RE: ACTION-110: Write proposal text for what it means to "not track" (ISSUE-119)

A quick look at EU and US university sites indicates plenty of tracking.
(depending on what we consider tracking)....

Universities aren't acting as publishers carrying banner ads.  But they do
advertise elsewhere using third parties who track back the performance of
those ads to university sites by pixeling their pages.  And third party
analytics code is quite common place on university sites.

-----Original Message-----
From: Rigo Wenning [mailto:rigo@w3.org] 
Sent: Saturday, February 18, 2012 6:16 PM
To: public-tracking@w3.org; Ninja Marnau
Cc: Roy T. Fielding
Subject: Re: ACTION-110: Write proposal text for what it means to "not
track" (ISSUE-119)

Roy, Ninja, 

looks like we have two very good proposals on the table. Just to also give
my recollection from the Brussels meeting: Matthias was complaining about
the small websites, but also about the Universities that will not do big DNT
implementation efforts. But they are not tracking either. How do we deal
with it. Ninja took a first (restrictive) suggestion. Roy toned down a bit
(I think we have too much misunderstandable EU data protection jargon in
Ninja's proposal). 

Can you both be clear on: 

1/ Log data (which data for how long?)

2/ Cookie data (session cookies are not in scope anyway, right?)

And can we please stop the confusion of this case with the DNT case for the
professionals? Only because there are  sites that do not participate in the
advertisement model (aka Universities) we should not disregard them in our
solution. And if you really fear that having "normal University sites
indicating that they do not track" is conveying a bad message on our normal
DNT specification, than this may be seen as a confession that the industry
doesn't trust the effectiveness of their own suggestions and that they want
to re-think their suggestions. But I believe this would be a dead-end
discussion, especially as I think all the alleged harm is not intended. 

This said, I agree with Aleecia and Roy that we should be careful about the
concrete wording. "not-tracking" and "really-not-tracking" looks like a bad
option. Somebody will ultimately come up with a "really-really-really-not-
tracking-fingers-crossed". So I share Roy's concern, but I don't think Ninja
intended that effect. I remind you that we are in an international context
here with non-native speakers.

Best, 

Rigo

On Monday 13 February 2012 15:04:24 Roy T. Fielding wrote:
> A party may claim that it is not tracking if
> 
> 1) the party does not retain data from requests in a form that might 
> identify a user except as necessary to fulfill that user's intention 
> (e.g., credit card billing data is necessary if the user is making a 
> purchase) or for the limited purposes of access security, fraud 
> prevention, or audit controls;
> 
> 2) when user-identifying data is retained for purposes other than to 
> fulfill the user's intention, the party maintains strict 
> confidentiality of that data and only retains that data for a limited 
> duration that is no longer than is necessary to accomplish that 
> purpose, thereafter destroying or otherwise clearing the 
> user-identifying data; and,
> 
> 3) the party does not combine or correlate collected user-identifying 
> data with any other data obtained from prior requests, 
> user-identifying profiles, or data obtained from third parties unless 
> specifically directed to do so by the user (e.g., when a user 
> initiates a login request) or for the limited purposes of inspection 
> for access security, fraud prevention, or audit controls.

Received on Sunday, 19 February 2012 00:21:46 UTC