RE: Action-157: Update logged-in consent proposal

I'm fine with "ideally":

<Normative>

Sites MAY override a user's DNT preference if they have received explicit, informed consent to do so.

<Non-Normative>

In the absence of a Tracking Preference standard, many organizations have developed direct consent mechanisms for web-wide tracking.  Interactions with users to obtain consent are often contextual.  For example, If a service has an obvious cross-site tracking function that the user deliberately signs up for then this could be deemed to have achieved "explicit and informed" consent from a user without directly addressing its reaction to an external Tracking Preference (which wasn't contemplated at the time the consent experience was designed).  Even in these cases, organizations should consider providing Tracking Preference references in associated product or service materials such as a privacy policy, help center, or separate notice to users.

Companies claiming public compliance with the W3C Tracking Protection standard, should not seek to obtain explicit, informed consent from users in non-obvious ways such as placing these details in their Terms of Service or deeply placed within their Privacy Center if it will not be obvious to users that the nature of the service will lead them to ignore a user's Tracking Preference based on the nature of the consent the user is granting.

Out-of-band consent will be further reinforced in user interactions through either the Header Response or Well-Known URI approaches to replying to user Tracking Preferences.  This will provide a constant reminder of prior consent on each interaction and provide a resource (link) to allow the user to understand how this consent was achieved and ideally options to alter that consent if the user chooses to do so.


From: David Singer [mailto:singer@apple.com]
Sent: Wednesday, April 25, 2012 12:21 PM
To: Shane Wiley
Cc: public-tracking@w3.org
Subject: Re: Action-157: Update logged-in consent proposal

Nice

one word comment:

On Apr 24, 2012, at 22:22 , Shane Wiley wrote:


<Normative>

Sites MAY override a user's DNT preference if they have received explicit, informed consent to do so.

<Non-Normative>

In the absence of a Tracking Preference standard, many organizations have developed direct consent mechanisms for web-wide tracking.  Interactions with users to obtain consent are often contextual.  For example, If a service has an obvious cross-site tracking function that the user deliberately signs up for then this could be deemed to have achieved "explicit and informed" consent from a user without directly addressing its reaction to an external Tracking Preference (which wasn't contemplated at the time the consent experience was designed).  Even in these cases, organizations should consider providing Tracking Preference references in associated product or service materials such as a privacy policy, help center, or separate notice to users.

Companies claiming public compliance with the W3C Tracking Protection standard, should not seek to obtain explicit, informed consent from users in non-obvious ways such as placing these details in their Terms of Service or deeply placed within their Privacy Center if it will not be obvious to users that the nature of the service will lead them to ignore a user's Tracking Preference based on the nature of the consent the user is granting.

Out-of-band consent will be further reinforced in user interactions through either the Header Response or Well-Known URI approaches to replying to user Tracking Preferences.  This will provide a constant reminder of prior consent on each interaction and provide a resource (link) to allow the user to understand how this consent was achieved and hopefully options to alter that consent if the user chooses to do so.

s/hopefully/ideally/ ?  (notwithstanding the recent dictionary change which allows 'hopefully' to mean 'we hope' instead of the old insistence on 'with hope')


David Singer
Multimedia and Software Standards, Apple Inc.