15:51:37 RRSAgent has joined #dnt 15:51:37 logging to http://www.w3.org/2013/04/10-dnt-irc 15:51:39 RRSAgent, make logs world 15:51:39 Zakim has joined #dnt 15:51:41 Yianni has joined #DNT 15:51:41 Zakim, this will be 15:51:41 I don't understand 'this will be', trackbot 15:51:42 Meeting: Tracking Protection Working Group Teleconference 15:51:43 Date: 10 April 2013 15:51:49 Zakim, this will be TRACK 15:51:49 ok, npdoty; I see T&S_Track(dnt)12:00PM scheduled to start in 9 minutes 15:52:46 peterswire has joined #dnt 15:54:21 robsherman has joined #dnt 15:54:37 T&S_Track(dnt)12:00PM has now started 15:54:44 +efelten 15:56:02 LMastria_DAA has joined #DNT 15:57:02 +npdoty 15:57:12 dwainberg has joined #dnt 15:58:07 + +1.202.344.aaaa 15:58:08 +dwainberg 15:58:20 zakim, call thomas-781 15:58:20 ok, tlr; the call is being made 15:58:22 +Thomas 15:58:35 Zakim, who is making noise? 15:58:42 zakim, I am thomas 15:58:42 ok, tlr, I now associate you with Thomas 15:58:44 zakim, mute me 15:58:44 Thomas should now be muted 15:58:45 npdoty, listening for 10 seconds I heard sound from the following: +1.202.344.aaaa (18%), dwainberg (43%) 15:58:50 + +1.202.587.aabb - is perhaps Yianni? 15:58:55 samsilberman has joined #dnt 15:59:17 + +1.240.994.aacc - is perhaps peter? 15:59:18 fielding has joined #dnt 15:59:20 Zakim, mute me 15:59:20 Yianni? should now be muted 15:59:39 Joanne has joined #DNT 15:59:46 zakim, mute me 15:59:46 Thomas was already muted, tlr 15:59:51 Zakim, aaaa is LMastria_DAA 15:59:51 +LMastria_DAA; got it 15:59:56 any volunteers for scribing, such as the first half? 16:00:00 Zakim, LMastria_DAA has mikez 16:00:00 +mikez; got it 16:00:02 +Fielding 16:00:11 rigo has joined #dnt 16:00:16 Zakim, LMastria_DAA has marcg 16:00:16 +marcg; got it 16:00:19 Wileys has joined #DNT 16:00:20 +Amy_Colando 16:00:26 +Joanne 16:00:30 johnsimpson has joined #dnt 16:00:36 +samsilberman 16:00:37 jchester2 has joined #dnt 16:00:43 zakim, call rigo-mobile 16:00:43 ok, rigo; the call is being made 16:00:45 +Rigo 16:00:48 Chris_IAB has joined #dnt 16:00:49 +BerinSzoka 16:01:00 +WileyS 16:01:01 prestia has joined #dnt 16:01:08 +WaltM_Comcast 16:01:11 jeffwilson has joined #dnt 16:01:23 +JeffWilson 16:01:26 vinay has joined #dnt 16:01:33 scribenick: LMastria_DAA 16:01:33 justin has joined #dnt 16:01:39 +vinay 16:01:48 +RichardWeaver 16:01:56 kj has joined #dnt 16:01:59 +??P49 16:02:08 Richard_comScore has joined #dnt 16:02:08 +[CDT] 16:02:11 Just joined via a private number 16:02:19 +jchester2 16:02:21 zakim, ??P49 is probably Chris_IAB 16:02:22 David_MacMillan has joined #dnt 16:02:22 +Chris_IAB?; got it 16:02:24 zakim, mute me 16:02:24 jchester2 should now be muted 16:02:27 +[Apple] 16:02:29 discussion re UI did not have issues ... Peter apologuzed and soon to be issued w numbers by Nick Doty 16:02:36 zakim, [apple] has dsinger 16:02:36 +dsinger; got it 16:02:44 +johnsimpson 16:02:51 +hwest 16:02:58 Chapell has joined #DNT 16:03:07 +chapell 16:03:34 Chapell proposal re user education = 1st item on agenda...waiting for Matthias b/c proposal is a confluence w TPE 16:03:57 hefferjr has joined #dnt 16:04:06 action-373? 16:04:06 ACTION-373 -- Aleecia McDonald to propose text prohibiting data append (because it requires sharing, or otherwise; with jchester) -- due 2013-03-20 -- OPEN 16:04:06 http://www.w3.org/2011/tracking-protection/track/actions/373 16:04:07 Swire moving to append? b/c wanting to wait for MAtthias 16:04:08 +??P21 16:04:14 zakim, who is making noise? 16:04:21 so, now moving to issue 373 16:04:22 kj has joined #dnt 16:04:23 agenda: http://lists.w3.org/Archives/Public/public-tracking/2013Apr/0071.html 16:04:25 dsinger, listening for 10 seconds I heard sound from the following: peter? (57%), hwest (56%) 16:04:35 +hefferjr 16:04:39 zakim, code? 16:04:39 the conference code is 87225 (tel:+1.617.761.6200 sip:zakim@voip.w3.org), adrianba 16:04:40 topic: Data Append 16:04:53 Zakim, ??P21 is schunter 16:04:53 +schunter; got it 16:04:56 + +1.650.465.aadd 16:04:56 hwest has joined #dnt 16:05:13 much of discussion came to a subset of categories for data append 16:05:17 ninjamarnau has joined #dnt 16:05:21 where is Yianni's memo? 16:05:22 Marc_ has joined #dnt 16:05:23 +[Microsoft] 16:05:31 zakim, [Microsoft] is me 16:05:31 +adrianba; got it 16:05:36 zakim, mute me 16:05:36 adrianba should now be muted 16:05:45 + +49.431.98.aaee 16:05:46 Mike_Zaneis has joined #DNT 16:05:52 1st party operating as a 3rd party...asking FB (rob sherman) to talk about bare bones language 16:06:00 zakim, aaee is ninjamarnau 16:06:00 +ninjamarnau; got it 16:06:19 background memo on append: http://lists.w3.org/Archives/Public/public-tracking/2013Apr/0070.html 16:06:27 thanks, Nick 16:06:55 Brooks has joined #dnt 16:06:57 moneill2 has joined #dnt 16:07:05 +Brooks 16:07:07 Chris Pedigo not avail right now, so moving along 16:07:07 zakim, aadd is David_MacMillan 16:07:07 +David_MacMillan; got it 16:07:26 +[IPcaller] 16:07:30 +[IPcaller.a] 16:07:35 Zakim, Ipcaller is Walter 16:07:35 +Walter; got it 16:07:43 zakim, unmute me 16:07:43 jchester2 should no longer be muted 16:07:47 zakim, [IPCaller] is me 16:07:48 sorry, moneill2, I do not recognize a party named '[IPCaller]' 16:07:58 Zakim, [IPcaller.a] may be moneill2 16:07:58 +moneill2?; got it 16:07:59 ok to review white pages and other material 16:07:59 Zakim, IPCaller.a is moneill2 16:08:00 sorry, Walter, I do not recognize a party named 'IPCaller.a' 16:08:21 Disagree with this approach as it can't be applied in real-time. This approach requires the 1st party store a user's DNT signal in the online world for application in the offline world. This is FAR outside of the scope of the DNT. 16:08:33 cOlsen has joined #dnt 16:08:36 John Simpson: should not include 3rd party data 16:08:47 if it's out of scope, then it's out of scope-- not prohibited 16:08:51 q+ 16:09:06 J Chester: targeting should be prohibited 16:09:09 zakim, mute me 16:09:09 jchester2 should now be muted 16:09:13 +[FTC] 16:09:17 +Chris_Pedigo 16:09:32 vincent has joined #dnt 16:09:36 +q 16:09:36 ChrisPedigoOPA has joined #dnt 16:10:01 What are concrete examples? 