Re: Poll text call: final text by 28 September

Fred,

Perhaps I missed it before when I asked the first time (apologies if I did miss it), but it would be helpful to understand your affiliation and representation to this forum/initiative.  Would you be so kind as to introduce yourself to the working group and point out your affiliation and it's constituency?  It's always good to understand who's "speaking" and who they represent.

With respect to your input on industry attribution metrics, that's your opinion (and that's fine), but I disagree.

Thanks,

Chris Mejia, IAB & DAA


From: Fred Andrews <fredandw@live.com<mailto:fredandw@live.com>>
Date: Tuesday, October 2, 2012 5:16 PM
To: Chris Mejia - IAB <chris.mejia@iab.net<mailto:chris.mejia@iab.net>>, Jeffrey Chester <jeff@democraticmedia.org<mailto:jeff@democraticmedia.org>>
Cc: W3C DNT Working Group Mailing List <public-tracking@w3.org<mailto:public-tracking@w3.org>>
Subject: RE: Poll text call: final text by 28 September

Chris,

If 'industry attribution metrics' are collecting mouse movements and page visibility and page rending details from the user agent then this would most certainly qualify as data collection under DNT.  Further it would not qualify for a permitted use: 6.1.2.5 "A third party may only collect, use, and retain for permitted uses information that a user agent necessarily shares with a web server when it communicates with the web server...".  Mouse movement and page rendering would hardly qualify as 'necessarily shares' - this is state covertly leaked.  If a user has expressed DNT:1 then 'industry attribution metrics' implemented by a third party are definitely not permitted.

The difference is that in this case users can probably take control by securing their UA with an extension that blocks 'industry attribution metrics' so they may not need to depend on DNT being respected.

cheers
Fred

________________________________
From: chris.mejia@iab.net<mailto:chris.mejia@iab.net>
To: jeff@democraticmedia.org<mailto:jeff@democraticmedia.org>
CC: aleecia@aleecia.com<mailto:aleecia@aleecia.com>; public-tracking@w3.org<mailto:public-tracking@w3.org>; john@consumerwatchdog.org<mailto:john@consumerwatchdog.org>; mike@iab.net<mailto:mike@iab.net>
Date: Tue, 2 Oct 2012 14:31:04 +0000
Subject: Re: Poll text call: final text by 28 September

Jeff,

It appears that you are conflating industry attribution metrics with ad targeting technologies. The "viewable ad impression" technology is only to understand if the ad that was served renders itself within the open browser window on the screen.  The initiative aims to fix a longstanding issue with digital advertising (that was based on legacy technology shortcomings), which is that some ads are never rendered on the screen, yet paid for.  Understandably, marketers want to pay for ads that are viewable.  Ads that are not "viewable" are those that are served down on the page "below the fold" (the user never scrolls them into view) or killed by ad blockers, etc.  This technology advancement has nothing to do with DNT.

Regards,

Chris

Chris Mejia, IAB & DAA

On Sep 30, 2012, at 6:24 PM, "Jeffrey Chester" <jeff@democraticmedia.org<mailto:jeff@democraticmedia.org>> wrote:

Aleecia:

I think the emergence of so-called viewable impressions and how they are used for targeting, such as the 3MS initiative
 involving IAB, Google, Yahoo, Facebook and many others raises new questions about the role research plays in the tracking/targeting function:http://www.measurementnow.net/benefits.html; for member list:  http://www.measurementnow.net/whos-involved.html

We need to understand how recent developments in measurement will be impacted for those users wishing to use DNT:1
I also was not at Boston, which likely did not have much NGO participation at the time with the group.  So I look forward to hear on this list and at the f2f about the relationship of viewable impressions, etc.


Thanks,

Jeff




Jeffrey Chester
Center for Digital Democracy
1621 Connecticut Ave, NW, Suite 550
Washington, DC 20009
www.democraticmedia.org<http://www.democraticmedia.org>
www.digitalads.org<http://www.digitalads.org>
202-986-2220

On Sep 30, 2012, at 12:45 PM, John Simpson wrote:

Thank you, Aleecia.  I was not at at the F2F in Boston, joining the group in October, so I wasn't aware of this conversation.  I drew my definite two-week retention limit based on my analogy to the workplace I mentioned and also the fact that it was the protocol retention limit proposed in the EFF/Mozilla/Stanford proposal.

I thought it was still under active consideration by a significant number of members in the WG and thought it should be included as an option for that reason.  If you believe the group generally has moved past that point and that the two options you offer provide the best opportunity for reaching consensus, I can *live* with that.

Cheers,
John


----------
John M. Simpson
Consumer Advocate
Consumer Watchdog
2701 Ocean Park Blvd., Suite 112
Santa Monica, CA,90405
Tel: 310-392-7041
Cell: 310-292-1902
www.ConsumerWatchdog.org<http://www.ConsumerWatchdog.org/>
john@consumerwatchdog.org<mailto:john@consumerwatchdog.org>

On Sep 29, 2012, at 10:25 PM, Aleecia M. McDonald wrote:

Hi John,

Thank you for your suggested new text before the deadline.

