13:51:25 RRSAgent has joined #TCF 13:51:25 logging to https://www.w3.org/2020/10/30-TCF-irc 13:51:27 RRSAgent, make logs Public 13:51:29 Meeting: IAB Europe's Transparency and Control Framework 13:59:00 present+ 14:01:05 kris_chapman has joined #TCF 14:01:45 LP has joined #TCF 14:01:48 AramZS has joined #TCF 14:01:52 kleber has joined #TCF 14:01:53 present+ 14:02:18 present+ 14:02:30 robin has joined #TCF 14:02:31 if someone wishes to take notes here, that would be appreciated 14:04:07 scribenick: kleber 14:04:21 dmarti has joined #TCF 14:04:51 Townsend Feehan: We've been watching the work in the Improving Web Adv BG for the last several months; that is not a venue for debating policy 14:05:08 ...TPAC does seem like a place for that sort of discussion, and could possibly inform BG work in the future 14:05:25 wseltzer_2 has joined #TCF 14:05:33 present+ wseltzer 14:05:47 ...Want to put the BG work in an EU context, discuss the EU's legislative framework, and discuss the Transparency & Control Framework, IAB's way to address that law 14:05:51 present+ yoshi, masaya_ikeo, naomi 14:06:20 ...web-adv BG has focused on browsers, and on cross-site tracking for digital advertising 14:06:49 ...EU has a very demanding privacy framework, but *does* allow cross-site tracking inside those guidelines 14:07:18 ...want to cover EU regulatory framework, and how TCF enables compliance with the two relevant laws 14:07:22 JohnWilander has joined #TCF 14:07:29 pl_mrcy has joined #tcf 14:07:29 present+ 14:07:35 present+ 14:07:48 ...We believe the future landscape needs to accommodate multiple paradigms, including the one TCF was developed against 14:08:05 ...We are actively seeking more browser engagement on TCF's evolution 14:08:20 present+ 14:08:37 Question: what is meant by "safely" engaging in cross-context tracking? 14:08:39 ...EU law has two concepts: Privacy, and Data Protection 14:09:19 ...Privacy is addressed by ePrivacy Directive, the "cookie directive" 14:09:38 ...opt-in consent based on prior understanding 14:09:52 ...doesn't care about personal data; any cookie stored on device requires consent of the user to store or access 14:10:28 ...Protection of Personal Data is addressed by GDPR — 2018 extension of preexisting 1995 law 14:11:14 ...GDPR's paradigm is that you may not process personal data, but there are exceptions to that prohibition, a.k.a. "legal bases" 14:11:40 ...six of these, of which three are relevant for advertising: Consent, Legitimate Interest, and Contract 14:11:46 asoltani has joined #TCF 14:12:26 ...Consent must be "specific", "informed", "unambiguous", and "freely-given"; there is a whole corpus on how to intepert those terms 14:12:58 Townsend will look at questions in Zoom chat when she pauses 14:13:07 ...key features: personal data is very broadly defined, including "indirectly identify a user", explicitly including IP address and also including pseudonymous identifiers 14:13:13 s/Townsend will look at questions in Zoom chat when she pauses// 14:13:27 ...Legal bases for processing are narrower than it was under 1995 directive, and consent is much more constraining 14:14:01 ...Basic paradigm is informed choice: As long as certain pieces of information are disclosed to the user at certain moments, the user is informed to make certain choices 14:14:34 ...this is coupled with privacy by design and by default, and puts a lot of responsibility on the user, and therefore on the industry, to provide the user with enough information to make meaningful choices 14:14:46 ...free movement of information across the EU depends on this 14:15:35 ...There are specific user rights and specific data controlled obligations, enforced by independent authorities 14:15:56 ...steep monetary fines for breaches for GDPR 14:16:21 ... GDPR explicitly speaks to processing of personal data for digital advertising 14:16:49 ...Principles: lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy,... 14:17:09 ...THere are user rights and data controlled obligations derived from those principles 14:17:58 ...The IAB Transparency & Control Framework (TCF) lives in this framework 14:18:54 ...problem TCF is trying to solve: All parties need a legal basis to process data, but only first parties are in a direct position to obtain it due to lack of direct line of communication to user 14:19:37 ...TCF standardizes language for UI, an API, and a format for transmitting user choices 14:20:06 ...that user choice string provides proof of consent, which is important for showing you had legal basis for processing 14:20:46 ...Four parts of the framework: UI, TCF Policies, Global Vendor List, and TCF Technical Specs 14:21:22 ..GVL (Global Vendor List) has ~600 vendors who are bound by Terms & Conditions to adhere to policies, provide information that is disclosed to users 14:22:15 ...TCF Policies are what the vendors agree to: they describe the purposes under which data may be processed, and govern how information must be