16:10:07 John Simpson: accept a distinction between online and offline; if the data is out of band, not a problem 16:10:08 Mejia: out of scope clarification being sought .... is something prohibited or out of scope? 16:10:20 Agree with Shane's technical point. On a broader point, we agreed that 1st party activities should generally be out of scope of the DNT standard. I would oppose this provision. 16:10:22 I thought maybe John Simpson and Chris Mejia are agreeing? 16:10:30 Would this be an example: The site gets my IP, determines that I am in Darmstadt and pulls 3rd party data on Darmstadt Weather? 16:10:37 zakim, unmute me 16:10:37 jchester2 should no longer be muted 16:10:42 Swire: if we prohibit something out of scope, does not seem to make sense 16:10:49 There is a queue John 16:10:50 q? 16:10:57 Zakim, who is making noise? 16:10:57 zakim, who is making noise? 16:11:02 ack Chris_IAB 16:11:07 npdoty, listening for 10 seconds I heard sound from the following: peter? (6%), WileyS (5%), johnsimpson (86%) 16:11:12 zakim, mute me 16:11:12 jchester2 should now be muted 16:11:18 dsinger, listening for 10 seconds I heard sound from the following: peter? (55%), Chris_IAB? (15%), jchester2 (4%) 16:11:24 +vincent 16:11:26 -Rigo 16:11:31 Simpson: 1st party cannot bring data from outside 1st party transaction 16:11:40 John Simpson: wouldn't try to prohibit combining data like from White Pages and being used offline, but would prohibit its use *during* an online transaction 16:11:42 JC has joined #DNT 16:11:45 zakim, unmute me 16:11:45 jchester2 should no longer be muted 16:11:47 +robsherman 16:11:58 q? 16:12:07 q+ 16:12:19 Mejia: is scope to collection/use of online data? 16:12:36 J Chester: are we talking onlinbe context only? 16:12:55 zakim, mute me 16:12:55 jchester2 should now be muted 16:13:07 +[Microsoft] 16:13:18 Swire: turn to shane, but has heard this issue before re using data for online ads 16:13:21 ack Wileys 16:13:31 Shane: agrees to out of scope concept 16:13:31 Lou. Sorry. Is this a question for me or are you scribing? 16:13:34 Zakim, call rigo-mobile 16:13:34 ok, rigo; the call is being made 16:13:35 +Rigo 16:13:50 Lou is scribing 16:13:58 +q 16:14:08 Let's discuss the role of cookie syncing and other applications regarding append 16:14:17 zakiom, who is making noise? 16:14:21 Zakim, mute me 16:14:21 schunter should now be muted 16:14:22 Shane: offline...we don;t know the signal of the offline data 16:14:40 q? 16:15:09 Discussion of what is in/out of scope might benefit from consulting the group's charter, which defines the scope. 16:15:15 it's not just real-time application only. we are calling for a permanent status unless otherwise notified. 16:15:31 WileyS, would you also imagine that it covers data previously collected by a third-party with a DNT:1 signal? (doesn't have to be real-time append) 16:15:36 zakim, unmute me 16:15:36 jchester2 should no longer be muted 16:15:40 Nick, 16:15:50 Swire: Shane asks a productive question of John and Jeff re data append 16:16:07 Nick, we already agreed that DNT signals wouldn't require historical purges - although a 1st party may choose to do so 16:16:17 Jeff Chester: 3rd party indicates that it received DNT signal 16:16:27 still has to be worked out 16:16:28 zakim, mute me 16:16:28 jchester2 should now be muted 16:16:58 WileyS, right, I just mean data that was collected by a third-party under a DNT:1 signal couldn't be shared later (much as it couldn't be shared in real-time) 16:17:29 q+ 16:17:35 Nick, agreed 16:17:36 Chapell: 2 different uses are being described ... 1st party appends in a non-online scenario...2nd: at time user vists large publisher, checks w 3rd parties to bring more data to reg process. clarify? 16:18:02 q? 16:18:14 Swire: Shane...re scenario 2...if DNT signal is obeyed, then applies 16:18:48 wait, but if I connect to a first party, and the first party makes a server-side request to a third-party to match up content customization data about that customer, the third party *isn't* receiving a DNT:1 signal from the user (because they don't communicate directly) 16:18:58 You don't need a matching key - can pass in real-time via a web beacon 16:19:00 ack Chapell 16:19:04 ack moneill 16:19:13 to be clear, you couldn't use an IP address to link data together RELIABLY - ip address is more like a zip code than a specific address 16:19:20 is Matthas on the call now? 16:19:27 close q 16:19:33 Mike o'Neill: need an identifier to link data together, possibly pass data w/o signal (out of band - ajax, etc)... 16:19:36 WaltM_Comcast has joined #DNT 16:19:36 Zakim, please close the queue 16:19:36 ok, npdoty, the speaker queue is closed 16:19:39 IP address is not a unique identifier 16:19:40 zakim, seen schunter? 16:19:40 probably, tlr; schunter arrived 15 minutes ago 16:19:52 Chris_IAB: not reliable enough for a criminal prosecution, but often > 90% reliable 16:19:54 ack robsherman 16:20:03 + +1.646.654.aaff 16:20:21 Walter, my research does not concur with 90% reliability. 16:20:28 Robsherman: apologies for late...2 points: obliigations on 1st parties = a long settled issue and reopning may be challenging...it is not append 16:20:52 for example, I'm at a hotel right now, sharing the same exact IP address with about 500 other users I'd guess 16:21:05 Robsherman: language sweeps too broadly. 