TPWG Global Considerations TF -- 11 Mar 2013

<peterswire> I am acting as scribe for this session -- statements by "peterswire" are as scribe and not the comments of the chair

<brookman> scribenick: peterswire

http://www.w3.org/2011/tracking-protection/130311-gloco.html for agenda

http://www.w3.org/Talks/2013/03-RW-GloCo-Berlin.pdf is Rigo's presentation; scribing here only for supplemental questions/comments

<schunter> who is on the call?

rvaneijk says that compliance spec can reference the work of global considerations group; rigo responds that he contemplates a document on global considerations rather than have the reference from the compliance spec

rigo emphasizes distinction between things really required in spec, vs. comments about the spec

aleecia suggests cross-references guide at start of the compliance spec, as a way to answer rvaneijk concern

rigo -- if want must/should, then that goes into TPE or compliance spec

<rvaneijk> Art 5.3 2002/58/EC was ammended by 2009/136/EC

rvaneijk emphasizes recital 66 of the 2009 e-privacy directive amendments; mentions browsers and ability to express the consent of the user; the idea of DNT is to use that provision in recital 66

kimon -- agrees mostly with rob; but, says recital 66 applied to existing browser settings as well; wants technology neutrality in the law

Kimon -- include other applications, beyond the browsers, as ways to indicate consent; e.g., flash not handled in the browser interface and insist that is also included

<aleecia> (I think Kimon just suggested that now LSOs are part of browser settings, we may already fulfill recital 66 even without DNT. I have not seen that suggested elsewhere. Kimon, is that what you were saying?)

<fwagner> aleecia, kimon is not on irc….

James Gray - DG Connect: e-privacy revision 2009; change to require "informed consent"; agrees with Rob that recital 66 a way to authorize role for DNT

Mike O'Neill: in 2009 no way to communicate across domains, from 1st party to 3d parties, that consent had been given

text on slide 8 of rigo's presentation is the 2009 text, with the informed consent language

<Weiss_Yahoo> has Recital 66 been transposed in all member states?

<Weiss_Yahoo> Compare and contrast proposed Amendment 108 with existing Article 27 procedure under the DP Act

Rob -- for slide 14, default settings are a fourth bullet; in EU, if want to transpose DNT to EU, then very relevant what the user default settings are

Justin: question of timing; issue when a user is presented with enough information to make a legally active choice

Rigo: absence of D

<moneill2> +q

moneill2: regulation allows pseudonymous data as a category; that's still in process of course; another proposal that pseudonymous should not be re-identified later

<brookman_> Are we really going to revisit the debate about whether the standard applies to first parties? That was settled over a year ago.

responding to brook man -- my understanding is that EU law simply does not recognize a distinction between 1st and 3d parties

vinay: adobe, how we implement is that we see DNT:1 and will apply that the same globally

<ninjamarnau> brookman_ - I think we need to revisit it as part of where 1st/3rd parties fit into the EU controller/processor system

vinay -- says cheaper to do window shade rather implement DNT different in EU and elsewhere

<Thomas_Schauf> Wolf Osthaus is speaking

<brookman> This fundamentally changes the purpose of "Do Not Track"

Wolf emphasizes the possibility of a contract or other agreement between a first party and data subject; that agreement may override what is in the DNT standard that applies to both first and third parties; don't know how to eal with that issue

rigo -- we will discuss this topic later, when revisit first party issues

Rigo -- want to use the tool as button to get 90% of the problems out of the way; that will increase its usefulness

moneill2: it's a signaling mechanism to the browser; or could use cookies to signal consent

justin (Weiss_Yahoo): dividing line in EU is maybe not as simple as characterized so far in the discussion; Art 29 has additional categories, where rules apply to some first and some third parties, but not others

justin: try to address both asymmetries: 1st/3d parties; also Art 29 WG asymmetries, where there are categories

