Fwd: Issue-39: Tracking of Geographic Data

Resending on behalf of Lauren. 

	Aleecia

Begin forwarded message:


> From: Lauren Gelman <gelman@blurryedge.com>
> Date: December 20, 2011 12:29:37 PM PST
> To: Justin Brookman <justin@cdt.org>, public-tracking@w3.org
> Subject: Re: Issue-39: Tracking of Geographic Data
> 
> 
> Just jumping in with my $.02 after following the list for a while... As a practical matter, I am really concerned about a rule set that relies on a company "immediately deleting" information after they obtain it.
> 
> There are two tangents "first party and third party" and "collection and track or transfer" and I am trying to figure out how they intersect.  Whether it is Geo or anything else, what does a user who turned DNT on, but then visits Wired expect? (the fact that an IP is also a unique identifier as well as providing geographic segment info is a completely separate issue).   I think that visiting Wired constitutes a limited opt-in to collection that stays within Wired or its agents (whether that includes all Conde Nast seems to be an open question around branding that i am putting aside for the moment). 
> 
> This means it is Wired's role to control data movement such that my limited opt-in is respected.
> 
> A DNT ON user visits Wired.   Wired as a first party is the ONLY party that can collect information from the session.  It can combine that information with other information it has on the user.  Wired must keep info silo'd and CANNOT transfer any info it to third parties.  It CAN transfer information per exceptions to outsource certain tasks that are generally accepted as necessary to manage a website (i.e. to service providers for analytics, to service providers to provide content management or user management, even to create user segments based on data collected only on their site).   But the Service providers must act in the shoes of the publishers and keep info silo'd on behalf of their clients and cannot use it for any other purpose, or combine it with any data from other clients.  Third parties (widgets, ad networks, lots of others yet to be invented) cannot themselves collect information about the user and thus also cannot transfer.  If there is a "significant user interaction" that sufficiently triggers a change in users' expectations, they can turn into First Parties.  Then they can act under the same rules as applies to Wired. 
> 
> I believe a user who turns on DNT but then visits a publisher still expects to get ads. The expectation is the ads are based on the user's interaction (future and present) with the site.  The publisher (first party) exercises control.  They can provide this experience with any combination of content, widgets and ads as long as NO information about the session or user is transferred to a third party.  This matches user expectations.  It also enables a business model where the publisher can show high-value ads.  But the publisher has to control the data tagging and siloing function in house (or by a service provider) so it is enabled without data wrongfully transfer to third parties.  For example, if Wired decides to do a deal with CNET down the line to share information about users, it has to be able to segregate out the silo'd DNT ON user information.
> 
> If you set up rules that put publishers in control, they can message appropriately to their users what data is being collected and for what purpose and cure the problem that right now, people have no clue who is collecting data and how they are using it.   On the other hand, If you set up an architecture where publishers cannot show high value ads to DNT ON users, they will reject the users, show them crappier content, or increase costs on DNT OFF users.  None of these are good options.  If you let third parties directly collect data from a session but prohibit its use for "cross tracking" that seems to me to be a pretty big loophole.   Differentiating between first and third parties solves these issues.
> 
> On Dec 20, 2011, at 12:06 PM, Justin Brookman wrote:
> 
> justin@cdt.org
> http://www.cdt.org
> @JustinBrookman
> 
>> If an ad network (or some other third-party) uses precise geolocation to show me an ad (or some other geo-contextual content), but then immediately deletes that information (or retains for some excepted purpose like ad reporting but not profiling), that seems to me to be more akin to contextual advertising than "tracking."  I think I agree with Shane that the granularity of the location is not relevant to whether the collection and use of location data is across sites or time.
>> 
>> On the other hand, the precision of the data will determine whether it can be kept pursuant to one of the exceptions if any of those exceptions require anonymization/de-identification (since precise geolocation data collected over time is inherently identifying).  If at the end of this process the exceptions don't require anonymization, that would be an argument against the use of precise geolocation by a third-party in response to a DNT header, as the exceptions would allow for the retention of highly personal data.
>> Justin Brookman
>> Center for Democracy & Technology
>> Washington, DC 20006
>> fax 202.637.0969
>> Director, Consumer Privacy Project
>> 1634 I Street NW, Suite 1100
>> @CenDemTech
>> tel 202.407.8812
>> 
>> On 12/20/2011 2:29 PM, Jeffrey Chester wrote:
>>> Geo-location is part of the third party tracking process and should be addressed by DNT header.  That can still mean use of IP address but no other geo-targeting data analysis.
>>> 
>>> 
>>> Jeffrey Chester
>>> Center for Digital Democracy
>>> 1621 Connecticut Ave, NW, Suite 550
>>> Washington, DC 20009
>>> www.democraticmedia.org
>>> www.digitalads.org
>>> 202-986-2220
>>> 
>>> On Dec 20, 2011, at 2:07 PM, David Singer wrote:
>>> 
>>> 
>>>> 
>>>> On Dec 20, 2011, at 9:56 , Kevin Smith wrote:
>>>> 
>>>>> I know we have talked about it a few times, but perhaps not in the context of geo, but I still favor the position that an ad server (or other 3rd party service) can use information collected in the current session to target you.
>>>>>  
>>>>> For instance, if I am visiting New York, I do not have a problem if I see Broadway ads while I am there.  I don’t mind contextual ads.  If I am reading up on my favorite basketball team, I expect to see sports related ads.  Nor do I mind time-related ads.  I do not mind prioritization of office supplies over movie trailers at 2:00 in the afternoon because an ad server does not need to know anything about me to make this decision.
>>>> 
>>>> Yes, these all use data *from the current transaction*, not anything from the past.  I think we've discussed this and think it's OK.  You're being treated as a fresh, new, visitor, and nothing is being remembered.
>>>> 
>>>>> What may bother me is if I see Broadway ads once I have returned to Utah (meaning they are remembering all of my locations – assuming I have not in some other direct way indicated a preference for the theater), or if I see sports ads while booking a flight, or if the decision to show me office supplies vs movie trailers was based on watching my many locations and thereby determining if I am home or at work.
>>>> 
>>>> or if you visited a theater site while in New York and went to a risqué cabaret, and when you get home and go looking for a show to take the family to, you get shown a lot of ads for risqué cabarets.
>>>> 
>>>> 
>>>> David Singer
>>>> Multimedia and Software Standards, Apple Inc.
>>>> 
>>>> 
> Lauren Gelman
> BlurryEdge Strategies
> 415-627-8512
> gelman@blurryedge.com
> http://blurryedge.com
>