Re: ACTION-152 - Write up logged-in-means-out-of-band-consent

On Mar 27, 2012, at 5:54 , Shane Wiley wrote:

> Per my action item from last week, here is a position statement with respect to setting new business rules for “logged-in users” with respect to personalization off of the 1st party site and DNT.
>  
> “User registration and login often are bundled with a set of sign-up flow notices, Terms of Service, and Privacy Policy by which a 1st party will operate.  If these notices directly address interactions with users off of the 1st parties direct web site, such as through Widgets or other interactions with a user in a logged-in state, in an open and transparent manner, then this is considered an out-of-band user consent and DNT signals will be ignored.”

Shane

I don't think we can tell users "if you want privacy, remember to log out all the time".  That's a non-starter. So I agree, a general "logged-in exception" doesn't fly, for me.

Nor do I think we can tell UAs "don't send cookies with DNT:1" because then trivial things will stop working (e.g. a cookie that selected the language or size of the 'like' button itself).  Sites will have to expect to get DNT and cookies, and we need to say what that means if the cookies are actually identifying the user.


I think the text needs to be more explicit, and say that permitting the site to track the user has to be a distinct choice, not 'bundled' with any other (e.g. a check-box in the preferences).  Otherwise I fear that sites will say that merely by signing up you made that choice.  I would prefer it not even be a choice, I think, but I am open to debate.

Otherwise, what Jonathan has said holds - that if you set DNT, and not the preference (if any), then you'll need to interact directly with the third party before they will recognize you and track you. I don't think it's too bad; click on the button, and now it can track you, for example.

Treating me as someone you know, but about whom you *remember* nothing, is intriguing but (IMHO) excessively subtle.


David Singer
Multimedia and Software Standards, Apple Inc.