16:21:07 Marc has joined #dnt 16:21:36 Rob: Explain further your example. Please 16:21:42 RobSherman: taggings on FB would be unintended consequence and there are many more 16:21:46 the only thing I share with the 499 other guests, other than my IP address, is that we are all staying at a Hilton hotel-- but that's it 16:21:49 I didn't see that implication, robsherman, that might be worth offline explanation 16:21:57 -Rigo 16:21:58 Chris_IAB, true but you can clearly dissociate cases where there are 500 poeple behind an IP address and cases where there is only 1 person 16:22:57 + +1.646.654.aagg 16:23:10 Swire: does DNT1 blocks appends in scenario mentioned by Shane...a long way from consensus on this 16:23:21 robsherman: would be re-opening a closed issue, might require fundamentally rethinking the spec 16:23:25 vincent, it is POSSIBLE to do that, I agree, but it represents an edge case for RELIABLY identifying a unique user, not the norm-- industry does not use IP address (alone) to identify a unique user (for frequency capping, for example), because it is not at all reliable a proxy 16:23:44 Zakim, aagg is [Nielsen] 16:23:44 +[Nielsen]; got it 16:24:05 Simpson: clarifying question: a lack of consensus re scenario 2 (realtime append) 16:24:17 so let's clearly differentiate-- ad industry doesn't do this-- we don't use IP address as a proxy for a unique, because it's highly unreliable in that respect 16:24:24 Swire: trying to clarify by moving to a list of issues 16:24:26 Chris_IAB: http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2002/wp58_en.pdf 16:24:37 anyway, sadly I have to drop out 16:24:41 Item #3 on agenda (UI) is now up 16:24:46 Topic: User Education and User Interface 16:24:47 -Walter 16:24:50 Walter, I get that they got this wrong in Europe :) (my POV of course) 16:25:00 +Rigo 16:25:02 Chris_IAB, don't use it or don't use it *alone* ? 16:25:16 Chris_IAB: I used to think that too, but have changed my opinion. But have to run now. 16:25:17 Swire: unclear how much this is TPE or Compliance spec...perhaps a convergence of the two 16:25:38 Look att he 2 proposals and review 16:25:50 Alan Chappll goes, then Adrian 16:25:53 Zakim, please open the queue 16:25:53 ok, npdoty, the speaker queue is open 16:25:55 ack Chapell 16:26:02 vincent and walter, happy to take this discussion off-line if you like (please ping me at my email address)-- for now, I'd like to hear the current proposal 16:26:21 -Amy_Colando 16:26:37 Chapell: goal=set guidelines 1: decision to ste DNT is a maeningful decison of the user 16:26:52 q? 16:26:53 2: functionality matches what we've discussed 16:27:12 Goal: user should be making an informed choice 16:27:31 Swire:normative text...what would be biggest changes 16:27:33 q+ 16:28:10 Chappel: point 1: clairfies that if extension or add on is used, then extention or add on is subject to this language 16:28:24 I've previously recommended that we explicitly note that any other software that modifies a DNT header (like a plugin) should be held to the same requirements 16:28:28 w/o this informed choice is not achieved 16:28:42 vincent- in advertising, the reliable proxy for a unique user is a cookie; let's discuss further offline 16:29:21 accurate descriotion of DNT (including parties) and provide a link or decription re DNT functionality...button/link maybe same thing 16:29:22 The DNT signal is broadly applied whereas exceptions are individually applied so therefore the bar should be higher for UAs to activate DNT. UAs without UIs would need to find solutions to ensure users understand what is occuring in other ways (such as during install time). 16:29:25 zakim, unmute me 16:29:25 adrianba should no longer be muted 16:29:33 I think we agreed in Amsterdam to re-draft Shane's proposal to be less specific about "link" 16:29:34 Chris_IAB, sure, thx 16:29:40 Chapell, we could just define the word "link" to include other things, like buttons 16:29:50 Nick, yes - I already sent that out 16:30:26 q? 16:30:26 Chapell, how about we call it an "object" or "web object" 16:30:28 moved it to "reference" I believe and that fixed the issue 16:30:35 Adrian: proposed alternative: button/link:prescribing link = too specific, some other UI to get to this information is fine... 16:30:37 indeed, WileyS!, I linked to it last night: "The User Agent MUST make available explanatory text to provide more detailed information about DNT functionality within easy and direct access for the particular environment prior to DNT being enabled." 16:30:39 Chapell, or "rendered web object" 16:30:42 WileyS, That is a different argument than you were making last year. 16:30:47 +q 16:30:53 Thank you Nick 16:30:53 Should not necessarily a must question being posed 16:31:20 Justin - it is more nuanced now - many called out this unbalanced situation and therefore my position has evolved. 16:31:20 if education is an online link, then perhaps you cant access 16:31:29 expalanatory text 16:31:32 +[Microsoft.a] 16:32:00 Justin - I don't believe the delta should be large but I do believe the UA's requirements are " 16:32:03 higher" 16:32:11 q+ 16:32:34 -Rigo 16:32:40 q- later 16:32:49 q+ 16:32:53 broader question: Adrian: set of actions re user choices not solely scoped to UA...site exceptions?...or other UA? 16:33:18 WileyS, I see. And I have pointed out the arguments about why the consent requirements should be stronger for the exceptions. I thought we had come to a good-faith compromise. This is disappointing. 16:33:50 adrainba- do you think we are CLOSE to an agreement with Chappell's proposal? 16:33:50 Adrian: examples re add-in, non-normative text may be helpful for discussions, but the normative text is what will be used and good to have the simpler doc we're working with right now 16:33:54 Justin, are you disagreeing that DNT set at the UA has broader application than an individual site exception? 