Permitted behavior of third parties under user-granted exceptions?

Hi Folks,


I had an interesting discussion with Alex where we discovered that we
have different opinions on what third parties are permitted to do once
they received an exceptions.
Assumption/scenario is that the user sends DNT;1 unless there is a
user-granted exception.

Please reply if you believe that any of the following statements is wrong:

1. If a third party receives DNT;1 and has no out of band exception, it
is required to follow the constraints for third parties (as defined in
the compliance spec)
    [I believe that this, e.g., means that in general it cannot
correlate data from this interaction with data obtained elsewhere]

2. If a third party receives DNT;0 (e.g., since it has obtained an
exception) then its behavior is not constrained by DNT.

3. This, e.g., imples that if a third party is embedded in multiple
sites and has exceptions on all those sites (i.e., DNT;0 is sent) then
this third party can
    - use the same cookies with unique IDs on all sites
    - correlate the obtained data in any way (at least no constraints
from us)
    - and, e.g., use the cookies to track unique visitors


Regards,
matthias

Received on Friday, 13 April 2012 01:48:00 UTC