RE: Summary of First Party vs. Third Party Tests

I believe 1st and 3rd party distinctions are critical to the conversation and a wholesale application of DNT - even to the site the user is expecting to visit - doesn't make sense.  As Aleecia's research has expressed, users do generally understand the difference and I believe our work should reflect that.  If we move to "explicit vs. implied" it seems like we're right back in the same place and are simply shifting terminology but the substance of the discussion is the same - which is "where is the DNT signal expected to be respected?".

- Shane

-----Original Message-----
From: David Wainberg [mailto:dwainberg@appnexus.com] 
Sent: Thursday, November 03, 2011 12:58 PM
To: Rigo Wenning
Cc: public-tracking@w3.org; Jonathan Mayer
Subject: Re: Summary of First Party vs. Third Party Tests

I agree with Rigo that the 1st vs 3rd party approach is too complex. We 
can get effectively the same result, but in a cleaner and more scalable 
way if we have a baseline application of DNT to all parties, and then 
provide exceptions based on consent. We'll still need to have the debate 
about what constitutes consent (explicit and implied), but the result 
will be a broadly applicable rule (or set of rules). That would be more 
useful than trying to cook up a 1st vs 3rd party distinction that's 
workable in this diverse ecosystem.

On 11/1/11 6:10 PM, Rigo Wenning wrote:
> Add one minority opinion that says that the distinction between first and
> third parties is too complex. This mixes technical and legal consideration
> into an indigestible brewing. It will make implementation on the service side
> too complex. It will create risk and ambiguity.
>
> I would rather tone down the compliance requirements for all and not
> distinguish between first and third parties to avoid the difficult
> distinctions. (I can generate a number of challenging distinctions on demand)
>
> I also believe that this will create a race into being a first party and that
> every ambiguity will be used to become a first party. At the end of the day,
> everybody will be a first party by contract or other virtue.
>
> Best,
>
> Rigo
>
> On Friday 28 October 2011 22:11:24 Jonathan Mayer wrote:
>> (ACTION-25)
>>
>> As I understand it, there are four camps on how to distinguish between first
>> parties and third parties.
>>
>> 1) Domain names (e.g. public suffix + 1).
>>
>> 2) Legal business relationships (e.g. corporate ownership + affiliates).
>>
>> 3) Branding.
>>
>> 4) User expectations.
>>
>> Here are some examples that show the boundaries of these definitions.
>>
>> Example: The user visits Example Website at example.com.  Example Website
>> embeds content from examplestatic.com, a domain controlled by Example
>> Website and used to host static content.
>>
>> Discussion: Content from the examplestatic.com domain is first-party under
>> every test save the first.
>>
>> Example: Example Website (example.com) strikes a deal with Example Affiliate
>> (affiliate.com), an otherwise unrelated company, to share user data.  The
>> user visits Example Website, and it embeds content from Example Affiliate.
>>
>> Discussion: Content from Example Affiliate is third-party under every test
>> save the second.
>>
>> Example: Example Website embeds a widget from Example Social Aggregator.
>> The widget includes a prominent logo for Example Social Aggregator, though
>> a user is unlikely to recognize it.
>>
>> Discussion: Content from Example Social Aggregator is third-party under
>> every test save the third.

Received on Thursday, 3 November 2011 20:07:44 UTC