16:34:14 Swire: when would primer doc be written...before ort after last call? 16:34:59 q? 16:34:59 I will just more that there is symmetry between what you want the user to do for dnt1 and for dnt0 16:34:59 q- 16:35:10 s/more/note/ 16:35:22 Adrian...no particular time, but as a user, you may want to read something ... example, XML schema was done after....just don't want to be doing at the time when normaitve doc is being debated 16:35:31 q? 16:35:40 q+ 16:35:47 Justin, when you look at a race-to-the-bottom, per Jonathan, this can be accomplished from both sides - so this is equal in my mind. Therefore we you step back from that position to the breadth of application, the UA is significantly broader than an individual site exception. 16:35:54 s/we/when 16:36:01 Swire: Doty email: talk about common resource (perhaps from w3c) re normative text? 16:36:16 s/normative/informative/ 16:36:23 q? 16:36:25 q+ 16:36:46 Adrian: in support of resource, but not complete replacement for primer 16:36:46 q+ 16:37:05 To the extent that an exception allows entities to track universally, I'm not sure the distinction is actually that meaningful. 16:37:10 Zakim, please close Q 16:37:10 I don't understand 'please close Q', peterswire 16:37:14 Zakim, please close the queue 16:37:14 ok, npdoty, the speaker queue is closed 16:37:22 ack efelten 16:37:40 Mobile apps can display web content 16:37:59 email formatted in HTML can cause HTTP fetches, and is thus a UA, for example. 16:38:08 Those UAs can be updated to provide this information prior to activating DNT. If they cannot, they should not attempt to activate DNT. 16:38:08 efelten, wouldn't it be fair then, if we need user consent, that those UAs that can't get it, don't do DNT? 16:38:15 help viewers are often written using HTML, also 16:38:19 I believe we are talking about the UI of a configuration, not the UA itself 16:38:25 WileyS, if you think that the consequence of turning on DNT is more important to the individual, then existing law would require great transparency obligations. 16:38:25 isn't that a fair requirement? 16:38:27 Felten: many UAs not browsers...informed choice could be there, but caution 16:38:29 +q 16:38:32 Mike_Zaneis has joined #DNT 16:38:32 ack schunter 16:38:42 Zakim, unmute me 16:38:42 schunter was not muted, schunter1 16:38:54 ack schunter 16:39:05 ack Chris_IAB 16:39:27 If a UA is incapable of presenting accurate choices to a user then that UA should not present DNT as an option, which is meant to be a user choice. 16:39:33 +1 Chris 16:39:45 +1 16:39:48 Peter: We can continue this discussion until the full hour (folding in my exception discussion). 16:39:53 Mejia: re Felten, express consent ... if UA can't get consent, then UA doesn't have to honor dnt 16:40:08 Matthias: ok; please open the Q again 16:40:09 efelten, is your point about not being very specific about UI? or that informed consent may just vary for different user agents? 16:40:17 Zakim, please open the queue 16:40:17 ok, npdoty, the speaker queue is open 16:40:21 q+ schunter 16:40:47 Zakim, please close the queue 16:40:47 ok, npdoty, the speaker queue is closed 16:40:47 The spec already says that you need to get the users consent to turn on DNT. 16:40:55 s/users/user's 16:41:24 Felten: expressing caution that interaction can happen...so platform, etc...so long as user is informed 16:41:25 efelten, right, but we are not talking about the time of interaction -- we are talking about the UI for setting a non-default configuration option. 16:41:39 Alan's language does talk about time of interaction. 16:42:02 nick -- please open the Q; matthias has provided more time for this 16:42:03 +1 to justin, there's agreement (and existing text) about consent 16:42:11 Zakim, please open the queue 16:42:11 ok, npdoty, the speaker queue is open 16:42:12 Swire: point out that spec = MUST, but DNT may need to be before 16:42:15 q? 16:42:40 Felten: understand info being presented to user 16:42:59 Zakim, who is making noise? 16:43:08 Swiree: follow up after today re Mejia and Felten re time 1 and time 2 16:43:09 Zakim, mute schunter 16:43:09 schunter should now be muted 16:43:10 npdoty, listening for 10 seconds I heard sound from the following: hwest (1%), chapell (15%) 16:43:15 ack Chapell 16:43:39 well, *how* something is presented is different from *what* needs to be presented -- the *how* can be just a list of non-normative examples 16:44:07 +1 to fielding. we should talk about *what* not *how* 16:44:11 tech companies can ALWAYS find a way to message users :) 16:44:30 Chappel: re Mejia: unfortunate if we created std that violates Privacy By Design...would be surprised whether regulators would be swayed by the unability of tech to present the choice 16:44:41 q? 16:44:49 Chappel: Adrian: exception that swallows thwe rule 16:44:53 David, the issue is strength of "what" which implies a "how" - there is important nuance here 16:44:54 ack dsinger 16:45:41 Singer: a browser help could explain DNT for members of what IAB members and others would like to explore more in the community and is a good idea 16:45:59 Am cncerend about the how 16:46:04 How is a legal question . . . 16:46:09 What about a mail agent? 