Re: Action-101; language for issue-6 for TCS spec

Shane, Roy, David and Aleecia,

Sorry, just catching up with email traffic today. I'm not sure where this all stands.  I'm glad to keep working on language as Shane suggests.  What's not clear to me is where this text is intended to go.  I think Aleecia envisioned it going into the Compliance and Scope spec.

Meanwhile, as you all will have likely read elsewhere, Roy has indicated he would be  happy to add most of my proposed language on the consumer view to his introduction in the TPE spec. I'd be happy to have it included, but worry that the introduction to the TPE is already too long.

I understand that David has a draft of a shorter version of the intro for the TPE.

I favor a minimalist approach to explanations for why we are doing this precisely because -- as Shane and David have suggested -- it's likely to be a very contentious process to reach consensus on language.  Roy, as I understand it, believes, we need a more detailed explanation to help implementers understand why they should be compliant.

However it ends up, it seems to me that any explanations of the reasons for DNT should be in only one document.  I'm not sure which one, but would lean towards the Compliance and Scope spec.  

Glad to proceed however, you all would like.

Best,
John





On Mar 3, 2012, at 3:38 PM, Shane Wiley wrote:

> John,
>  
> I have similar issues with your attempts at capturing the business perspective – as it feels you tried to ply in the consumer perspective anyway J. 
>  
> Aleecia had a good idea in my opinion in having us write the others perspective but as I had responded to your original attempt at this language, this is going to be a highly contentious effort and will take several weeks to finally produce a balanced, non-biased, short introductory paragraph or two to the documents.
>  
> I don’t believe we should abandon the effort but perhaps a small group of us can start working on this outside of the working group and bring back something once we feel a good solution.  John, Roy, David, and myself?  Anyone else?
>  
> Is everyone okay with this approach?
>  
> Thank you,
> - Shane
>  
> From: John Simpson [mailto:john@consumerwatchdog.org] 
> Sent: Friday, March 02, 2012 6:33 PM
> To: Shane Wiley
> Cc: Aleecia M. McDonald; public-tracking@w3.org (public-tracking@w3.org)
> Subject: Re: Action-101; language for issue-6 for TCS spec
>  
> Colleagues:
>  
> I was asked to write a paragraph answering issue-6  (What are underlying concerns? Why are we doing this? What are people afraid of?) from the business perspective.  Three points:
>  
> 1. Here is my proposed text
>  
> Business perspective:
>  
> "While there are a variety of business models to monetize content on the web, many rely on advertising. Advertisements can be targeted to a particular user's interests based on information gathered about one's online activity. While the Internet industry believes many users appreciate such targeted advertising, as well as other personalized content, there is also an understanding that some people find the practice intrusive.  If this opinion becomes widespread, it could undermine the trust necessary to conduct business on the Internet.  This Compliance specification and a companion Tracking Preference Expression specification are intended to give users a means to indicate their tracking preference and to spell out the obligations of compliant websites that receive the Do Not Track message.  The goal is to provide the user with choice, while allowing practices necessary for a smoothly functioning Internet. This should be a win-win for business and consumers alike."
>  
> 2. While I appreciate Shane's effort (below) to craft a text from the consumer perspective, I don't think it captures that view.  In fairness,  many of you may well believe my text misses the business point of view. Here is how I would express the user (or consumer) view:
>  
> User Perspective:
>  
> "Data about an individual belongs to that individual.  People have the right to know how data about them will be collected and how it will be used.  Empowered with that knowledge, individuals can decide whether to allow their online activities to be tracked and data about them to be collected.  Many Internet companies use data gathered about people's online activities to personalize content and target advertising based on their perceived interests.  While some people appreciate this personalization of content and ads in certain contexts, others are troubled by what they perceive as an invasion of their privacy.  For them the benefit of personalization is not worth their concerns about allowing entities with whom they have no direct relationship, to amass detailed profiles about their activities. The goal of this specification is to enable consumers to state their preference about whether their activities are tracked and what the obligations of a compliant website are when a Do Not Track message is received."