While we can add this as an option, I would like to remind you that in Boston we heard that aggregate reports of one month spans are an exceedingly common use case for this data. The rationale for six weeks was to add some extra time beyond a rolling four week period, just in case something needs to be re-run or otherwise needs a little extra time. During our discussions in Boston, I remember Peter being able to live with six weeks as reasonable for privacy, and many in industry able to live with six weeks as reasonable time for processing. We were exceedingly close to consensus on this point.

Two weeks' notice for leaving a job is an interesting concept, but is also a cultural construct. I hear that in some European countries, 3 or 6 months' notice is common. I am not convinced this is a relevant metric for our work here on log files.

If you have new information to present to the group with substantive reasons for why two weeks rather than six weeks, this would be a good time to discuss that information.

Aleecia


On Sep 28, 2012, at 4:13 PM, John Simpson <john@consumerwatchdog.org<mailto:john@consumerwatchdog.org>> wrote:

Sure, David.

As I understand it what we're talking about here are log files and that sort of thing that are passively collected with any Internet transaction.  If DNT is enabled they ought not be retained in unidentifiable form.  The question: What is a reasonable time frame for that?

I came up with two weeks based on an analogy to the sort of common workplace understanding about leaving a job.  You give two weeks notice when you quit. You give the boss two weeks two get things in order upon your departure.  Here the user  is giving the server two weeks notice to get things in order to honor his or her explicit preference about not being tracked.


Best,
John

----------
John M. Simpson
Consumer Advocate
Consumer Watchdog
2701 Ocean Park Blvd., Suite 112
Santa Monica, CA,90405
Tel: 310-392-7041
Cell: 310-292-1902
www.ConsumerWatchdog.org<http://www.consumerwatchdog.org/>
john@consumerwatchdog.org<mailto:john@consumerwatchdog.org>

On Sep 28, 2012, at 3:49 PM, David Wainberg wrote:

John,

It might be helpful to provide your basis for suggesting the two week period as a viable option.

-David


On 9/28/12 6:33 PM, John Simpson wrote:
Aleecia,

I would offer this option:

Option 3:

Operators MAY retain data related to a communication in a third-party context for up to TWO weeks. During this time, operators may render data unlinkable (as described above) or perform processing of the data for any of the other permitted uses

----------
John M. Simpson
Consumer Advocate
Consumer Watchdog
2701 Ocean Park Blvd., Suite 112
Santa Monica, CA,90405
Tel: 310-392-7041
Cell: 310-292-1902
www.ConsumerWatchdog.org<http://www.consumerwatchdog.org/>
john@consumerwatchdog.org<mailto:john@consumerwatchdog.org>

On Sep 28, 2012, at 3:12 PM, David Wainberg wrote:

Aleecia,

In reviewing this to provide feedback, it occurs to me that it relies on the definition of unlinkable, which is still very much up for debate. How can companies weigh in on these options without understanding what the requirements actually are? We should postpone this poll until we define unlinkable so that companies can give realistic feedback regarding the time and effort needed to meet the requirements.

Thanks,

David


On 9/25/12 6:20 PM, Aleecia M. McDonald wrote:
>From the call on 12 September, we discussed topics where we have increasing clarity on options for permitted uses. I want to make sure we have the text right to reflect our options prior to doing a decision process with a poll calling for objections, which is responsive to Ian's feedback. We also want to move quickly, as Roy suggests.

Please propose specific alternative text if you believe that the two texts given below do not reflect the options before us by Friday, 28 September. We will briefly review these texts on the call tomorrow, just to make sure no one misses anything, and here we are on the mailing list, for those who cannot make the call.

Aleecia

-----
Log files: issue-134
----

This normative text fits into the section on Third Party Compliance, subsection 6.1.1.1, Short Term Collection and Use, <http://www.w3.org/2011/tracking-protection/drafts/tracking-compliance.html#short-term>. We will also want non-normative text, and have some suggested, but that will be clearer once we have the normative text settled. (Options for definitions of unlinkable data are in section 3.6, Unlinkable Data, <http://www.w3.org/2011/tracking-protection/drafts/tracking-compliance.html#def-unlinkable>.)

Option 1:
Operators MAY retain data related to a communication in a third-party context for up to 6 weeks. During this time, operators may render data unlinkable (as described above) or perform processing of the data for any of the other permitted uses.

Option 2:
Operators MAY retain data related to a communication in a third-party context. They MUST provide public transparency of their data retention period, which MUST have a specific time period (e.g. not infinite or indefinite.) During this time, operators may render data unlinkable (as described above) or perform processing of the data for any of the other permitted uses.