16:46:20 as an example, this concept of linking to an educational resource, is available today via the industry's icon-based self-regulatory program 16:46:25 -robsherman 16:46:28 so I can tell you that it works :) 16:46:34 one more thought re: non-normative language --- I'm not sure if Adrian is advocating getting rid of all non-normative language or just some. I may want to revisit the normative language if the group's consensus is to get rid of the non-normative language 16:46:48 q? 16:46:59 Justin, there are equal parts "guidelines" and "laws" for "Hows" 16:47:20 WaltM_Comcast has joined #dnt 16:47:21 q+ 16:47:25 Singer: text such as accurately may be an issue 16:47:30 Chappell, please change "Guidelines" to "Rules" and keep "Must" 16:47:49 We can and should include guidelines here - fair? If we want to only apply the legal bar - I'm fine with that across the board (UA DNT activation and site exceptions) 16:48:04 ack dwainberg 16:48:32 +1 to David Wainberg 16:48:47 Wainberg: Should vs Must: for the compliance, there many things which cannot be tested... 16:48:52 I appreciate it is difficult to make 'must testability' a hard rule, but we should only contravene when we..um…must 16:49:08 q/ 16:49:09 it may have been that Alan was using "guidelines" because the charter specifically notes that guidelines are in scope, while specifying UI would not be 16:49:18 Wainberg: vcan't think of a real eexample where a user cannot be offered information about a choice 16:49:30 q? 16:49:59 WileyS, Not entirely sure what you mean by guidelines, but I wouldn't mind at all examples saying, "here are ways you could do it." But I think you are probably right that legal bar is probably the right way (http://lists.w3.org/Archives/Public/public-tracking/2012May/0118.html). I disagree with jmayer's proposed language on exceptions. 16:50:13 Wainberg: perhaps separate guidelines for websites and broswers ....the convos need to remain together for the time being 16:50:17 DNT is not Privacy By Design. DNT is a user preference; it should not be mistaken for a security/privacy protocol that is actually designed to preserve privacy. 16:50:19 Justin, okay. 16:50:25 ack schunter 16:50:45 Swire:Brookman wrote that extensivce interactions abouut UAs and users...correct? 16:50:48 Yes, Nick --- that's why I used Guidelines. I'm happy to state "rules" if that is helpful 16:50:54 efelten, btw, the digital ad industry didn't use to have a mechanism to message users about OBA targeting; then the FTC and others asked us to do this, and we figured out a way to do it, in the tech. So I don't buy the idea that UAs won't adapt as well, if they want to set DNT. 16:50:58 to fielding: agree, we cannot boil the ocean, we cannot fix every privacy issue online. this is about DNT, HTTP transactions, and people... 16:51:23 Nick, please close the Q 16:51:31 to justin and adrian: I strongly agree we should not agree text on what UA consent means without the same, or parallel text, on what site consent means 16:51:41 Brookman: section 3-11, prescriptive for one and prescriptive for another 16:51:59 Justin, this means industry will separately evaluate each UA's implementation and will decide per each if they will recognize that signal (and reply appropropriately in real-time). Issue 143 will need to be closed for this to finally be settled. 16:52:23 Zakim, please close the queue 16:52:23 ok, npdoty, the speaker queue is closed 16:52:44 the incentive for sites to be 'economical' with their explanation and so on is strong. 16:52:44 Brookman: leave to market and regulators to figure out 16:53:52 Shane, wasn't that your point with 143? "As we've developed draft text for obtaining explicit, informed consent from a user for out-of-bound user granted exceptions, it's equally important that activation of a tracking preference be coupled with the same explicit, informed consent." 16:53:55 Wainberg: how prescriptive we should be and whether requiremenets are equivalent on both sides...we should set these q's aside and perhaps bring the convos together in the futryure 16:54:01 there is some commonality in requirements; but the consent/explanation for sites to get DNT:0 should be stronger (as this implies a weakening of privacy) 16:54:36 q? 16:54:46 Matthias: ensuring exception alings w what user wants...we should have requirements, including what informed consent is and what education and choices should be discussed 16:55:19 Matthias:implementation POV: should be balanced between broswers and sites 16:55:29 Nick, my goal in 143 is that UAs that are setting DNT that are not the web browser but are sending the signal through the UA should name themselves in the DNT header (would require a change to the TPE). 16:55:30 WileyS, I think I've been sold on the idea that servers should be able to send back some sort of signal that a stated preference is not being honored. 16:55:39 Justin, great. 16:55:48 Matthias, ONLY 20-pages? ;) 16:55:52 ack Chapell 16:56:14 We can make it 50, too ;-) The global # of trees is the limit ;-) 16:56:14 +1 to Chappell 16:56:19 Chappel: non-normative language: caution using it as a way to "kick the can" on open issues 16:56:47 port_6665 has joined #dnt 16:56:47 Swire: summary: developing a resource for visible link for explaining these issues 16:56:47 My goal is to keep those requirements "as light as possible but no lighter". 16:56:55 schunter1, trees? bytes man, bytes :) 16:57:01 Most mobile apps are UAs, for example. 16:57:04 Swire: UAs that don;t have browsers and we may need examples 16:57:30 efelten, why can't a mobile app that wants to set/send DNT, not message the user? 16:57:43 Swire: there may be apps or other things where at Time 1 and a subsequent time when choices may no longer be able to be negotiated 16:57:47 in fact, the NTIA is trying to define this now, no? 16:57:56 Not all apps have an interactive UI. e.g. widget that displays current temperature in tiny type in upper corner of my phone's home screen. 16:58:10 Swire: Aleecia circulated the tri-partie issue 16:58:13 Ed, agreed - so each should include fair disclosure and user choice if they desire to support DNT- that's part of the price of admission to DNT. 16:58:24 Felten to bring up examples in 1 week 16:58:37 efelten- those apps CAN have mechanisms; that they don't today, is simply the a reflection of the state that they don't have to, no? 16:58:44 Timing issue...Felten to bring up examples as well 16:58:45 Ed - they can - at install and at time of placement on the screen. 