Re: Status of First-Party Sets

Adobe is also very interested in continued exploration and development of FPS.

Thanks,
Russell Stringham

From: Don Marti <dmarti@cafemedia.com>
Date: Thursday, June 9, 2022 at 9:07 AM
To: James Rosewell <james@51degrees.com>
Cc: Chris Wilson <cwilso@google.com>, public-privacycg@w3.org <public-privacycg@w3.org>, Travis Leithead <travis.leithead@microsoft.com>, Kaustubha Govind <kaustubhag@google.com>, Robin Berjon <robin@berjon.com>, Theresa O'Connor <hober@apple.com>, yoavweiss@chromium.org <yoavweiss@chromium.org>, Léonie Watson <lwatson@tetralogical.com>, matthew.hancox@ing.com <matthew.hancox@ing.com>, david.verroken@ing.com <david.verroken@ing.com>
Subject: Re: Status of First-Party Sets

EXTERNAL: Use caution when clicking on links or opening attachments.


Hi all,

CafeMedia is still interested in discussing FPS.

We do have some outstanding issues covering responsibilities of the IEE and criteria for set membership, and have submitted pull requests that might help clarify both. Evaluating FPS will really depend on how the IEE works, and we look forward to discussing at future meetings.

Best,
Don

On Thu, Jun 9, 2022 at 7:25 AM James Rosewell <james@51degrees.com<mailto:james@51degrees.com>> wrote:
Hi Chris,

I’m struggling from the links you have provided to identify the “significant set of independent voices”. At best I can find three.

The discourse discussion is two years old and can hardly be considered current. Issue 88 relates to a debate concerning the group that hosts the FPS proposal rather than support for the proposal. Perhaps the representatives from CafeMedia, Microsoft, and Salesforce who participated in the issue 88 can confirm they are interest in the technical merits of progressing the FPS proposal at WICG?

For the avoidance of doubt my own comment from the minutes referred to was not an expression of interest for FPS as a solution. My only interest in FPS is in following a proposal that negatively impacts competition in the digital market and that as such cannot be ignored. I would prefer Google voluntarily stopped work on it and communicated as such to the market.

I am interested in taking a fork, titled GDPR Validated Sets<https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FWICG%2Ffirst-party-sets%2Fpull%2F86&data=05%7C01%7Crstringh%40adobe.com%7C783683f214de4480d26e08da4a29b19c%7Cfa7b1b5a7b34438794aed2c178decee1%7C0%7C0%7C637903840757238206%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=ryCJONJmFBTF6upMsEpVDO5XofHGqFZ95vd2utgBxpw%3D&reserved=0>, forward in WICG, Privacy CG, or some other venue, should there be others who are interested. The GVS fork removes discriminatory first and third party language, aligns to GDPR on which we both agree is the applicable data protection legislation (see CMA/Google commitments<https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fassets.publishing.service.gov.uk%2Fmedia%2F62052c6a8fa8f510a204374a%2F100222_Appendix_1A_Google_s_final_commitments.pdf&data=05%7C01%7Crstringh%40adobe.com%7C783683f214de4480d26e08da4a29b19c%7Cfa7b1b5a7b34438794aed2c178decee1%7C0%7C0%7C637903840757394427%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=3WyKwQ23UrVvgSShVk3uIo5N3WdJCuqMdqnfmuN75es%3D&reserved=0>), and does not require a single enforcement entity but rather uses existing solutions recognising they are not always perfect. I would like Google to support this fork.