>  
> 3. My belief is that both Shane and I are operating with the best of intentions. Yet,  I suspect that neither of us is happy with the other's proposal.   That goes to the point I made earlier.  We simply do not need any explanation of why we are offering this standard.  I like philosophy.  I have a BA in philosophy. But we don't need or want to engage in endless debates.  All we need are specifications that explain how to send a DNT message, how to respond to it and what the obligations are to be compliant.
>  
> A comparison to traffic laws may by illustrative of my view.  It doesn't matter why a speed limit near a school is set at 25 mph (or whatever). There's no explanation of why (kids might run into the street) in the traffic code.  The law says signs will be put up with the limit and that compliant drivers will stay under the limit or risk enforcement action -- a ticket from a cop.
>  
> Regards,
> John
>  
>  
> On Mar 1, 2012, at 8:37 PM, Shane Wiley wrote:
> 
> 
> Consumer Privacy Perspective: 
> 
> The Internet brings millions of users and web sites together in a vibrant and rich ecosystem.  As the sophistication of the Internet has grown, so too has its complexity which leaves all but the most technically savvy able to deeply understand how web sites collect and use data about their online interactions.  While on the surface many web sites may appear to be served by a single entity, in fact, many web sites are an assembly of multiple parties coming together to power a user’s online experience.  As an additional privacy tool, this specification provides both the technical and compliance guidelines to enable the online ecosystem to further empower users with the ability to communicate a tracking preferences to a web site and its partners.        
> 
>  
> From: John Simpson [mailto:john@consumerwatchdog.org] 
> Sent: Wednesday, February 29, 2012 12:57 PM
> To: Aleecia M. McDonald
> Cc: Shane Wiley; public-tracking@w3.org (public-tracking@w3.org)
> Subject: Re: Action-101; language for issue-6 for TCS spec
>  
> Glad to give it a try.
>  
>  
> On Feb 29, 2012, at 8:44 AM, Aleecia M. McDonald wrote:
> 
> 
> 
> Thank you both.
>  
> I could imagine keeping John's short text as proposed, and then adding two paragraphs. One the one hand, privacy concerns are… On the other hand, business concerns are… Short, simple, acknowledgements of some of the issues out there. What might be interesting is for Shane to write the privacy paragraph and John to write the business paragraph. We have ample source material on both sides that has been in and out of the introduction section, so I think this is a comparatively quick task of cutting it down to something condensed and fairly neutral.
>  
> What do you think? If you're up for it, and can get drafts to the dlist by Friday, I think we can have it in for group review with enough time to discuss on the dlist and finalize on the call a week from now. 
>  
> I greatly appreciate your ability to work together in mutual respect, regardless of very different underlying views and values. This is how things work, and how to be effective in the TPWG. Thank you, gentlemen. 
>  
>             Aleecia
>  
> On Feb 28, 2012, at 5:34 PM, Shane Wiley wrote:
> 
> 
> 
> John,
>  
> Thank you for the thoughtful response – and I agree “less will be more” in this case (at least we’ll limit the areas of discussion where view points are largely divergent).
>  
> With that in mind, perhaps there is a middle ground between the current drafts and your draft below – the goal being to capture the specific issues being addressed and shy away from language/positions that are controversial within the group.  It would definitely be “shorter” and still provide some context (and can be used as a preamble for both documents).  Thoughts?
>  
> Thank you again,
> - Shane
>  
> From: John Simpson [mailto:john@consumerwatchdog.org] 
> Sent: Tuesday, February 28, 2012 6:26 PM
> To: Shane Wiley
> Cc: David Singer; public-tracking@w3.org (public-tracking@w3.org)
> Subject: Re: Action-101; language for issue-6 for TCS spec
>  
> Shane and David,
>  
> I've been thinking a lot about the points you made here and even though I wrote the text that was supposed to go into the Compliance document in response to Issue-6, and I've concluded you are correct.  The TPE should be about sending the DNT message.  Compliance should only be about obligations when you get the DNT message.
>  
> Why we're doing this may lead to a never ending debate.  It is likely, in fact, that we're all doing this for different reasons. Trying to capture that in a specification documents  makes little sense and may be impossible.
>  
> I think this is true with both documents.  I'd be inclined to close Issue-6 and not attempt to add the language to the Compliance document.  There may be some further language there that should be cut, too. I need to look.
>  
> In the TPE, I'd cut virtually all the Introduction.  I'd propose keeping:
>  