16:58:45 Ed, how would a user, in the case of such an app, set the DNT signal? 16:58:47 … so the configuration UI is important to our task of defining a protocol that is supposed to communicate the user's preference: the user's understanding of DNT needs to be compatible with what the specification says the preference communicates. I'd be happy with any UI that doesn't set DNT:1 by default and doesn't mislead users about the meaning of DNT. 16:58:48 action: felten to draft examples regarding different UAs with different UI affordances 16:58:48 Created ACTION-390 - Draft examples regarding different UAs with different UI affordances [on Edward Felten - due 2013-04-17]. 16:59:03 Swire to circle to Alleecia and Matthias re tr-Partite 16:59:25 Chappel, Adrian, others...can we work on revisions 16:59:26 I'll have some revisions - and would be happy to speak with Adrian 16:59:34 happy to discuss 16:59:55 -samsilberman 17:00:02 I'm curious,. Do we think that a UA must be able to grant exceptions to be compliant? 17:00:07 action: Chapell to update UI/consent proposal (including discussion with Adrian) 17:00:08 Created ACTION-391 - Update UI/consent proposal (including discussion with Adrian) [on Alan Chapell - due 2013-04-17]. 17:00:34 -Thomas 17:00:53 scribe? 17:00:54 -BerinSzoka 17:00:59 scribenick: dwainberg 17:01:07 zakim, who is making noise? 17:01:15 issue-187? 17:01:15 ISSUE-187 -- What is the right approach to exception handling? -- pending review 17:01:15 http://www.w3.org/2011/tracking-protection/track/issues/187 17:01:19 dsinger, listening for 10 seconds I heard sound from the following: peter? (12%), hwest (49%) 17:01:23 Topic: Site Consent, 187 17:01:29 Zakim, mute hwest 17:01:29 hwest should now be muted 17:01:32 schunter1: Issue 187: what is the right approach to exceptions. Offline in email 17:01:41 Sorry about that - I'm muted on this end but clearly that's not working 17:01:46 ... I discussed w/ Jonathan, and there is no more resistance to the new exceptions. 17:01:51 -WaltM_Comcast 17:02:02 ... and the remaining concern is whether there is a race to the bottom for UX 17:02:13 ... i.e. getting exceptions w/ minimal user interaction. 17:02:33 ... so pare this down to "what conditions necessary for setting an exception." 17:03:09 ... there is currently language in 6.3.1 17:03:16 +q 17:03:24 Zakim, please open the queue 17:03:24 ok, npdoty, the speaker queue is open 17:03:25 ... basically says you must be reasonably certain the user wants the exception 17:03:27 q+ moneill2 17:03:34 ... Jonathan proposed 3 points. 17:04:07 Jonathan proposed these three requirements that refine this language and that I would like to gather feedback on: 17:04:07 1) Actual presentation: The choice mechanism MUST be actually presented to the user. It MUST NOT be on a linked page, such as a terms of service or privacy policy. 17:04:08 17:04:10 2) Independent choice: The choice mechanism MUST be presented independent of other choices. It MUST NOT be bundled with other user preferences. 17:04:12 17:04:14 3) No default permission: The choice mechanism MUST NOT have the user permission preference selected by default. 17:04:16 17:04:47 q? 17:04:54 does #2 mean the site can't say "Give me an exception, or pay me for access?" 17:04:54 ack moneill2 17:05:02 q+ 17:05:17 q+ 17:05:20 moneill2: idea of "at the time". There are sites with large numbers of domains. 17:05:38 ... and the problem of signaling consent across domains. 17:05:54 q? 17:05:57 ack JC 17:06:00 ack j 17:06:04 Zakim, mute jchester2 17:06:04 jchester2 should now be muted 17:06:05 q+ to ask about #2 17:06:27 JC: responding to item 2, one can infer from that a company can't create a preferences page that has DNT as one item. 17:06:30 seems like if we agree that sites are responsible for getting consent for exception then the mechanisms for doing so are part of the discussion earlier 17:06:40 ... also possibility to consolidate mechanisms in the future. 17:06:53 ... so would like us to reconsider point 2. 17:07:15 schunter1: so the point is it might be that we set all the privacy preferences in a package. 17:07:23 Jonathan's "independent" requirement seems the only major difference from adrianba's text, I think 17:07:25 ack ch 17:07:34 JC: yes, as just an example. Or, e.g., some browsers have a privacy page. 17:07:55 ChrisPedigoOPA: it seems like under this a user couldn't be presented with the choice as part of a sign up. 17:08:10 ... I don't think it's reasonable to say you couldn't include in one page or one question. 17:08:37 Item 3) covers that 17:08:40 q? 17:08:41 zakim, who is making noise? 17:08:45 ack d 17:08:45 dsinger, you wanted to ask about #2 17:08:52 dsinger, listening for 10 seconds I heard sound from the following: +1.646.654.aaff (19%), schunter (5%), [Apple] (85%) 17:08:54 dsinger: reads #2 differently. 17:08:56 yeah, that might be the motivation, if it's bundled with the terms of service, that might be objectionable to many of us 17:09:20 Good point 17:09:22 ... Read it as implying you couldn't have linked choices, e.g. if you don't agree to the exception you can't have ... 17:09:35 q+ 17:09:39 q+ 17:09:39 q? 17:09:42 ack C 17:10:17 ChrisPedigoOPA: elsewhere in the compliance doc, I think we say it's ok to alter experience or refuse access if DNT is on. 17:10:34 I agree that we have made that decision as a group 17:10:55 q+ 17:11:02 schunter1: I think the purpose of item 3 is that there has to be an explicit choice. 