<ninjamarnau> Weiss_Yahoo also pointed out thet the permitted uses of the working group have asymmetries to the permitted uses under the ePrivacy Directive

brookman: 1st/3d party distinction has been at the center of DNT since 2007; why revisit that now

Rigo: DNT is a signaling mechanism; someone sends 1st party a DNT signal

brook man -- compliance spec says 1st parties are out of scope

<vinay> +1 to Brookman

rigo: in EU, everyone subject to legal requirements; not the 1st/3d party distinction in EU
... seeks a 1st party tool for EU, which helps with consent in EU; he wants to reduce the use of window shades

Vinay: for 1st party analytics, will need window shade for that

vinay -- already have a consent mechanism in EU, and it would continue even if have DNT:0, for analytics on first party site

rigo -- disagrees; if DNT:0 is consent, why still need window shade?

<brookman> How will Adobe get the DNT:0 signal?

moneill2: DNT:0 or a cookie -- can say OK by user for tracking

<vinay> pop-up or window shade (because, almost all users if prompted by the web browsers, in which we have no input in, will select 'tell websites not to track me')

brookman: something has to happen for Adobe to get the DNT signal and have it count as consent

rigo: if unset or DNT:1, have exception mechanism, and site can look to that in the exception API
... if define DNT:0, the messaging can be very small; define the average tracking of DNT:0 in the spec itself; only if go beyond that for additional permissions, then window shade or pop up window for those additional actions

weiss_yahoo: don't focus too much on the tech specifics of the window shade

weiss-yahoo: one thing servers can do is get consent for everything at once; other extreme is granular and regional

rigo: in regulated context, law applies, DNT is a tool that allows things within the regulated framework

<brookman> Yes, it allows you to globally reject certain processing by third parties!

rigo: DNT can standardize the most common stuff; DNT:0 permits most of what is done, and only get additional consent if do the smaller use cases
... for sensitive data issues (Art. 8), then need something additional beyond DNT:0; would need to see how to do that

moneill: two issues; need a consent mechanism, on 1st party sites, something will appear, that should be our focus; don't confuse that with the implied consent problem

vinay: another concern about changing DNT means is how consumer educated if rely on browsers to manage consent; "tell websites I don't want to be tracked" and haven't had clear messaging from the browsers about different meanings of "tracking" in different markets
... if defaults with many DNT:1 from browsers, then pop-ups from lots and lots of sites

rigo: when have that, window shades seem attractive, but not over time; lots of people delete cookies

aleecia: roughly 50% delete cookies in 6 months, said Comscore

brookman: on global default settings, ok to DNT:0 for analytics that doesn't authorize "everything server wants"
... could do global setting at first run, say no window shades or whatever?

rigo: yes, a tool exists that is domain based at set-up, do that in a fine-grained way

<brookman> No user is going to set up their browser to whitelist domains for DNT.

<brookman> Like five users.

rigo: don't preclude innovation in permission management; user can start open and go closed; user can start closed and go open; that's an advantage of DNT at the moment

<vincent> brookman, that's why initially I proposed a content/context based exception mechanism. That something that can be built on top of the exception mechanism

<vinay> does anyone have the link to comScore's cookie deletion study?

<brookman> Sensitive data --- another issue we decided not to address as a group over a year ago.

kimon: in EU, advertising is allowed only for over the counter drugs, so no advertising for the prescription, serious medicines; so medical and advertising is a non-issue

<brookman> For the record, I do not particularly like window shades.

shift to session on "Identification of Issues", scheduled for 14:10 start; Peter Swire continues as scribe -- comments here are in that role and not as statements of chair of the working group

rigo: suggest that we note the issues we just identified

ninjamarnau: rather than "audience measurement" discuss DNT:1 permitted uses; under e-Privacy Directive have permitted uses list; interested in aligning these two lists of permitted uses

