Re: Frequency Capping

Hi Chris -- thank you kindly.

I (and a few others) have repeatedly stated what you are saying here:

On 7/12/2012 11:39 AM, Chris Mejia wrote:
> Under the currently proposed binary DNT mechanism, there is no way for 
> publishers/ad-networks/advertisers/etc. to know if the consumer made 
> the setting themselves.  So if an IE10 user turns off the default DNT, 
> then later turns it on, there is no way to distinguish that user from 
> others who have not manipulated the default setting.  There is also no 
> way to audit this setting of the mechanism.  As such, those companies 
> who chose to "honor" this voluntary DNT spec, will likely have to 
> honor all DNT requests, no matter how they were set.  OR conversely, 
> _not honor any DNT signals_, pointing to a clear market inconsistency 
> in how DNT is set, with no technical mechanism available to determine 
> the validity of consumer preference.

I still think this is the case, but the working group has not reached 
consensus on this point and many members have argued that servers can 
ignore any and all of IE10's signals simply because they deem it to be 
'non-compliant' and, more importantly, a number have said they intend to 
do so when implementing DNT. Again, I strongly disagree with that 
notion, but there you have it.

>     CM:  I think you missed a step.  Step 1 should be to identify an
>     actual problem to solve for.  Until you have identified that
>     actual harm has been done to consumers through this practice, we
>     are only solving for theoretical potential threats.  Once you
>     quantify and thus qualify the potential harm, _based on real
>     documented experience_, THEN I think everyone can asses if we need
>     to solve for the potential.
>
>     *Just because I heard someone say that they sighted a unicorn,
>     doesn't mean that I should rush out to build a unicorn farm.* 
>     Before I go to all the trouble and expense of building my unicorn
>     farm, I will probably take the very balanced and reasonable steps
>     of validating the actual existence of unicorns.  Call me crazy if
>     you like.
>
>

Chris -- the privacy harm I am referring to is the fact that my online 
activities are being tracked. You may disagree with the magnitude of 
such a privacy harm, but some may disagree and, in contexts where I have 
had no interaction with the multitudes of companies that are doing the 
tracking, I would want the right to opt-out of this type of tracking (at 
least with respect to a select number of companies, based on trust, etc.).

Are you denying that current frequency capping techniques entail the 
placement of unique user identifiers on user's computers, as well as 
third party access to these identifiers across diverse sites?