17:11:36 ack n 17:11:37 ... so there has to be an exit point from the page that allows not to grant an exception. 17:11:44 q+ 17:11:58 npdoty: one way we think about things you accept when you use a site. e.g. a TOS. 17:12:09 With respect to #2, if the purpose of service is tracking and that's fairly well understood up-front, I don't see the need to "overly" state that DNT will not be recognized for this service. We're elevating DNT above all other considerations and that doesn't feel nuanced enough to match real-world situations. 17:12:11 q+ 17:12:21 ... so having the choice in the TOS would undermine what we're trying to get at. 17:12:45 we had previously proposed: "explicit, separate and informed consent" 17:12:48 schunter1: My opinion is this is somewhat too descriptive. Suggest language that you can only register an exception is you're sure the user wants an exception. 17:13:00 ... then have lists of conditions that can be met. 17:13:22 explicit and informed consent is sufficient -- separate has nothing to do with it. 17:13:23 q? 17:13:24 ... This is what you want to achieve, and then examples. 17:13:49 q? 17:13:52 fielding, do you think Terms of Service would suffice "explicit and informed" consent? 17:13:53 schunter1: general question for the group: are these 3 items in scope? Are we ok, in generaly, with these kinds of requirements. 17:13:54 ack schunter1 17:13:54 ack sch 17:13:58 ack Ch 17:14:03 Mike_Zaneis has joined #DNT 17:14:18 ChrisPedigoOPA: I think we all agree it wouldn't be buried in the Terms of Service 17:14:19 ChrisPedigoOPA: We agree it wouldn't be buried in the TOS. But want to preserve the option to message consequences. 17:14:31 alas, I am sure some sites will want to call the exception API with as little explanation as possible... 17:14:33 +1, I agree on messaging consequences/alternatives 17:14:36 npdoty, that would depend on the TOS and the consent, not on its separateness 17:15:06 ChrisPedigoOPA: Principal approach would allow flexibility for different kinds of implementations. 17:15:11 q? 17:15:35 Note that by getting less prescriptive here, I expect to also be less prescriptive for the browser UI requirements (schunter's balance principle) 17:15:47 does someone want to take an action on issue-187? do we need a new proposal? or does adrianba's proposal cover this? 17:16:03 Zakim, who is making noise? 17:16:14 hwest, listening for 11 seconds I heard sound from the following: +1.646.654.aaff (9%), Chris_IAB? (18%) 17:16:30 Ice cream man! lol 17:16:48 q+ 17:16:50 schunter to propose closing 187, replacing with just collecting user input 17:16:50 schunter1: Formal action for me is to send proposal to close 187 and replace with another issue on ux. 17:17:06 (I can't hear dsinger) 17:17:15 better 17:17:25 dsinger: connected to the previous conversation, should try to come to common text wherever we can 17:17:35 schunter1: preference to bucket both into a single conversation 17:17:48 this issue and the UA explanation issue are linked; not completely common, as Alan says, but there may well be common concerns and/or text 17:18:00 q? 17:18:16 -RichardWeaver 17:18:25 am I the only one not hearing anything? 17:18:30 Call breaking up.. 17:18:30 I can hear nick. 17:18:31 Can hear you, Nick 17:18:34 cant hear 17:18:44 not hearing current speaker 17:18:49 -schunter 17:19:31 not audible 17:19:32 ack d 17:19:40 broken conversation 17:19:42 dsinger: the approach of linking site consent and ua consent is right 17:19:45 Redialing 17:19:49 David, agreed - they're linked but I believe the UA issue is larger due to its all encompassing application versus individual exceptions which can be tracked for compliance. 17:19:50 what was that Dsinger? 17:19:54 Mattias turned on DNT 17:19:57 +schunter 17:20:02 q? 17:20:05 zakim, who is speaking in tongues? 17:20:05 I don't understand your question, justin. 17:20:07 -JeffWilson 17:20:34 -[Nielsen] 17:20:46 Does the group believe that a compliant UA must be able to grant exceptions? 17:21:06 q? 17:21:06 schunter1: would like to consider the discussion of choice collection together under one issue. 17:21:06 ... question for both discussion 17:21:06 q+ 17:21:15 to WileyS, LOL, I think the site issue is much larger due to the incentive to mis-behave and the larger number of sites 17:21:25 let's see if Jonathan would like to make a revision, good idea. 17:21:29 q? 17:21:30 ack d 17:21:51 let's not *combine* but *link* the discussions 17:22:01 note that they have related concepts 17:22:01 Why are we combining - I object to combining at this time 17:22:04 q+ 17:22:07 +1 to DWainberg 17:22:09 action: doty to check with Jonathan about revising consent requirements (would adrianba's text suffice?) 17:22:09 Created ACTION-392 - Check with Jonathan about revising consent requirements (would adrianba's text suffice?) [on Nick Doty - due 2013-04-17]. 17:22:21 certainly OOB consent is not going to be defined by this standard 17:22:59 Topic: next Working Draft 17:23:05 Matthias, we need to close on Issue-143 soon 17:23:07 q+ to explain on drafts 17:23:08 dwainberg: should have separate discussions for consent in UA vs server 17:23:19 -[CDT] 17:23:31 schunter1: next steps work on final edits, next call go over the document, and get to a working draft ready to be published. 17:23:33 q? 17:23:41 q- 17:23:48 q- 17:23:49 Do we plan to publish another Compliance working draft? 17:23:59 schunter1: Restructuring the response indicators. What is the best structure to communicate tracking status. 17:24:03 http://lists.w3.org/Archives/Public/public-tracking/2013Apr/0066.html 17:24:04 …apologizes, I have some pending edits that are not done... 17:24:16 no 17:24:22 ... I think the consensus is 3 pieces 17:24:26 Roy, I don't want to bloat the DNT header signal but I'd like to ensure 3rd party UAs to the web browser UA are naming themselves when activating DNT. Thoughts on how to approach this problem? 