<aleecia> We may be interested in ISSUE-98 PENDING REVIEW Should we consider applicable laws and regulations, such as the Article 5, paragraph 3 ePriv Dir

rvaneijk: if you want house this consent mechanism, then must work on exceptions

break until 10 after the hour

<aleecia> ComScore, The Impact of Cookie Deletion on Site-Server and Ad-Server Metrics in Australia, January 2011 http://www.stir.nl/upload/documenten/impact-of-cookie-deletion-australiajanuary-20111.pdf

<aleecia> Vinay there are other studies but most use self-reported data, which is not so useful for this question, since many users don't know what browser settings / anti-virus software / private browsing they have

<Joanne> summary of the issues from the first sessions

<Joanne> Issues 1. Asymmetric Issue bridging gap between DNT which distinguishes first part and third party DNT:0 does not eliminate need for 1st party to provide notice obtain consent (e.g. window shades) and timing question 2. Handling of pseudonymous data (category under EU law) (Article 29 categories asymmetries) and asymmetries with permitted uses) 3. DNT default settings in the EU 4. Compare and contrast proposed Amendment 108 with existing Article 27 proced[CUT]

<Joanne> please clarify as needed

<Joanne> add'l issues

<Joanne> Wolf emphasizes the possibility of a contract or other agreement between a first party and data subject; that agreement may override what is in the DNT standard that applies to both first and third parties; don't know how to eal with that issue (revisit as part of first party discussion) 6. Sensitive data issues (Article 8) - need something beyond DNT:0 to handle (note: main WG decided not to address year ago) 7. discuss DNT:1 permitted uses; under e-Privacy[CUT]

<tara> Are you back? Phone seems muted still.

<Joanne> Directive have permitted uses list; interested in aligning these two lists of permitted uses instead of audience measurement

break hasn't ended yet

<Joanne> some of the listed issues from the earlier session may fall under the scope of Issue 98: http://www.w3.org/2011/tracking-protection/track/issues/98

<aleecia> scribenick: aleecia

rigo: list of issues in IRC, incomplete

(note: http://www.w3.org/2011/tracking-protection/track/issues?sort=product has many already)

rigo: first party and restrictions, can we simplfy wording?

issue-14?

<trackbot> ISSUE-14 -- How does what we talk about with 1st/3rd party relate to European law about data controller vs data processor? -- pending review

<trackbot> http://www.w3.org/2011/tracking-protection/track/issues/14

<tlr> http://www.w3.org/2011/tracking-protection/track/products/4

tlr: go with Rigo's issues, reconcile with prior work after
... clean slate
... leave tracker alone for now and reconcile later

rigo: agree.

vinay: better way to phrase, exception and 1st parties separated out
... how does exception mech, implication of contracts, and other relationships affect it? Related but different issues

[note for those on the phone, Rigo is updating slides in real time to capture discussion]

rigo: make a standard, then diff to the user. Your information need to the user is condensed. We have to discuss if this works
... next issue, becomes a subpart of issue 1
... do we have an issue on pseudonymous data? New regulation has implications here

Vinay: only need if we discuss the laws

tlr: it's an issue, we're talking about it

kimon: what about anon issue, is that a different issue?

rob: if it's anon, we don't need to worry about it. Only worry about the process of de-identification.

Thomas: we need to take into account DNT unset
... need discussion on scope of DNT, defn of anonymous data, and personal information
... not only as DNT default in EU, if you want a global standard at the end

rigo: in european context we have start up screen as suggested solution to meet consent requirement

Thomas_Schauf: is that EU only or global?

rigo: ok, doing that as subpoint
... defaults are Peter's discussion

cross-talk suggesting regional, not just EU

rigo: main defaults question is WG and not task force discussion

rvaneijk: defaults in EU is one scenario that might play out there's no gap between tech standard and becoming compliant. Other use cases will have DNT standard but needs additional things to be legally compliant
... in most cases there is a gap between DNT spec and legal
... additional requirements to become legally requirement
... relevant because if we do not accept starting position to becoming legally requirement via DNT, we should not pursue that use case
... could be a remark, but "if you claim to be DNT compliant does not mean you are legally compliant"

aleecia: we have already figured out that DNT unset means have not consented, do we need it as an issue?

summary of discussion, no one had changes they proposed

peter: for anon and de-id, main group has done work already

rob: that's the pain point, we have not met the EU standards under Shane's definition
... the point where we stopped was data retention time. Shane is at 18 months if de-identified. For me, need to look at purpose, 24 hours could be long enough.