>       " This specification defines the HTTP request header field DNT for expressing a tracking preference on the Web, a well-known location (URI) for providing a machine-readable tracking status resource that describes a service's DNT compliance, and the HTTP response header field Tk for resources to communicate their compliance or non-compliance with the user's expressed preference.
>         "A companion document, [TRACKING-COMPLIANCE], more precisely defines the terminology of tracking preferences, the scope of its applicability, and the requirements on compliant first-party and third-party participants when an indication of tracking preference is received. "
> 
> I really believe this is a case where less is more.  We're all at the table for different reasons.  Let's put a laser-like focus on sending the DNT message (TPE) and what the obligations will be (compliance).  
> 
> I really believe this may help move us toward consensus.
> 
>  
> Best,
> John
>  
>       
> 
>  
>  
> On Feb 22, 2012, at 4:37 PM, Shane Wiley wrote:
> 
> 
> 
> 
> + 1
>  
> I believe the language is highly overstated as well and would recommend this be completely removed from the Working Group document set.  Advocates could simply release their own “companion document” at the release of the W3C DNT documents (similar to what Trade Groups will probably do as well).  Otherwise, we’ll need to unwind the clear bias in these descriptions to provide a more balanced message – which could eat up several weeks of Working Group time.
>  
> - Shane
>  
> From: David Singer [mailto:singer@apple.com] 
> Sent: Wednesday, February 22, 2012 4:13 PM
> To: public-tracking@w3.org (public-tracking@w3.org)
> Subject: Re: Action-101; language for issue-6 for TCS spec
>  
> I honestly think that the specifications should just state what the protocol is (TPE) and what it means to comply (compliance).  I think explanations of 'why', 'how', and so on, are best dealt with at length in a companion 'report'.  Trying to fit all the justification, background, rationale, examples, and so on, into the spec. just makes it unwieldy, IMHO.
>  
>  
> On Feb 21, 2012, at 17:54 , John Simpson wrote:
> 
> 
> 
> 
> 
> Colleagues:
> This is Action-101: Revise Issue-6 text based on feedback on the mailing list.  It has been cut a bit from the first version and a new second paragraph inserted in response to comments on the list.  It would go in section 2.1 in the FPWD of the TCS.
> Best regards,
> John
> ------------
> Explaining stakeholders' concerns and the reasons to offer Do Not Track help put the Tracking Compliance and Scope standard in context so its importance will be understood.
>  
> Specification:
>  
> The user experience online involves the exchange of data across servers. At the most basic level, online communication requires the exchange of IP addresses between two parties. Completion of e-commerce transactions normally involves the sending of credit card numbers and user contact information. However, the user experience also often involves unintentional disclosure of data and the commercial compilation of many different kinds of user data by different entities. Much web content is supported by advertising and much of this advertising is linked to either the content of the page visited or to a profile about the particular user or computer. Complex business models have arisen around these online data flows.
>  
> Citizens and consumers confront a far-reaching and largely non-transparent system of data collection and analysis used to make decisions about them. The Internet should ensure that users have control over their information, and to the largest extent possible, over the methods used to process such data. Providing more transparency about data flows and empowering users to control their data, will bolster users' confidence in the Internet. Such an outcome is a win, win for business and consumers alike.
>  
> Exactly how data is gathered and used is not clear to most users. Moreover, users have repeatedly expressed concerns about the use of their data, as this data can be considered personal or even sensitive. For example, a Consumers Union Poll (http://www.consumersunion.org/pub/core_telecom_and_utilities/006189.html ) found that 72 percent or respondents are concerned that their online behaviors were being tracked and profiled by companies. A poll conducted for Consumer Watchdog by Grove Insight found 80 percent support for a "Do Not Track" feature (http://insidegoogle.com/wp-content/uploads/2010/07/wfreInternet.release1.pdf). TRUSTe featured two research studies attempting to quantify consumer concerns around tracking in mobile (April 2011) (http://www.truste.com/about_TRUSTe/press-room/news_truste_mobile_privacy_survey_results_2011) and more generally around OBA (July 2011) http://www.truste.com/ad-privacy/TRUSTe-2011-Consumer-Behavioral-Advertising-Survey-Results.pdf) The Special European Barometer 359 ( http://ec.europa.eu/public_opinion/archives/ebs/ebs_359_en.pdf) found that 54 percent of respondents were uncomfortable with the fact that websites "use information about your online activity to tailor advertisements or content to your hobbies and interests."
