Re: ACTION-152 - Write up logged-in-means-out-of-band-consent

Shane,

There is no "if."  You have misrepresented my views.  Again.

I believe this W3C process is the one real shot at specifying a meaningful Do Not Track standard that both protects users and avoids heavy-handed government intervention.  If we don't reach agreement, EU (and possibly U.S.) regulators will impose their own Do Not Track standard.  If we reach partial agreement, I expect government scrutiny to wane.  For those reasons, I think we cannot punt or postpone issues within the ambit of Do Not Track.  None of that expands the scope of my motivation beyond Do Not Track.

Jonathan

On Apr 2, 2012, at 11:08 AM, Shane Wiley wrote:

> I apologize Jonathan if I've misrepresented you in this case.  I distinctly remembering you using phrases like "one time at the well" or something to that effect.  I again apologize if I misinterpreted that statement.
> 
> - Shane
> 
> -----Original Message-----
> From: Jonathan Robert Mayer [mailto:jmayer@stanford.edu] 
> Sent: Monday, April 02, 2012 9:51 AM
> To: Shane Wiley
> Cc: Rigo Wenning; public-tracking@w3.org; Alan Chapell; Jeffrey Chester; David Singer; John Simpson
> Subject: Re: ACTION-152 - Write up logged-in-means-out-of-band-consent
> 
> Shane has seen it fit to once again falsely malign my motives. I'll be brief as usual: I am not attempting to solve anything more than third-party web tracking. I have never indicated or acted otherwise.
> 
> Jonathan
> 
> On Apr 2, 2012, at 8:40 AM, Shane Wiley <wileys@yahoo-inc.com> wrote:
> 
>> Rigo,
>> 
>> Interestingly I believe it is your argument that attempts at eating its cake and having it too.
>> 
>> The issues this group is wrestling with will have impacts on the privacy debate far beyond the reach of DNT.  I'm not sure how often you work in the internet advertising world or how much history you have the specifics of the privacy legal debate both in the US and the EU, but there will be no way to isolate the "appropriate consent" structure as applying only to DNT.  This is exactly the reason advocates in this conversation are pushing so hard on these dimensions as they see this as an opportunity to solve multiple privacy topics in a single pass (Jonathan has said as much in email and in f2f meetings).  While I'm supportive of solving all of the privacy debate, I believe it will be impossible to do this in our stated timeframe - if ever - as I believe many of these debates will live far into the future as our cultures and the Internet evolve together.
>> 
>> I don't see the disconnect (eat/have cake) between saying out-of-band consent trumps DNT and then allowing local law to define what is appropriate consent.  In fact, I believe there will be many areas of this standard that will need to follow this formula.  We've already agreed as a working group that we don't believe direct references to regional laws are appropriate in the standards documents (fine for conversation as a testing mechanism) - rather we'd simply state "in compliance with local law".  I see several conversations within the TPWG as attempting to override local law by setting some default, pan-global privacy standard outside of DNT - "appropriate consent" is just one of these.
>> 
>> - Shane 
>> 
>> -----Original Message-----
>> From: Rigo Wenning [mailto:rigo@w3.org] 
>> Sent: Monday, April 02, 2012 7:48 AM
>> To: public-tracking@w3.org
>> Cc: Shane Wiley; Alan Chapell; Jeffrey Chester; Jonathan Mayer; David Singer; John Simpson
>> Subject: Re: ACTION-152 - Write up logged-in-means-out-of-band-consent
>> 
>> Shane, 
>> 
>> On Sunday 01 April 2012 20:54:12 Shane Wiley wrote:
>>> I disagree with your basic premise here: '"Out-of-band" is creating the
>>> trouble, because it imports troubles from outside in our definition space
>>> and we have to decide in how far we accept that (see below).'
>> 
>> You can't have the cake and eat it too. 
>> 
>> Either you take some rule from outside (out of band is superior of what we 
>> define here) and you accept that the discussion about quality of out of band 
>> agreements for DNT compliance is in scope for our Group. 
>> 
>> Or you say, those out of band agreements have some legal value outside DNT and 
>> we do not discuss it here but manage the semantic clash in our legal 
>> department. In this case you may well say that because you have out of band 
>> agreement, you break DNT compliance without legal consequences.
>> 
>> Or we create some rules under which out of band is taken into account by DNT 
>> while still maintaining DNT compliance. That needs definition of some 
>> requirements for out-of-band agreement as accepted for compliance with the 
>> _Specification_.
>> 
>> But what we should not accept is allowing services to say "we do DNT" while 
>> basically ignoring DNT-rules because of an undefined out of band agreement. 
>> This is so prone to abuse that DNT would become meaningless IMHO. 
>> 
>> Best, 
>> 
>> Rigo
>

Received on Monday, 2 April 2012 18:39:06 UTC