<brookman> If third parties can do behavioral tracking despite DNT:unset in the EU, it will not be because of any document this group issues. That will be an interpretation of existing (or future) EU law.

Rigo: put that under pseudonymous discussion

swire: and anon as well?

discussion summary:

if something is pseudonymous enough, do we have to address it? Or does retention time / use still matter?

rigo: if not part of consent mechanism, it's out of scope or permitted use, which has a description of it
... would add article 27 procedure under data protection

rob: fundamental question, if the answer is no, we're doing something completely different with DNT.
... do we still go for that solution or not? If we find it infeasible to use DNT for consent, we need to feed that back to the big group

rigo: sensitive data issue
... article 8, medical data
... in P3P we had issues with double click declaring medical data
... Kimon says there's no pharma advertising so the issue goes away
... is there an article 8 issue or can we skip it?
... if we believe we have to deal with sens data, could have window shade like requirements
... could need additional consent, and javascript API
... should we keep or strike?

rob: keep it. More than just pharma ads, not even in art 8
... fine grained geo-loc, for example

aleecia: already out by the compliance doc

tlr: geo as browser API is orthogonal to this, but inferred other ways (e.g. IP address, or restaurants in small area in search) that could be interesting
... if I've consented by geoloc API, that's already consented

rigo: if geoloc, isn't it an issue for Compliance and not GC?

tlr: we have text and closed issue
... not heard request to reopen

<brookman> Are we really going to tmodulate this document to take into account every country's sector-specific law?

<brookman> Do we need a section on US video record law?

peter: maybe Rob could review geoloc

nope, we have "don't break the law"

<brookman> It was a rhetorical question! :)

frank: geoloc could be an issue, depends on purpose

<brookman> I thought ISSUE-15 (closed) addressed this, but sadly it only mentions kids . . .

frank: geoloc api does not mean consent for all time

rob: pharma ads don't need to deal with, so can we remove art 8 in the whole? Perhaps other categories, but maybe not geoloc. Are there others?

swire: sexual orientation is an example

apple & orange?

political affil?

<brookman> law > DNT

aleecia: can't kill this as an issue yet, maybe we can with more thought

ninja: (too quiet to hear)

swire: sensitive data not part of compliance

rigo: DNT:1 permitted uses under e-priv directive

<ninjamarnau> sorry, wanted to support what peter said. profiling could lead to information about sexual orientation, religion, origin etc.

rob: can we spell out asymmetry here?
... justin raised it but

Justin: what would be a permitted use in e-priv, and first v third party
... US v. EU, permitted use and/or exception could differ

?: we now refer to e-priv only, is that intended?

scribe: existing privacy directive, and e-priv is only cookies
... need current and future too
... exemptions is not just e-priv directive, more general
... also national laws
... example, German law with other exemptions

weiss_yahoo: asymmetry in laws

(thanks, sorry)

rob: can we bridge asymmetry?
... or do we always have a gap?

weiss: what do we *need* it to do to get to compliance. Let's find the delta to the main document. Maybe there is a way to address them, but I want to make sure that all of the exceptions I get the benefit of as an EU company are preserved
... to the point about reconciling in one signal and one server call is a concern

rigo: permitted uses that are allowed in EU are not missing from compliance list, but should check

weiss: first party analytics

rob: not the biggest point to worry about. "Audience measurement" more an issue
... could not exempt first party analytics but it is what we would have advised

rigo: need to discuss
... if we put this in and get recognition from Art 29 WP, could work

weiss: is that realistic?

rob: highly legal env, can only go as far as the law says

rigo: amendment 108 discussion but in the mean time, could have tolerance if this is accepted practice