>  
> In non-US jurisdictions, consumers have a different, and higher, expectation around privacy, which stems closer to a fundamental "right" granted to them as part of their citizenship of a particular country. The concept of non-permissive collection of their browsing behavior and personal information is antithetical to their fundamental values and expectations of how they should be treated online.
>  
> The accompanying Tracking Preference Expression recommendation explains how a user, through a user agent, can clearly express a desire not to be tracked. This Tracking Compliance and Scope recommendation sets the standard for the obligations of a website that receives such a DNT message.
>  
> Taken together these two standards should have three substantial outcomes:
>  
> Empower users to manage their preference around the collection and correlation of data about Internet activities that occur on different sites and spell out the obligations of sites in honoring those preferences when DNT is enabled.
> Provide an exceedingly straightforward way for users to gain transparency and control over data usage and the personalization of content and advertising on the web.
>  
> Enable a vibrant Internet to continue to flourish economically by supporting innovative business models while protecting users' privacy.
>  
> Examples and use cases:
>  
> 1. Several of the stated research studies have shown that when consumers are asked about their preferences around tracking, usually a large majority state they do not wish to be tracked under any circumstances, even when told of how the tracking is to be used (e.g., to provide relevant advertising).
>  
> 2. However, research of this type doesn't often map to reality when it comes to actual behavior of consumers using technology to control this preference. Examples include:
> a. Users that block 3rd party cookies by default, or that clear their cookies after each setting.
> b. Users of third party privacy add-ons to help manage their privacy. 
> c. Users that have seen the AdChoices icon, clicked on it and opt-ed out of tracking in the current DAA regime.
> d Recent DNT data from Mozilla shows a very small minority of uptake and usage.
>  
> In each of these cases, a very small minority have chosen to use these technologies. But, it can be argued that for the average user, all of these methods are just complex to use and as such a simpler framework is needed. Hence, why consumer advocacy and governments intervene. 
>  
> 3. Users are often offered a free ad-supported application or service (vs. a paid-for equivalent) and still continue to select free apps when given the choice. [The underlying assumption is that they associate "seeing apps" with "tracking".]
>  
> 4. In the EU, the issue of choice takes a higher level position of human right based upon Article 8 of The Charter of Fundamental Rights of the European Union and Article 8 of The European Convention on Human Rights, the former saying,"Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law." In this case, it is argued that all citizens should offer express consent prior to allowing any tracking that is not absolutely critical to delivering the fundamental function of the visited website.
>  
> 5. Another level to this argument argument is that everyone is at least due transparency and the *option* to express a preference with the belief that that preference will mean something (accountability). This is a fundamental right in the value exchange of personal information online, especially when data is already being collected without that person's knowledge or explicit permission. Whether it is opt-in or opt-out can vary by location of course. If such system was prevalent then perhaps more people would change their minds on willingness to be tracked.
>  
> David Singer
> Multimedia and Software Standards, Apple Inc.
>  
>  
> ----------
> John M. Simpson
> Consumer Advocate
> Consumer Watchdog
> 1750 Ocean Park Blvd. ,Suite 200
> Santa Monica, CA,90405
> Tel: 310-392-7041
> Cell: 310-292-1902
> www.ConsumerWatchdog.org
> john@consumerwatchdog.org
>  
>  
>  
> ----------
> John M. Simpson
> Consumer Advocate
> Consumer Watchdog
> 1750 Ocean Park Blvd. ,Suite 200
> Santa Monica, CA,90405
> Tel: 310-392-7041
> Cell: 310-292-1902
> www.ConsumerWatchdog.org
> john@consumerwatchdog.org
>  
>  
> ----------
> John M. Simpson
> Consumer Advocate
> Consumer Watchdog
> 1750 Ocean Park Blvd. ,Suite 200
> Santa Monica, CA,90405
> Tel: 310-392-7041
> Cell: 310-292-1902
> www.ConsumerWatchdog.org
> john@consumerwatchdog.org
>  

----------
John M. Simpson
Consumer Advocate
Consumer Watchdog
1750 Ocean Park Blvd. ,Suite 200
Santa Monica, CA,90405
Tel: 310-392-7041
Cell: 310-292-1902
www.ConsumerWatchdog.org
john@consumerwatchdog.org