Re: Re ISSUE-26: When a 3rd party becomes a 1st party

There are two separate issues here --- let's not mix them up.

(1) Whether a third-party can render personalized content based on 
first-party data when the DNT signal is on.  We discussed this on the 
call yesterday --- I said I think I'm fine with such personalization so 
long as the party doesn't add third-party data about me to the 
first-party profile that I affirmatively created.  Tom gave a plausible 
alternative that when DNT is on, I should have a browsing experience 
that is effectively anonymous to third parties.  There was not consensus 
on the call about this issue.

The issue that Jeff is raising is:

(2) Whether a third-party becomes a first-party when they click (or 
otherwise meaningfully interact) with third-party content.  As Shane 
said, there had previously seemed to be general consensus in the group 
that such an interaction would turn the third-party into a first-party.  
But the issue shouldn't be closed.  I wonder what the practical 
alternative is, though.  Does that mean that when DNT is on, 
Like/Tweet/+1 buttons can never work?  Or that a dialog box has to pop 
up making clear that your activity will be transmitted to the separate 
service?  That seems unduly prescriptive to me (though Twitter buttons 
do something like that) but perhaps living in a tech/privacy world I 
overestimate the average person's understanding of third-party widgets 
and buttons.

Justin Brookman
Director, Consumer Privacy Project
Center for Democracy&  Technology
1634 I Street NW, Suite 1100
Washington, DC 20006
tel 202.407.8812
fax 202.637.0969
justin@cdt.org
http://www.cdt.org
@CenDemTech
@JustinBrookman


On 12/15/2011 12:13 PM, JC Cannon wrote:
>
> I would like to point out that logged in users find value from 3^rd 
> -party widgets that inform them when friends and family members like 
> an article, restaurant or hotel in which a consumer may be interested. 
> I would hate to see us stifle innovation that is seen as valuable to 
> consumers.
>
> JC
>
> Twitter <http://twitter.com/jccannon7>
>
> *From:*Shane Wiley [mailto:wileys@yahoo-inc.com]
> *Sent:* Thursday, December 15, 2011 8:41 AM
> *To:* Dave Singer
> *Cc:* Jeffrey Chester; Bryan Sullivan; public-tracking@w3.org
> *Subject:* RE: Re ISSUE-26: When a 3rd party becomes a 1st party
>
> David,
>
> I share your view on this point but obviously not "all" of us do. J
>
> Thus far, the general consensus has been that an impression of a 3^rd 
> party widget must be treated as a 3^rd party situation (seen but not 
> touched, so to speak).  If there is "meaningful interaction" (not just 
> a mouse over), then this should be treated as a 1^st party situation 
> if several additional conditions are met: 1) prominent branding of the 
> 1^st party (in some cases, such as the FB Like button, I would argue 
> this already has prominent branding without saying "Facebook") and 2) 
> a link to that parties home page / privacy policy.
>
> Jonathan and I led a detailed discussion on this topic several months 
> ago -- and it's based on that string that I draw the conclusion of 
> "general consensus".
>
> - Shane
>
> *From:*Dave Singer [mailto:singer@apple.com]
> *Sent:* Thursday, December 15, 2011 8:34 AM
> *To:* Shane Wiley
> *Cc:* Jeffrey Chester; Bryan Sullivan; public-tracking@w3.org
> *Subject:* Re: Re ISSUE-26: When a 3rd party becomes a 1st party
>
> On Dec 15, 2011, at 8:10 , Shane Wiley wrote:
>
> Jeffrey,
>
> Do you have data to back-up the "user expectations" claims you've 
> presented?  I believe when users click on the FB "Like" button they 
> every expectation this is going to set the "Like" for that particular 
> item on their Facebook page.  Do you have information suggesting users 
> that click on the FB Like button do not have this expectation?
>
> I think we're all in agreement that if they *interact* with content, 
> the content they interact with is first party.
>
> However, when I visit New York Times, though I don't mind NYT knowing 
> I visited, knowing who I am, and indeed if they need to, remembering I 
> visited, the same does not apply to Facebook, Twitter, or any other 
> site that the NYT chose to send my way, and I didn't choose.
>
> So, they remain 3rd party until the user chooses to interact, IM (ok, 
> maybe not very H in this instance)O.
>
> - Shane
>
> *From:*Jeffrey Chester [mailto:jeff@democraticmedia.org]
> *Sent:*Thursday, December 15, 2011 8:03 AM
> *To:*Bryan Sullivan
> *Cc:*public-tracking@w3.org <mailto:public-tracking@w3.org>
> *Subject:*Re: Re ISSUE-26: When a 3rd party becomes a 1st party
>
> I think granting First party status to a [Third Party] widget embedded 
> on a site needs to be viewed in terms of user expectations.  They are 
> likely not to understand that that widget or some other syndicated 
> application has its own data collection practices, different privacy 
> policies, etc.  For a user to have meaningful DNT, such widgets should 
> be regarded as Third Party, and hence the DNT signal should be in effect.
>
> Jeffrey Chester
>
> Center for Digital Democracy
>
> 1621 Connecticut Ave, NW, Suite 550
>
> Washington, DC 20009
>
> www.democraticmedia.org <http://www.democraticmedia.org/>
>
> www.digitalads.org <http://www.digitalads.org/>
>
> 202-986-2220
>
> On Dec 14, 2011, at 2:05 PM, Bryan Sullivan wrote:
>
>
>
> Inhttp://www.w3.org/2011/tracking-protection/drafts/tracking-compliance.html#third-party-compliance:
>
> The statement "In addition, a domain that hosts a third-party visible
> widget or window that is clearly identified and branded as being
> controlled and operated by a party separate and distinct from the
> first party becomes a first party itself when a user engages in
> "meaningful interaction" with the window or widget." is unclear.
>
> I believe this is intending to say: "In addition, a third-party domain
> providing content presented in a visible widget or window, clearly
> identified and branded as being controlled and operated by a party
> separate and distinct from the first party, becomes a first party
> itself when a user engages in "meaningful interaction" with the window
> or widget."
>
> With this meaning, the intent of what I was expressing on the call can
> be better understood. DNT should not prevent sites from providing
> personalized service, if the site is acting as a 1st party in any
> context (as the site directly visited by the user, or a 3rd party site
> with content hosted on the visited site).
>
> --
> Thanks,
> Bryan Sullivan
>
> Dave Singer
>
> Multimedia and Software Standards, Apple
>
> singer@apple.com <mailto:singer@apple.com>
>