitments with a "regulatory hook" for US legal purposes

<aleecia> PROPOSAL: we have previously agreed to the general direction below. Unless someone has new information or cannot live with the text, let us adopt it and close this issue:

<aleecia> In order to be in compliance with this specification, a third party must make a public commitment that it complies with this standard. A "public commitment" may consist of a statement in a privacy policy, a response header, a machine-readable tracking status resource at a well-known location, or any other reasonable means. This standard does not require a specific form of public commitment.

<fielding> issue-45?

<trackbot> ISSUE-45 -- Companies making public commitments with a "regulatory hook" for US legal purposes -- pending review

<trackbot> http://www.w3.org/2011/tracking-protection/track/issues/45

<npdoty> ACTION: west to update Compliance spec with pointer regarding issue-21 [recorded in http://www.w3.org/2012/08/08-dnt-minutes.html#action04]

<trackbot> Created ACTION-237 - Update Compliance spec with pointer regarding issue-21 [on Heather West - due 2012-08-15].

aleecia: issue-45 is also pending review but never closed
... already have text for quite some time

<dsinger> issue-45?

<trackbot> ISSUE-45 -- Companies making public commitments with a "regulatory hook" for US legal purposes -- pending review

<trackbot> http://www.w3.org/2011/tracking-protection/track/issues/45

<fielding> TPE does require a specific form.

<WileyS> Roy, For a UA to be HTML5 compliant, I'm assuming they must publicall state they are HTML5 compliant, correct? If that's the case, then that makes sense here too.

aleecia: we had pretty good agreement on this text, we can close the issue

<tl> Header or URI, no?

fielding: now the TPE require the well known location

aleecia: are you ok to fix this

fielding: ok

aleecia: you can past that in IRC and if no objection, adopt this

<jmayer> +q

adrianba: confused, in order to be in compliance you have to make a public comitement
... why do we need to say something like this in the spec

<Chris_IAB> agree with that statement David

<fielding> New text: In order to be in compliance with this specification, an origin server MUST make a public commitment that it complies with this standard through the provision of a site-wide tracking status resource [[!TRACKING-DNT]].

<jmayer> Offered to give an answer, but I wasn't sure if it was needed.

aleecia: the point of issue-45 is to have tome type of regulatory enforcement

<jmayer> +q

<dsinger> Perhaps it needs to be stated the other way up: the existence of the well-known resource is a claim of compliance with the spec.

aleecia: if company does not claim something there is no enforcement option

<fielding> shorter: An origin server MUST make a public commitment that it complies with this standard through the provision of a site-wide tracking status resource [[!TRACKING-DNT]].

aleecia: if you're going to comply with this, you should make a public statement

<ifette> pick-and-choose is going to be a reality no matter what the spec says

<WileyS> The FTC will only hold a company to their public committments - so if a company says that then that is what they are gauged on

jmayer: let's suppose we don't have this requirement, companies could select with which part of the spec they're compliant

<WileyS> +q

<npdoty> I believe that's what fielding is suggesting (that the WKL is a claim of compliance)

<jmayer> My point: this requirement establishes a tighter nexus between "we support Do Not Track" and this particular set of documents. It makes enforcement easier.

dsinger: what are the other way out, maybe we should say that the implementation the well known resource is a claim of compliance

<fielding> I don't think that section 6.6 is necessary -- I just want it to be less incorrect.

<jmayer> My other point: There's nothing new here, it's the same way curent self-regulation is (in theory) enforceable.

ifette: linked to waht we expect to be machine readble and what we expect to be human readable

<jmayer> +q

<Chris_IAB> I'm not sure that we need to include mechanisms for enforcement through this spec. Enforcement is a local issue, and we can't possibly address all local legal concerns around the world. Finally, we are not lawyers on this group, are we?

ifette: even that does not prevent the pick and choose approach

WileyS: the language does not change the ability to pck and choose
... an organisation could say I support this part and not this one, the FTC could only verify the part that are claimed

<Chris_IAB> agree, this is a volunteer spec (not a "standards" until it is widely adopted-- definition of standard is wide adoption)

<WileyS> Disagree strongly

<dsinger> people will implement in stages…that's reality

<Chris_IAB> WileyS, who are you disagreeing strongly with?

jmayer: companies will have to be veery explicit if they go for the pick& choose

<fielding> jmayer, you just argued against including this section -- it is irrelevant

<ifette> i'll be amazed if we come to a point where everyone is going to take or leave the spec as-is

<WileyS> Disagreeing with Jmayer assertion that we must look for ways for the entire spec to be supported

<Chris_IAB> Thanks WileyS

adrianba: at MS when the W3C draft come for implementation, we publish a doc explaining the compliance with the spec

<felten> +q

<WileyS> +1 to who was just speaking

<tl> I think that that is one major respect in which DNT and HTML5 are very different.

<rvaneijk> @WileyS: if the spec isn't implemented, even though is already contains MAY's and SHOULDS, what is the added value in the end....

adrianba: browsers may be compliant with only parts of the spec, iterative process

<npdoty> s/who was just speaking/adrianba/

<jmayer> Point 1) we shouldn't facilitate picking and choosing parts of the spec to implement. I'm deeply concerned that reps from Yahoo, Google, and other companies have suggested they might ex post unilaterally renegotiate Do Not Track. Point 2) an explicit representation requirement disincentivizes picking and choosing by requiring very careful phrasing if a company does that. It can't simply say "we support Do Not Track."

<fielding> yep, thanks Ed

felten: we should distinguish global claims vs local claims

<npdoty> adrianba: and for many specs, we don't have 100% of the Recommendation fulfilled in every version of the spec, takes time to implement, etc.