Best,
Tamir


On 7/12/2012 11:39 AM, Chris Mejia wrote:
> Hi Tamir,
>
> Thanks for your detailed reply.  My comments are below, inline with yours.
>
>
> Chris Mejia | Digital Supply Chain Solutions | Ad Technology Group | 
> Interactive Advertising Bureau - IAB
>
>
> From: Tamir Israel <tisrael@cippic.ca <mailto:tisrael@cippic.ca>>
> Date: Wed, 11 Jul 2012 23:34:06 -0400
> To: Chris Mejia - IAB <chris.mejia@iab.net <mailto:chris.mejia@iab.net>>
> Cc: "Grimmelmann, James" <James.Grimmelmann@nyls.edu 
> <mailto:James.Grimmelmann@nyls.edu>>, W3C DNT Working Group Mailing 
> List <public-tracking@w3.org <mailto:public-tracking@w3.org>>, Mike 
> Zaneis - IAB <mike@iab.net <mailto:mike@iab.net>>, Brendan 
> Riordan-Butterworth - IAB <brendan@iab.net <mailto:brendan@iab.net>>
> Subject: Re: Frequency Capping
>
> On 7/11/2012 7:12 PM, Chris Mejia wrote:
>> With Microsoft already shipping IE10 with DNT:1 defaulted to "on", 
>> there will soon be 30+ percent of users broadcasting the DNT:1 signal.
>
> Oh, that. Well, I don't think IE10 DNT-1 by default actually 
> translates into a 30% DNT-1. Assuming for the moment that IE10 does 
> achieve a 30% user base, the reality is that these users will be 
> prompted left right and center by servers to move to DNT-0 or grant 
> exceptions. I imagine many will, as I've seen the creativity and 
> innovation the ad industry is able to leverage when setting out to 
> convince users to click on buttons : P
>
>     CM: 30% was a forward looking number (refer to the separate thread
>     on this topic where I support the number).  I believe that
>     industry publishers are not generally interested in creating a
>     "land-mine field" of pop-ups on the Internet to "battle" a poorly
>     implemented DNT:1 mechanism.  This battle, if it were enacted,
>     would happen on publisher websites and would represent a terrible
>     user experience that would likely be attributed to the publisher,
>     thus creating poor consumer to publisher brand will.
>
>
> In any case, in setting DNT-1 on by default, IE10 is non-compliant 
> with the standard (so I don't see how you could pin that one on the 
> W3C) and, moreover, at the moment it appears the working group is 
> leaning towards a standard that permits servers to ignore any DNT-1 
> signal they feel is non-compliant.
>
>     CM:  To be clear, I have not pinned Microsoft's implementation of
>     DNT on the W3C.  Conversely, I support and applaud all working
>     group efforts to denounce such default settings of DNT.  In my
>     opinion, the setting of DNT by default is a fatal flaw for the
>     success of the currently proposed mechanism and program. As many
>     smart folks on this forum have already pointed out, it's probably
>     not practical in practice to simply ignore some DNT signals and
>     not others, based on assumptions that certain users associated
>     with particular non-compliant user agents did not make their
>     settings consciously and/or were not armed with relevant
>     information to make an informed decision.  Under the currently
>     proposed binary DNT mechanism, there is no way for
>     publishers/ad-networks/advertisers/etc. to know if the consumer
>     made the setting themselves.  So if an IE10 user turns off the
>     default DNT, then later turns it on, there is no way to
>     distinguish that user from others who have not manipulated the
>     default setting.  There is also no way to audit this setting of
>     the mechanism.  As such, those companies who chose to "honor" this
>     voluntary DNT spec, will likely have to honor all DNT requests, no
>     matter how they were set.  OR conversely, _not honor any DNT
>     signals_, pointing to a clear market inconsistency in how DNT is
>     set, with no technical mechanism available to determine the
>     validity of consumer preference.
>
>     To summarize, many companies may choose not to honor this
>     voluntary DNT specification at all, based on the systemic fatal
>     flaw outlined above.  I don't see that as a particularly good
>     outcome, but I understand and appreciate why companies may be
>     forced to make such an unfortunate choice:  in the US, if a
>     company states they will honor the DNT spec/signal, they are
>     potentially opening themselves up to regulatory enforcement (i.e.
>     FTC, State AGs, etc.) and private litigation for cases brought by
>     or in the name of users that feel their DNT request was not
>     adequately honored.  Simply ignoring some DNT signals (no matter
>     the rationale), under the currently proposed mechanism, likely
>     leads to this legal exposure.
>
> Going back to the F-caps, since we're talking about third parties a 
> specific user has had little interaction with, I do not think it is 
> unreasonable for a user who sends out a signal -- 'do not track me' -- 
> to presume that this means they will not be tracked. Allowing user 
> identification for the purpose of F-caps means allowing tracking or, 
> alternatively, makes it impossible to ensure non-tracking at the user 
> end.
>
> It could be that some might feel the marginal benefit of adopting a 
> method of F-capping that does not require tracking is not meritorious. 
> But making this assessment is a two step process. The first step is to 
> outline the most feasible means of achieving the objective. Step two 
> is to weigh the costs of that objective against any perceived benefit. 
> We can't really do step 2 properly without doing step 1 first. If step 
> 1 is impossible, it would be good to hear why some of the methods that 
> have already been proposed are impossible or to what extent they're 
> inadequate.
>
>     CM:  I think you missed a step.  Step 1 should be to identify an
>     actual problem to solve for.  Until you have identified that
>     actual harm has been done to consumers through this practice, we
>     are only solving for theoretical potential threats.  Once you
>     quantify and thus qualify the potential harm, _based on real
>     documented experience_, THEN I think everyone can asses if we need
>     to solve for the potential.
>
>     *Just because I heard someone say that they sighted a unicorn,
>     doesn't mean that I should rush out to build a unicorn farm.* 
>     Before I go to all the trouble and expense of building my unicorn
>     farm, I will probably take the very balanced and reasonable steps
>     of validating the actual existence of unicorns.  Call me crazy if
>     you like.
>
>
> Best,
> Tamir
>