In relation to your assertion concerning WICG and justifications for shipping features. That is not my experience. User Agent Client Hints (UACH) exists only as a WICG document<https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FWICG%2Fua-client-hints&data=05%7C01%7Crstringh%40adobe.com%7C783683f214de4480d26e08da4a29b19c%7Cfa7b1b5a7b34438794aed2c178decee1%7C0%7C0%7C637903840757394427%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=8bV7hA7S3aUQS376PMfH70PkBJ6%2B3rTGYmQa%2BPQfjZE%3D&reserved=0> which is dependent on an IETF<https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Frfc%2Frfc8942.html&data=05%7C01%7Crstringh%40adobe.com%7C783683f214de4480d26e08da4a29b19c%7Cfa7b1b5a7b34438794aed2c178decee1%7C0%7C0%7C637903840757394427%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=%2Ffu3%2Bqy97UzAF3Tsx8S3NZetTnsPAp1IEWrAkV7gyFo%3D&reserved=0> experiment<https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fstandards%2Fprocess%2Finformational-vs-experimental%2F&data=05%7C01%7Crstringh%40adobe.com%7C783683f214de4480d26e08da4a29b19c%7Cfa7b1b5a7b34438794aed2c178decee1%7C0%7C0%7C637903840757394427%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=1kcL9GQk1zAx02Q6SSrDxEEF%2Bv0C2988dppi5IXU7JA%3D&reserved=0>. Neither are a standard or have started the standards process. Yet UACH and User Agent (UA) Reduction is being shipped today and existing widely used interoperability interfered with which is having an impact on the advertising eco-system among others (see Google quarter report to the CMA<https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.gov.uk%2Fcma-cases%2Finvestigation-into-googles-privacy-sandbox-browser-changes%23googles-quarterly-report&data=05%7C01%7Crstringh%40adobe.com%7C783683f214de4480d26e08da4a29b19c%7Cfa7b1b5a7b34438794aed2c178decee1%7C0%7C0%7C637903840757394427%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=1WpDquEGCWVL6ZIg2fqRtH7dwWxT7CSeINV6PaWhxGA%3D&reserved=0> in relation to latency and fraud). The CCed representatives from ING should monitor UA Reduction and UACH very closely. However it is not a topic for the Privacy CG.

Regards,

James

From: Chris Wilson <cwilso@google.com<mailto:cwilso@google.com>>
Sent: 08 June 2022 23:03
To: Robin Berjon <robin@berjon.com<mailto:robin@berjon.com>>
Cc: Travis Leithead <travis.leithead@microsoft.com<mailto:travis.leithead@microsoft.com>>; James Rosewell <james@51degrees.com<mailto:james@51degrees.com>>; Kaustubha Govind <kaustubhag@google.com<mailto:kaustubhag@google.com>>; Theresa O'Connor <hober@apple.com<mailto:hober@apple.com>>; yoavweiss@chromium.org<mailto:yoavweiss@chromium.org>; Léonie Watson <lwatson@tetralogical.com<mailto:lwatson@tetralogical.com>>; matthew.hancox@ing.com<mailto:matthew.hancox@ing.com>; david.verroken@ing.com<mailto:david.verroken@ing.com>; public-privacycg@w3.org<mailto:public-privacycg@w3.org>
Subject: Re: Status of First-Party Sets


Hey Robin, et al:



(For context, for those who don't know, I’m also a WICG co-chair.)



The WICG is intended for incubation of standards features - as are all community groups. It is important to remember that Community Groups are not standards-track venues in the W3C, and one CG does not lend more legitimacy to its products than another; they simply have potentially different communities.  Nothing that lives in a W3C Community Group should be called a “standard”.



As per the minutes of the Privacy CG meeting on 5/26/22 [1], Tess stated that the PCG wanted to focus on “privacy stuff”, and FPS was not, in her opinion, a good fit for the focus of their group;  this was backed up by Pete, who said “Seems like PrivacyCG is not the right place to continue the discussion.”  This was not by unanimous community consensus; but, as Tess said, removing work items is at the discretion of the PCG chairs according to its charter.    I’ve noted before my personal disagreement with giving the very small number of browser engine companies essentially a veto vote over incubations in the PCG; but regardless, that’s not the case in the WICG.



As I said during the PCG meeting, the WICG will allow for incubation as long as there are multiple independent entities (not specifically different root implementations) that are interested.  FPS met that bar initially [2], and continues to pass that bar - several PrivacyCG community members who are supportive of the proposal chimed in on [3], including at least one other browser vendor (Microsoft Edge) who is interested in continuing development..  This should not be unexpected; FPS was adopted into the Privacy CG from the WICG with the understanding that PCG wanted to spend their community time on it; the fact that the Privacy CG have since decided to stop spending time on this exploration does not change the fact that there are still a significant set of independent voices that think it continues to merit further incubation.



On a separate note: Google Chrome and the broader Chromium project has not, to my knowledge, used presence in the WICG as justification to ship any feature.  It is true that the Blink process strongly encourages any to-be-shipped feature to be in an open forum, to enable collaboration and at the very least, eventual interoperability. However, having a specification in an open forum is a baseline requirement, not a justification, for shipping.