<brookman> "tolerance" . . .

tlr: would like to hear from Thomas

<brookman> This discussion somewhat belies that argument that Europe doesn't care about the difference between first and third parties

swire: defn of first party not discussed, but has corporate group. Holding company with multiple brands. Does that work in EU?

rob: legal perspective, legal entity

swire: controller is narrower and different in EU

rob: sometimes wider because of data processor, which becomes part of first party

weiss: yes, under 95 directive

rigo: what about wholly owned subsidiary?
... your company but diff legal entity. One party?

ninja: different controllers in Germany

thomas: raising eyebrows to trying to find european standard. Ideally one standard with local taken into account

rigo: working with EU on recognition of W3C standards
... make one standard, earn beneficial legal effects. Remains global standard but get recognition

Thomas: one global standard, yes or no?

<ninjamarnau> to extend aleecia's scribing: if a corporate group contains several legal entities (Ltd., Inc., Corp, AG) these are several controllers, not one single controller

rigo: hope is we can create one DNT with two docs that work globally
... is a hope

,,, means checking entire document against EU laws. But we aren't there yet

Rigo: going through mind map to see if other issues
... do not have defn of DNT:0 marked down yet, central
... use P3P data classes, firefly which was bought by MSFT, wanted full set of online collectable data. Could use it here.

tlr: that's a possible solution, we're working on problem defn

rigo: content of the consent message when you get DNT:0

rob: see you are connecting purposes to DNT:0

rigo: need specific consent

rob: limited list, though.
... for exceptions, data minimization, no secondary use, etc. - including in this text as well?
... limited list gets purpose limitations. Second is addtional limitations like we did with exceptions.

Rigo: DNT:0 makes sense only if we make the assumption that all processing of personal data is prohibited unless you have a legal ground or consent
... all those limitations apply
... suggestion, define DNT:0 in broad way we get rid of 99% of window dialogs
... "do you want the commercial web to work, yes / no" instead of fine grain
... under finality principle and other principles apply here. for the US, irrelevant anyway.
... use an "at least" definition

rob: address asymmetry here as well

rigo: asymmetry is there in legal framework, can explain it, but don't have to make it explicit. You would destroy the American model.
... two possible deliverables. Normative text goes into main docs, or a set of best practices

justin: you mean specifying absolutely not tracking? (hilarity ensued)

vinay: if compliance defines tracking and is geared to 1st or 3rd party, would we need to change the defn of track, or have a different DNT:1 for GC?
... if track or DNT:1 is defined, do we need a way to define it differently?

swire: within WG, people feel we must define tracking, and must not define tracking. Conflict.
... for global reasons if we have DNT:1 and :0 makes it even harder to have normative defn of tracking, because regional (laws?) may be different
... not having tracking defined, there's 23 things that say what you may do, but nothing on top of that. If they work for DNT:0 and :1, that's great

<brookman> In Cambridge, we were getting close to a definition of "tracking" based on what I proposed: tracking is "the collection and retention of data across multiple parties' web domains in a form such that it can be attributed to a specific user or device

vinay: by selecting DNT:0 you're allowing first party analytics, but in most of the world that would be ok with DNT:1
... wouldn't the defn of DNT:0 change?

rigo: -- loses scribe. huh?

swire: EU has its law. Say it's the strictest. Then DNT:0 good globally

vinay: browser says what to users?

rigo: they don't, you tell them

vinay: but the choice is made before they reach a website

rigo: when they come to you, ask them to change, and you present it
... if we don't want the battle on defaults, give a choice upfront

vinay: if we want informed choice, we tell them pros and cons of both choices

<brookman> I think this is an open issue :)

ninja: what does a browser need to do to get informed consent for DNT:1 and :0?

vinay: if it differs regionally, how do browsers explain?
... changes the defn of what DNT means

<Weiss_Yahoo> i'm surprised we've gone this long having avoided the word browser 'wizard'

vinay: if DNT:1 is regional, DNT:0 is too

brookman: DNT:0 means you can track me anywhere, for example.
... then refine "anywhere"

<brookman> MOVING TO MARKET RESEARCH

<brookman> AKA AUDIENCE MEASURESMENT

rigo: nine issues so far, time to move on

<brookman> s/measuresment/measurement

<scribe> scribenick: vinay

Asking whether we switch topics to Market Research due to time constraints/obligations/availability

Q: Does anyone on IRC care/need to talk about Market Research?