<WileyS> jmayer - we've not suggested anything of that kind - we've only stated it should be an option

aleecia: two difference case you're explaining

<justin_> So a requirement that a company clearly and publicly state *the extent* to which they're compliant with the spec?

<WileyS> Justin, that sounds like a good approach

felten: two representaiton: one in the policy written by PR

<jmayer> +q

felten: one sent by the server to a specific request

<adrianba> s/the W3C draft come for implementation/a W3C draft becomes a W3C Recommendation/

<adrianba> s/explaining the compliance with the spec/explaining our support of the spec/

<npdoty> felten's point, as I understand it, is that a particular response (like header or WKL) should be an accurate representation, separate from questions about your privacy policy

<felten> Yes, Nick summarized me correctly.

jmayer, sorry I did not get what you said

<WileyS> Agreed on the requirement to honor DNT "to the extent to which a server states it will honor DNT".

<dsinger> in the small, what you do implement should comply. whether you have all the i's dotted and t's crossed is another question

<fielding> I prefer Nick's

<npdoty> aleecia: thanks for being on the call today, expect quite a bit of email, including an action for you to respond to a poll regarding tri-part state

<npdoty> ... next week will be TPE

<npdoty> ... we're adjourned this week

<jmayer> My suggestion: We don't have agreement on whether a site should be able to send back "I got your DNT, but I'm not honoring it" while being in compliance with the spec. But I think we might have agreement that, for the ordinary case where a site doesn't send that, it is representing compliance with the entire bundle of DNT obligations. In other words, we don't have agreement on whether DNT compliance extends to all users, but we might have agreement about what i

<ifette> ugh

<ifette> what am i doing wrong

<ifette> didn't participants used to work? ugh

Summary of Action Items

[NEW] ACTION: doty to draft middle way draft on permitted uses [recorded in http://www.w3.org/2012/08/08-dnt-minutes.html#action02]
[NEW] ACTION: doty to set up poll on objections regarding minimum choices for UA [recorded in http://www.w3.org/2012/08/08-dnt-minutes.html#action03]
[NEW] ACTION: mayer to update proposal on permitted uses based on Seattle [recorded in http://www.w3.org/2012/08/08-dnt-minutes.html#action01]
[NEW] ACTION: west to update Compliance spec with pointer regarding issue-21 [recorded in http://www.w3.org/2012/08/08-dnt-minutes.html#action04]
 
[End of minutes]

Minutes formatted by David Booth's scribe.perl version 1.136 (CVS log)
$Date: 2012/08/08 17:32:28 $

Scribe.perl diagnostic output

[Delete this section before finalizing the minutes.]
This is scribe.perl Revision: 1.136  of Date: 2011/05/12 12:01:43  
Check for newer version at http://dev.w3.org/cvsweb/~checkout~/2002/scribe/

Guessing input format: RRSAgent_Text_Format (score 1.00)

Succeeded: s/ecomming/becoming/
Succeeded: s/is/is not/
Succeeded: s/can/can't/
FAILED: s/who was just speaking/adrianba/
FAILED: s/the W3C draft come for implementation/a W3C draft becomes a W3C Recommendation/
FAILED: s/explaining the compliance with the spec/explaining our support of the spec/
Found ScribeNick: vincent
Inferring Scribes: vincent
Default Present: npdoty, +1.646.654.aaaa, eberkower, aleecia, ifette, Chris_IAB, +1.609.310.aabb, felten, +1.714.852.aacc, fielding, BrendanIAB?, adrianba, Dabiano_Nielsen, +1.916.641.aadd, +1.650.308.aaee, robsherman, Joanne, +1.540.822.aaff, WileyS, rvaneijk, +1.202.345.aagg, samsilberman, jeffwilson, [Microsoft], cblouch, RichardWeaver, justin_, +1.202.695.aahh, Lia, +1.202.642.aaii, tl, hwest, vincent, alex, +1.919.388.aajj, johnsimpson, AnnaLong, jmayer, ChrisPedigoOPA, BerinSzoka, dsinger, +1.646.666.aakk, +1.866.317.aall, bilcorry, [Mozilla], dsriedel, +aamm, +1.202.326.aann, Chapell, Brian_Amazon, Chris, Peder, +1.415.520.aaoo, KevinT, +1.425.455.aapp, +1.917.934.aaqq, +1.425.455.aarr
Present: npdoty +1.646.654.aaaa eberkower aleecia ifette Chris_IAB +1.609.310.aabb felten +1.714.852.aacc fielding BrendanIAB? adrianba Dabiano_Nielsen +1.916.641.aadd +1.650.308.aaee robsherman Joanne +1.540.822.aaff WileyS rvaneijk +1.202.345.aagg samsilberman jeffwilson [Microsoft] cblouch RichardWeaver justin_ +1.202.695.aahh Lia +1.202.642.aaii tl hwest vincent alex +1.919.388.aajj johnsimpson AnnaLong jmayer ChrisPedigoOPA BerinSzoka dsinger +1.646.666.aakk +1.866.317.aall bilcorry [Mozilla] dsriedel +aamm +1.202.326.aann Chapell Brian_Amazon Chris Peder +1.415.520.aaoo KevinT +1.425.455.aapp +1.917.934.aaqq +1.425.455.aarr
Regrets: Susan susanisrael
Agenda: http://lists.w3.org/Archives/Public/public-tracking/2012Aug/0013.html
Got date from IRC log name: 08 Aug 2012
Guessing minutes URL: http://www.w3.org/2012/08/08-dnt-minutes.html
People with action items: doty mayer west

[End of scribe.perl diagnostic output]