disclosed, where, in what layer of a UI, what needs to happen before any data is stored, etc 14:22:34 ...v1 of framework & policies came out in 2018, v2 rolled out in Aug-Sept 2020 14:23:09 ...Tech Specs implement these policies; this is hosted by the IAB Tech Lab (vs. previous two parts which are hosted by IAB Europe) 14:24:06 ...UI is the visible part of the framework — mediated by CMP = Consent Management Provider, providing information disclosure, gets user choices, makes those choices available to site & vendors 14:24:39 ...The UI is the part of the experience controlled by the publisher, and some parts are standardized to get legal certainty, but other parts are up to the choice of the site owner 14:25:28 ...publishers still get to control and frame their relations to the user, while interpretation of the law is standardized 14:25:39 ...TCF interpretation of the law is on the conservative side 14:26:22 robin has joined #TCF 14:26:23 ...(schematic of basic ad call: user -> web site -> ad exchange -> fanout to many ad tech companies) 14:26:59 ...GDPR applies to personal data, broadly construed — includes identified data like name & address, and also identifiable, like IP address or browsing behavior 14:27:16 ...Ongoing questions about the legal bases "legitimate interest" 14:27:39 ...TCF allows vendors to declare whether they are processing under consent, legit interest, or both 14:28:34 ...overall TCF is a new development which enables new transparency not previously available 14:28:58 ...(pictures of example UIs) 14:29:35 ...Standardization has more benefits, beyond efficiency — consistent presentation of purposes and definitions makes it easier for users to understand 14:29:51 ...also helps *companies* better understand what data processing they themselves are doing 14:30:31 ...breaking out Basic Ads / Personalized ads profile building / Show personalized ads / Ads measurement / etc, total of 10 purposes 14:30:46 rrsagent, pointer? 14:30:46 See https://www.w3.org/2020/10/30-TCF-irc#T14-30-46 14:31:38 ...TCF v1 was shown around to a bunch of EU Data Protection Authorities, got feedback that the language was too legalistic, so in v2 language is much more user-friendly in addition to legal 14:32:08 Jemma has joined #tcf 14:32:21 ...also added "stacks of purposes", which are a combination of more atomic purposes, e.g. showing a combined purposes "Personalized ads and ads measurement" comprising the four above 14:32:50 ...trying to reconcile the need to make consent informed and specific, with the need to make the information presented to the user understandable 14:33:16 rrsagent, make minutes 14:33:16 I have made the request to generate https://www.w3.org/2020/10/30-TCF-minutes.html Jemma 14:33:21 ...Governance: IAB Europe + 25 national IABs + IAB Tech Lab 14:33:43 ...open-source, cross-industry standard with muti-stakeholder governance 14:34:03 ...Compliance enforcement: Suspension for breaches of TCF policies 14:34:56 ...Update: Publishers don't register, so don't have exact numbers, but hundreds of thousands of sites, including outside-EU sites since relevant when EU visitors come to them 14:35:08 ...over 600 vendors, 120 CMPs 14:35:25 ...70-80% of non-app bid requests from EU web sites carry a TCF string 14:35:41 gendler has joined #TCF 14:35:45 ...Aspiration to have a version of TCF approved as a GDPR trans-national Code of Conduct in 2021 14:36:03 ...technical measures are in progress to ensure integrity of the TCF string 14:36:44 present+ 14:36:54 florian_irc has joined #TCF 14:37:28 Robin Berjon: What do you mean by "safely processing personal data at scale"? By nature, broadcast of personal information is inherently unsafe 14:37:41 -> https://lists.w3.org/Archives/Public/www-archive/2020Oct/att-0011/IAB_TCF.pdf Slides 14:38:16 present+ 14:38:34 are we managing the queue on here or on Zoom? 14:38:36 Feehan: Challenging the assumption that underlies the web-adv BG work. We believe it is possible to process personal information in a way that protects privacy 14:38:39 i|Townsend Feehan|-> https://lists.w3.org/Archives/Public/www-archive/2020Oct/att-0011/IAB_TCF.pdf Slides 14:38:49 s/Townsend Feehan/Townsend_Feehan/ 14:38:55 Robin: The question is the scale and the frequency — how can you make that more safe? 14:39:24 Feehan: TCF is a legal compliance standard, not about changing processing practices. Means to achieve consumer protection 14:40:15 Gerben: Q about Belgian DPA investigation finding TCF to be in conflict with GDPR 14:40:54 Feehan: A fair reading is that the TCF itself isn't in conflict. Mostly there is a novel and contestable finding that IAB Europe itself is a data controller 14:42:04 ...THe report queries the legality of the TCF using Legit Interest. GDPR allows that; this is a DPA opinion about cross-site tracking. What's written in the report is that the framework may breach the law by offering Legit Interest as a basis for profiling 14:42:52 ...Second, report