Susanisrael expressed interest, but may not be available for a call today

Tara: Market research is a topic she cares about, but not high on her priority list where she needs to discuss it now

peterswire: I don't have a list to call on, and didn't know he was chairing
... but he thought that since we have al ot of knowledgeable people in the room, that we should discuss it to give him (and the group) more info so we can present this to the group

Rigo: checking how long we have the room. We are 30 minutes late.

Peterswire: WOuld like to have the conversation at some point during the 2 days

Rigo: Perhaps we can have this another time, or discuss it over dinner. Prefer to have it now

Fast .. lets track Kimon!

we're trying to get all the relevant people in the room

we're not on an official break

Peter is now chairing

Mission accomplished! We've found Kimon

We have a lot of knowledgeable people in the room right now. Kathy Joe provided language to the grou

scribe: p. Rigo is presenting it on the screen.

Justin was part of the working group that came up with the language Kathy proposed

Justin wasn't part of the group

he was an outsider; and he expressed some concerns over the languag

Concerns: 1) audience measurement still allows for 3rd parties to monitor all my web traffic (albeit for understandable purposes)

found useful: 1) hard requirement that data be anonymized (or did he say pseudonymized); and 2) a hard 53 week retention period

Made the argument that the reports are meant to calculate 1-year

Justin: The other language was not as important because you can still do A LOT with it

PeterSwire: Are these practices different/in line with EU practices?

Kimon: Haven't had a chance to discuss this with his members yet

Peter question to Kimon: Is pseudonymous common in the EU? (like a cookie ID; but not PII like email/name/phone number)

Kimon: Cannot commit; but as far as he knows as limited to audience measurement, you drop a cookie/ use a tag

Justin: I imagine other demographic information is relevant, like age, location, etc.

Kimon: What market research is doing is two things: 1) What is the market share of each of the websites; and 2) (_____) I couldn't catch it

Fundamental problem of research is trying to adjust the numbers

What the large companies do is adjust the numbers against panels (consent-based model); if the panel is large enough, the audience can be used to better the measurements to accrue for inconsistencies

Rvaneijk: two points. Kathy sent the group a document that has notes. Looked at hte document closely. Takes into account a lot of info that he would consider PII (user account info, unique registrant, etc.) . Many categories of data that has to deal with a specific user
... 2) The presentation that David Stark presented contains reports (slides still online) that were meant to show aggregated reports. It said 'unique user'...
... The report shows aggregated results; but it uses browser-level data
... Signaling DNT needs to be meaningful
... audience measurement is something he clearly sees fit within DNT. its a business model that includes data flows that a lot of people may feel uneasy about. So, DNT:1 has meaning towards this type of data

Ninja: If we're talking about pseudonymous data, if we're talking about pseudonymous data as yello data, there are a lot of shades of yellow
... even if you do not have directly identifiable data, if you have enough indirect data, you need to see the context/aggregation to see if it can be re-personalized. needs to be careful about darker yellow categories

rvaneijk: do we need to place limitations on the collection, or the use?

wiess_yahoo: one challenge he sees is on how broadly we define terms like research.
... certain kinds of research may be allowable (even if it contains PII)
... this topic has an ambiguity to it on the purpose for what the data will be used for
... there may be multiple uses of this data. a one-size fits all rule may be challenging for this use case

peterswire: this got started with meetings with Kathy Joe @ esomar. The term I've found 'market resarch' is confusing enough that i'd like to move away from using the term 'audience measurement'
... this new term has fewer ambiguities
... can imagine there would be a functioning economy for this on the internet

