Re: Summary of First Party vs. Third Party Tests

It seems to me that all sites must respect DNT when the message is sent.  The interesting question is what the compliance responsibilities will be.  I'll grant that there are different levels of response depending on then user's relationship with and expectations of the site.  As I understand the issue, "First" party and "Third" party are conventions that are fairly well understood.  (I don't know how we got there, though. Logically, I'd think of the user as the first party, the site whose URL is entered in the browser as the second party, and other content served to the Second Party site as coming from Third Party sites, but that's not the convention.)

I think talking about "explicit" and "implicit" consent is the same as discussing talking about first party and third party, so I think we ought to stay with conventional terminology -- First Party responsibilities and Third Party responsibilities.

It's essential to stress, however, that ALL sites have responsibilities when they receive a DNT message.  In  the compliance standard we'll need to spell out those standards.  It could well be the case that  good actors with best practices will wish go beyond their minimum responsibilities when they encounter and honor the DNT request.

--John M. Simpson



On Nov 3, 2011, at 1:06 PM, Shane Wiley wrote:

> I believe 1st and 3rd party distinctions are critical to the conversation and a wholesale application of DNT - even to the site the user is expecting to visit - doesn't make sense.  As Aleecia's research has expressed, users do generally understand the difference and I believe our work should reflect that.  If we move to "explicit vs. implied" it seems like we're right back in the same place and are simply shifting terminology but the substance of the discussion is the same - which is "where is the DNT signal expected to be respected?".
> 
> - Shane
> 
> -----Original Message-----
> From: David Wainberg [mailto:dwainberg@appnexus.com] 
> Sent: Thursday, November 03, 2011 12:58 PM
> To: Rigo Wenning
> Cc: public-tracking@w3.org; Jonathan Mayer
> Subject: Re: Summary of First Party vs. Third Party Tests
> 
> I agree with Rigo that the 1st vs 3rd party approach is too complex. We 
> can get effectively the same result, but in a cleaner and more scalable 
> way if we have a baseline application of DNT to all parties, and then 
> provide exceptions based on consent. We'll still need to have the debate 
> about what constitutes consent (explicit and implied), but the result 
> will be a broadly applicable rule (or set of rules). That would be more 
> useful than trying to cook up a 1st vs 3rd party distinction that's 
> workable in this diverse ecosystem.
> 
> On 11/1/11 6:10 PM, Rigo Wenning wrote:
>> Add one minority opinion that says that the distinction between first and
>> third parties is too complex. This mixes technical and legal consideration
>> into an indigestible brewing. It will make implementation on the service side
>> too complex. It will create risk and ambiguity.
>> 
>> I would rather tone down the compliance requirements for all and not
>> distinguish between first and third parties to avoid the difficult
>> distinctions. (I can generate a number of challenging distinctions on demand)
>> 
>> I also believe that this will create a race into being a first party and that
>> every ambiguity will be used to become a first party. At the end of the day,
>> everybody will be a first party by contract or other virtue.
>> 
>> Best,
>> 
>> Rigo
>> 
>> On Friday 28 October 2011 22:11:24 Jonathan Mayer wrote:
>>> (ACTION-25)
>>> 
>>> As I understand it, there are four camps on how to distinguish between first
>>> parties and third parties.
>>> 
>>> 1) Domain names (e.g. public suffix + 1).
>>> 
>>> 2) Legal business relationships (e.g. corporate ownership + affiliates).
>>> 
>>> 3) Branding.
>>> 
>>> 4) User expectations.
>>> 
>>> Here are some examples that show the boundaries of these definitions.
>>> 
>>> Example: The user visits Example Website at example.com.  Example Website
>>> embeds content from examplestatic.com, a domain controlled by Example
>>> Website and used to host static content.
>>> 
>>> Discussion: Content from the examplestatic.com domain is first-party under
>>> every test save the first.
>>> 
>>> Example: Example Website (example.com) strikes a deal with Example Affiliate
>>> (affiliate.com), an otherwise unrelated company, to share user data.  The
>>> user visits Example Website, and it embeds content from Example Affiliate.
>>> 
>>> Discussion: Content from Example Affiliate is third-party under every test
>>> save the second.
>>> 
>>> Example: Example Website embeds a widget from Example Social Aggregator.
>>> The widget includes a prominent logo for Example Social Aggregator, though
>>> a user is unlikely to recognize it.
>>> 
>>> Discussion: Content from Example Social Aggregator is third-party under
>>> every test save the third.
> 

----------
John M. Simpson
Consumer Advocate
Consumer Watchdog
1750 Ocean Park Blvd. ,Suite 200
Santa Monica, CA,90405
Tel: 310-392-7041
Cell: 310-292-1902
www.ConsumerWatchdog.org
john@consumerwatchdog.org