says that TCF doesn't offer adequate rules regarding sensitive data, e.g. sexual orientation, trade union membership, etc. You can't use TCF to process those sorts of data, so really doesn't apply to us 14:43:33 ...Third, provisional conclusion that TCF breaches GDPR because it allows a CMP to stop working with a publisher if it suspects the publisher breaches policies, but it doesn't *require* that suspension 14:44:04 ...but actually policies say CMPs must stop acting on any information from a publisher it knows to be violating policies, and to pass along that information 14:44:41 ...Overall this is not central to the TCF framework, and all stuff we will explore with them 14:45:10 kazho has joined #TCF 14:45:28 ...Surprising that IAB Europe might be a data controller — this should be of major interest to the W3C which likewise creates standards for other companies to implement 14:46:06 ...GDPR provides encouragement for trade associations to draft codes of conduct; pretty obviously, nobody will want to draw one up if the host association is going to be found a co-controller with everyone who imlements 14:46:45 Libor Polcak: Publsihed research that CMPs and publishers don't respect user choice. 14:47:02 ...you said that you have a program to check compliance, but I don't think we see that in practice 14:47:21 Feehan: There are surely instances of non-compliant behavior by websites that implement TCF (and sites that don't also!) 14:48:02 ...Between 15 Aug and 30 Sept, it was still allowed to use TCF v1.1 signals, v2 only started on Sept 30, and we have some enforcement actions underway at the moment 14:48:20 ...happy to have our attention brought to any violations 14:48:41 ...noncompliance is in nobody's interest 14:49:26 Aram Z-S: What plans to implement auditing in the middle of the ecosystem, not just at publisher? Any plans to implement a mechanical method to avoid leaking information on the back-end? 14:49:37 ...reports in the trade press about consent string fraud occurring among vendors 14:49:52 ...I haven't seen any middle vendors brought up for such violations 14:49:59 ...what happens to people who don't follow the rules? 14:50:34 Feehan: If you don't follow the rules, we suspend you from the framework, and publicize information about the nature of breaches, including communicating to DPAs 14:50:47 ...Law enforced by regulators, not by us 14:51:12 ...We started by enforcing against CMPs (around 140), harder to enforce against vendors (around 600) 14:51:31 ...We are in the process of developing tools, automated and manual, to check on the behavior of vendors 14:52:06 ...Can't speak yet to what it will consist of, but acceptance among publishers is conditional of compliance falling not only on CMPs but on other layers of stack also 14:52:15 ...stay tuned, more to come, probably later this year 14:53:16 Alex Cone (IAB Tech Lab PM): We have two working groups at Tech Lab dedicated to technical accountability, and to continued iteration on frameworks 14:53:41 ...work in progress right now include signing of consent strings to combat consent-string fraud 14:54:26 ...and the technical auditing mechanism to support compliance, including standardized logging of transactions, scrubbed of user data, but enough to data-mine for anomalous behavior that is a sign of mis-behavior 14:54:48 ...there is a lot of incentives by publishers to keep their data protected, not having publishers taken down by bad behavior of others 14:55:48 kleber: how many companies have been enforced against so far, is there a public list? 14:56:08 kleber: Any suspensions yet? How many? And public list of suspensions? 14:56:22 Feehan: No suspensions yet in v2, just in transition from v1 right now 14:56:29 sauski has joined #TCF 14:56:51 Feehan: What happens if Belgian DPA concludes TCF is not in compliance? (The three questions from before) 14:57:36 ...Way to fix these: (1) don't use Legit Interest as a legal basis for profiling, (2) don't process special-category data with TCF which you shouldn't anyway, (3) stop working with publishers who are non-compliant 14:58:22 Aram Z-S: Is there any intent to lower cost bar for CMPs to register? To allow non-profits or orgs motivated in different ways to participate 14:58:53 Feehan: Currently 1200 euro annual fee for CMPs. We would be open to considering adaptations of fees. Reach out to us 15:00:17 rrsagent, draft minutes 15:00:17 I have made the request to generate https://www.w3.org/2020/10/30-TCF-minutes.html wseltzer_2 15:09:57 zakim, end meeting 15:09:57 As of this point the attendees have been Bert, AramZS, kris_chapman, wseltzer, yoshi, masaya_ikeo, naomi, JohnWilander, pl_mrcy, robin, gendler, Jemma 15:09:59 RRSAgent, please draft minutes v2 15:09:59 I have made the request to generate https://www.w3.org/2020/10/30-TCF-minutes.html Zakim 15:10:03 I am happy to have been of service, Ralph; please remember to excuse RRSAgent. Goodbye 15:10:07 Zakim has left #TCF