-Chris



[1] https://github.com/privacycg/meetings/blob/main/2022/telcons/05-26-minutes.md<https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fprivacycg%2Fmeetings%2Fblob%2Fmain%2F2022%2Ftelcons%2F05-26-minutes.md&data=05%7C01%7Crstringh%40adobe.com%7C783683f214de4480d26e08da4a29b19c%7Cfa7b1b5a7b34438794aed2c178decee1%7C0%7C0%7C637903840757394427%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=URllnFGTTPosVyZ4ANuwpo3SOFbhRHuA5J3mtPrDFz0%3D&reserved=0>

[2] http://discourse.wicg.io/t/proposal-first-party-sets/3331<https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fdiscourse.wicg.io%2Ft%2Fproposal-first-party-sets%2F3331&data=05%7C01%7Crstringh%40adobe.com%7C783683f214de4480d26e08da4a29b19c%7Cfa7b1b5a7b34438794aed2c178decee1%7C0%7C0%7C637903840757394427%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=QSjK5F4h9SqIGinGSoo2vvVtgAGoe5klx9gRxTf0tws%3D&reserved=0>
[3] https://github.com/WICG/first-party-sets/issues/88<https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FWICG%2Ffirst-party-sets%2Fissues%2F88&data=05%7C01%7Crstringh%40adobe.com%7C783683f214de4480d26e08da4a29b19c%7Cfa7b1b5a7b34438794aed2c178decee1%7C0%7C0%7C637903840757394427%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=P8HLQc102x%2BD7pGoTgtShgxeCm7KJr8Bt0qJY632xiM%3D&reserved=0>

On Tue, Jun 7, 2022 at 11:53 AM Robin Berjon <robin@berjon.com<mailto:robin@berjon.com>> wrote:
Hi Travis!

On 2022-06-06 14:09, Travis Leithead wrote:
>  > [..] I’m unsure how one would go about removing FPS from WICG.
> Perhaps the WICG chairs can advise?
>
> The WICG is home to over 120 <https://wicg.io/<https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwicg.io%2F&data=05%7C01%7Crstringh%40adobe.com%7C783683f214de4480d26e08da4a29b19c%7Cfa7b1b5a7b34438794aed2c178decee1%7C0%7C0%7C637903840757394427%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=JRylkXqDwxPKRguQtmxxXJb3KkVCevLK5ScandCdLXA%3D&reserved=0>> unique incubations at
> varying stages of maturity and implementation. While I have been a
> co-chair, we have graduated numerous proposals into other venues, and
> archived others at the request of their owners, but we've never forcibly
> removed any incubations (even when they appear inactive for years). I
> think it would set a bad precedent to start now. The WICG is a field for
> sowing ideas; for this reason our criteria for acceptance is very low.

I think a potentially important point is at risk of finding itself
buried under James's usual anti-privacy activism.

The status of FPS in WICG is unusual and (to me) unexpected. The WICG is
intended for incubation of new features and early standard proposals.
FPS has already been incubated quite a lot, and the incubation didn't
pan out. I'm not suggesting that FPS be shut down — as we all know,
sometimes standards take trying more than once — but I would encourage
WICG chairs to be particularly careful that it does not impinge upon the
WICG's reputation. There is already significant grumbling in the
community that the WICG is primarily a venue for the standards-washing
of Google's plans; it would be very unfortunate if the WICG found itself
used as justification to ship FPS in a browser.

It also appears that Kaustubha and the Privacy CG chairs have a
different appreciation of the status of implementer support. Given the
importance that having multiple implementations holds in our processes
and community, this is an issue that seems worth clarifying. Kaustubha:
do you mind explaining your conclusion on this point? Again, I don't
think that having just one implementer interested means FPS shouldn't go
to the WICG (some things there have zero implementers interested and
that's fine!) but we should at least be able to reach consensus on who
is interested and how that impacts the legitimacy of shipping the feature!

--
Robin Berjon
VP Data Governance
Acting VP Marketing Analytics
The New York Times Company
This email and any attachments are confidential and may also be privileged. If you are not the named recipient, please notify the sender immediately and do not disclose, use, store or copy the information contained herein. This is an email from 51Degrees.mobi Limited, Davidson House, Forbury Square, Reading, RG1 3EU. T: +44 118 328 7152; E: info@51degrees.com<mailto:info@51degrees.com>; 51Degrees.mobi Limited t/as 51Degrees.