17:24:28 regarding publishing drafts: I may have mentioned this only among the editors, we are trying to satisfy our process requirements by publishing snapshot working drafts of the documents 17:24:30 NO 17:24:38 ... who you are, whether you're claiming exceptions, and then if you're "under construction" 17:24:47 Topic: Response Indicators 17:25:02 dsinger: Question is "am I designed to operate as an X party" is orthogonal to whether have consent 17:25:15 I said they are NOT orthogonal and explained why on list 17:25:25 ... replace with a C, meaning I have consent. If they were append, rather than replacements... 17:25:37 ... but it's minor, don't need to rathole on it. 17:26:11 fielding: Don't understand how matthias got consent. 1 and 3 say you are compliant, so not orthogonal. 17:26:32 ... so you can't say 3 and 1 and C at the same time. They're separate answers. 17:26:46 ... if you don't understand what the consent is about you have to go to the control link. 17:26:57 is "C" not intended to refer to consent to things otherwise prohibited by Compliance? 17:27:13 +q 17:27:17 q+ 17:27:28 Let's not rathole. Roy's point is a consequence of the way the text is currently written, and we could change it. I can drop it. 17:27:37 schunter1: we have a disagreement there we won't resolve in 3 mins. 17:29:04 fielding: if you're say you're doing something differently from the, e.g. 1st party requirements, then you're not following those requirements. 17:29:23 schunter1: continue this discussion offline 17:29:36 I don't care enough to spend a lot of time on it, though, and I don't want to waste the group's time 17:29:44 q? 17:29:46 q- 17:29:49 zakim, who is on the call? 17:29:49 On the phone I see efelten, npdoty, LMastria_DAA, dwainberg, Yianni? (muted), peter?, Fielding, Joanne, WileyS, vinay, Chris_IAB?, jchester2 (muted), [Apple], johnsimpson, hwest 17:29:52 ... (muted), chapell, hefferjr, David_MacMillan, adrianba, ninjamarnau, Brooks, moneill2?, [FTC], Chris_Pedigo, vincent, [Microsoft], +1.646.654.aaff, [Microsoft.a], schunter 17:29:52 LMastria_DAA has marcg 17:29:52 [Apple] has dsinger 17:30:03 -ninjamarnau 17:30:04 -vinay 17:30:04 -Chris_IAB? 17:30:06 -Joanne 17:30:06 -[Microsoft] 17:30:07 -[FTC] 17:30:07 -[Microsoft.a] 17:30:08 -schunter 17:30:08 -jchester2 17:30:08 -WileyS 17:30:08 - +1.646.654.aaff 17:30:09 -chapell 17:30:09 -hefferjr 17:30:11 -npdoty 17:30:11 -Brooks 17:30:12 -David_MacMillan 17:30:12 -[Apple] 17:30:12 -dwainberg 17:30:13 -adrianba 17:30:13 -Yianni? 17:30:14 Zakim, please list the attendees 17:30:14 hwest has left #dnt 17:30:14 -johnsimpson 17:30:14 I don't understand 'please list the attendees', npdoty 17:30:14 -Fielding 17:30:15 -Chris_Pedigo 17:30:15 -peter? 17:30:16 -vincent 17:30:21 Zakim, list attendees 17:30:21 As of this point the attendees have been efelten, npdoty, +1.202.344.aaaa, dwainberg, Thomas, +1.202.587.aabb, +1.240.994.aacc, mikez, Fielding, marcg, Amy_Colando, Joanne, 17:30:22 zakim, list participants 17:30:24 ... samsilberman, Rigo, BerinSzoka, WileyS, WaltM_Comcast, JeffWilson, vinay, RichardWeaver, [CDT], jchester2, Chris_IAB?, dsinger, johnsimpson, hwest, chapell, hefferjr, schunter, 17:30:24 ... +1.650.465.aadd, adrianba, +49.431.98.aaee, ninjamarnau, Brooks, David_MacMillan, Walter, moneill2?, [FTC], Chris_Pedigo, vincent, robsherman, [Microsoft], +1.646.654.aaff, 17:30:24 ... +1.646.654.aagg, [Nielsen] 17:30:27 peterswire has left #dnt 17:30:28 As of this point the attendees have been efelten, npdoty, +1.202.344.aaaa, dwainberg, Thomas, +1.202.587.aabb, +1.240.994.aacc, mikez, Fielding, marcg, Amy_Colando, Joanne, 17:30:28 ... samsilberman, Rigo, BerinSzoka, WileyS, WaltM_Comcast, JeffWilson, vinay, RichardWeaver, [CDT], jchester2, Chris_IAB?, dsinger, johnsimpson, hwest, chapell, hefferjr, schunter, 17:30:33 ... +1.650.465.aadd, adrianba, +49.431.98.aaee, ninjamarnau, Brooks, David_MacMillan, Walter, moneill2?, [FTC], Chris_Pedigo, vincent, robsherman, [Microsoft], +1.646.654.aaff, 17:30:33 ... +1.646.654.aagg, [Nielsen] 17:30:33 -efelten 17:30:35 rrsagent, please draft the minutes 17:30:35 I have made the request to generate http://www.w3.org/2013/04/10-dnt-minutes.html npdoty 17:30:40 johnsimpson has left #dnt 17:31:16 -moneill2? 17:31:21 -LMastria_DAA 17:36:22 disconnecting the lone participant, hwest, in T&S_Track(dnt)12:00PM 17:36:23 T&S_Track(dnt)12:00PM has ended 17:36:23 Attendees were efelten, npdoty, +1.202.344.aaaa, dwainberg, Thomas, +1.202.587.aabb, +1.240.994.aacc, mikez, Fielding, marcg, Amy_Colando, Joanne, samsilberman, Rigo, BerinSzoka, 17:36:24 ... WileyS, WaltM_Comcast, JeffWilson, vinay, RichardWeaver, [CDT], jchester2, Chris_IAB?, dsinger, johnsimpson, hwest, chapell, hefferjr, schunter, +1.650.465.aadd, adrianba, 17:36:24 ... +49.431.98.aaee, ninjamarnau, Brooks, David_MacMillan, Walter, moneill2?, [FTC], Chris_Pedigo, vincent, robsherman, [Microsoft], +1.646.654.aaff, +1.646.654.aagg, [Nielsen] 17:36:34 Zakim, bye 17:36:34 Zakim has left #dnt 17:36:36 rrsagent, bye 17:36:36 I see 3 open action items saved in http://www.w3.org/2013/04/10-dnt-actions.rdf : 17:36:36 ACTION: felten to draft examples regarding different UAs with different UI affordances [1] 17:36:36 recorded in http://www.w3.org/2013/04/10-dnt-irc#T16-58-48 17:36:36 ACTION: Chapell to update UI/consent proposal (including discussion with Adrian) [2] 17:36:36 recorded in http://www.w3.org/2013/04/10-dnt-irc#T17-00-07 17:36:36 ACTION: doty to check with Jonathan about revising consent requirements (would adrianba's text suffice?) [3] 17:36:36 recorded in http://www.w3.org/2013/04/10-dnt-irc#T17-22-09