<brookman> (an industry that was previously based entirely on opt-in data)

peterswire: On hte internet, there are a bunch of things that can happen without the opt-in
... this group may determine that the nielsen-type may not need to be affected. it may decide that it is a permitted use. what peter wants is to understand how this sort of issue will be thought about in the legal EU context

weiss_yahoo: the 'research' status is relevant under EU law; and it is evolving
... whether that kind of use has been addressed in the Art 29 WP on this
... some of it may fall under a subset of analytics

<peterswire> q/

Kimon: in the offline world, you would be putting people on the bridge to count the number of cars driving each way
... you would have people asking drivers specific questions on where you are driving to

<brookman> I can't think of cross-site passively-collected "market research" that can't also be defined as "audience measurement"

Kimon: in the online world, you have limitations. for example, you have surveys and panels

Peterswire: there haven't been much arguments about the panels
... but there is strong concern over DNT:1 and the 'watching them on the bridge' example

Rigo: I think market research is needed. I'm not saying that its not needed. The Q is does it create databases that law enforcement can access. Concern that they need to watch all of us to see whether the people they've got to sign up is honest

kimon: It always comes back to (_____) Something (I missed it)
... don't share your mistrust.

<brookman> If we can't fix government access issues, then we absolutely have to care about industry databases.

<Weiss_Yahoo> +1 to Kimon's point about differentiating risks presented by the Gov't from risks presented by mere 'holding' of data for legitimate purposes by industry

kimon: on the industry point, we need to come to the conclusion on whether 'we are evil', 'if we're big brother', or 'if we're agreeing where the risk lies'
... in Kimon's view, audience measurement isn't that scary

Justin Brookman: SHould I have any control over a 3rd party watching me for audience measurement?

kimon: it's all a balance in society

Justin: what's your answer

Kimon: you have a control

Aleecia: I'm not looking at this from a state-actor or data-breach perspective. I'm looking at it from a population/consumer perspective that have said "I do not want to be tracked"
... so the question becomes "from a public policy perspective, where do we say 'even though you haven't consented (or you have said no), we still want to track you anyways)
... in the past, we've had a very small set of uses that said we still need to track you anyways
... then we starte dgoing down to use/retention/narrow scope
... the question that I have is: "Does this audience measurement rise to the level of 'we don't care what you want, we're doing it anyways'?"
... "does it rise that level?" I'm looking for the argument on why that's so vital

Kimon: So, if I'm a website, I have to finance myself somehow
... If I'm an advertiser, I have to know how effective my offer is. To know whether I should continue knowing whether I should market online.
... I also want to know about my market share
... Its to know 'what is my market share'? If we don't know how many people are online, the "Internet starts breaking a bit"

<brookman> Panel data has worked in other industries for years

Aleecia: What I hear is, we need to be able to perform analytics on the site, but we need to do analytics across sites.

Kimon: That's not what I'm saying

Aleecia: I'm hearing this as an end-run against independent data rights

Kimon: Its not. It's about aggregation

rvaneijk: I think there are ways ot move forward here; but it may be from my lack of understanding. I have a feeling that hte data collection is not proportionate
... on the bridge example, i write down the license plate and collect other information like car type/ etc.. The question becomes, that event level data, is there a way to anonymize/de-identify it so that there are no license plates there?

kimon: its unfortunate we don't have our colleagues here to look at this more closely

<brookman> I suspect it's not that easy, but I am still curious about how much the passive measurement data really fine tunes the panel data at the end of the day.

moneill: if you limit the identifier for a short period of time, maybe that can solve some of the issue? you don't need to keep the data that long

(did I get that right?)

Rigo: If we define a permitted use for audience measurement, then we could define it in a restrictive way
... then we could set restrictions, such as 'you cannot use this for calibration...'
... htere is an advantage to set audience measurement as a permitted use so you can set the space

weiss_yahoo: Companies are measuring log files. Some of the purposes are permissable for permitted uses
... the log files are still there (because of other permitted uses)
... companies have logical silos
... there is no 1:1 data collection/data storage/data use -- so there's a challenge when there are multiple purposes
... the closer analogy I see is frequency capping
... added benefit of it had some consumer protection element ( so consumers don't see the same ad over and over again)

aleecia: double-keyed cookies would help remove some of the privacy concerns
... I think frequency capping was about money
... double-keyed cookies is in non-normative text
... Aleecia: a lot of people said they could live with the idea of double-keyed cookies

<aleecia> Nooooo!

rvaneijk: would be interesting to recap the discussion on frequency capping
... shows a need and a privacy-friendly alternative
... average time I spend on a specific side of the website is web analytics (first party)
... the analody of frequency capping is not a good one

analogy/ not analody

aleecia: I agree with what Rob said
... is there a way that's good enough?
... Is there a time component that you're doing audience measurement (with, for example, data for one day)?

<brookman> Is panel data plus non-DNT:1 census users enough?

<brookman> Which is more than you get for other industries.

Kimon: Not sure if the timing data is enough; but I'll take this back

rvaneijk: Not sure what we're really dealing with. sounds like a large exception for advertising
... if we're talking about behavioral advertising, do we need aggregate reports?
... How does that work?
... what would be the added value for DNT (since they already have an opt out)
... David Stark talked about a way to provide visibility. how can the consumer figure out who the audience science companies are?

kimon: if we integrate everything in to DNT, we need to evaluate whether it makes sense to put everything in the same basket

rvaneijk: DNT needs to be meaningful; and right now its not meaningful to him

rigo: can there be an opt out for measurement?

<susanisrael> i think of audience measurement as being primarily about measuring the audience for content. Of course, this will be a first-party use in most cases.

<susanisrael> most magazines were sold on a subscription basis and there was a lot of demographic analysis of those subscriber lists

Aleecia: is this enough of a problem to tell people they don't have choices anymore?

peterswire: once a user clicks DNT, it hsould mean something
... core point from privacy: it needs to mean stop collecting data across sites; and can't keep it for 13 months
... for industry it needs to bring value and insight so they can best determine how to manage advertising spend

Kimon: can't forget the diversity of the internet
... lots of different players

<susanisrael> +1 to content diversity point

Aleecia: not taking away own-site analytics

Aleecia: wouldn't also removing those small guys not have that large of an impact to your counts?

<susanisrael> rigo, I can hear some people better than others. thanks. Not perfect, but I get the idea.

Kimon: an advertiser may say "I don't trust you, NYTimes.com, I want to hear from someone independent"

brookman: Why can't you use analytics instead?

<susanisrael> agree that third party measurement is often required to establish trust

<susanisrael> *thanks, Rigo

rvaneijk: This is not just limited to the web. AppNexus does thisi via cookies and fed back to the advertisers. This is also mobile; and all across the internet

rigo: have had very nice research done here. what do you think the willingness of the industry is to 'stuff the DNT:1 users' into the same bucket so you don't get as much info about them as you do from others?

<rvaneijk> http://www.appnexus.com/ebay-case-study

rigo: is there a way to reduce the data but continue to measure
... do you need all this data for the complete picture?

peterswire: was talking to a company in the us about this. what are the characteristics of users between DNT:0 and DNT:1?
... this company hasn't done the research yet
... but was wondering if users who set it have different charecteristics from it

Rigo: the largest and fiercest resistance he's seen in implementation is when people have software they are unwilling to change

rvaneijk: maybe the industry needs to innovate?...

Back to Rigo

Rigo: last part on the agenda today

<tara> Thanks, everyone! Bye!

<rigo> thanks, hear you tomorrow

TPWG Global Considerations Task Force
Face to Face Meeting Berlin

11 Mar 2013

Attendees

Contents

Summary of Action Items

Scribe.perl diagnostic output

TPWG Global Considerations Task Force Face to Face Meeting Berlin