Re: ACTION-267 - Propose first/third party definitions from existing DAA documents

Dear all,

to add some European flavour, here what we use in our OBA Framework, matching European law. We call First Parties "Web Site Operators". W3C can of course use this wording, we have the full rights to it.


Third Party

An entity is a Third Party to the extent that it engages in Online Behavioural Advertising on a web site or web sites other than a web site or web sites it or a an entity under Common Control owns or operates.


Web Site Operator

A Web Site Operator is the owner, controller or operator of the web site with which the web user interacts.


Control

Control of an entity means that another entity (1) holds a majority of the voting rights in it, or (2) is a member of it and has the right to appoint or remove a majority of its board of directors, or (3) is a member of it and controls alone, pursuant to an agreement with other members, a majority of the voting rights in it, or (4) has placed obligations upon or otherwise controls the policies or activities of it by way of a legally binding contract, or (5) otherwise has the power to exercise a controlling influence over the management, policies or activities of it, and “Controlled” shall be construed accordingly.


Common Control

Entities or web sites under Common Control include ones which Control, for example parent companies, are Controlled by, such as subsidiaries, or are under common Control, such as group companies. They also include entities that are under a written agreement to process data for the controlling entity or entities, and do such processing only for and on behalf of that entity or entities and not for their own purposes or on their own behalf.


For other UA, we capture them through the following wording:

To the extent that Companies collect and use data via specific technologies or practices that are intended to harvest data from all or substantially all URLs traversed by a particular computer or device across multiple web domains and use such data for OBA, they should first obtain Explicit Consent.

Kind regards,
Kimon

From: Rachel Thomas <RThomas@the-dma.org<mailto:RThomas@the-dma.org>>
Date: Wednesday 10 October 2012 16:48
To: Craig Spiezle <craigs@otalliance.org<mailto:craigs@otalliance.org>>, "public-tracking@w3.org<mailto:public-tracking@w3.org>" <public-tracking@w3.org<mailto:public-tracking@w3.org>>
Subject: RE: ACTION-267 - Propose first/third party definitions from existing DAA documents
Resent-From: <public-tracking@w3.org<mailto:public-tracking@w3.org>>
Resent-Date: Wednesday 10 October 2012 16:43

Hi Craig, great question – let me try to clarify with some additional info from the DAA principles.  Below is the definition of “affiliate” as well as some commentary on the definition from the DAA’s Self-Regulatory Principles for Online Behavioral Advertising.  (Also, please note that while there is not an explicit definition of “affiliate” included in the DAA’s Self-Regulatory Principles for Multi-Site Data, the same definition applies in that context as well).


AFFILIATE



Definition: An Affiliate is an entity that Controls, is Controlled by, or is under common Control with, another entity.



Commentary (relating to definitions of both “affiliate” and “control”): These terms set an objective test to separate related First Party entities from Third Parties and others. An Affiliate is defined as an entity that Controls, is Controlled by, or is under common Control with, another entity. The definition of Control sets out two alternative tests, which reflect a commonly understood definition of a single entity. The first alternative looks to whether one entity is under significant common ownership with the other entity. The second alternative looks to whether one entity has the power to exercise a controlling influence over the management or policies of the other. In addition, each entity must be subject to Online Behavioral Advertising policies that are not materially inconsistent with the other entity’s Online Behavioral Advertising policies. The combination of Control and governance by similar Online Behavioral Advertising policies renders the two entities Affiliates of each other.



The tests for Control are unrelated to brand names. As a result, different brands, if they otherwise meet one of the tests for Control, would be treated as Affiliates rather than Third Parties.



The starting point for whether two or more affiliated consumer-facing Web sites constitute a First Party under the Principles is whether the Web sites are the same company. The use of the term Affiliate is intended to allow affiliated companies that are in the same corporate family to share information within that family as if they are the same company, thereby benefitting from their collective assets. The treatment of Affiliates is not intended to create a means for companies that are in reality unrelated in corporate structure (and, therefore, that consumers would never expect would be sharing information,) to avoid providing the choice required under these Principles. In many cases companies can readily be transparent either in branding on the Web sites or through clarity in the privacy notices of their particular Affiliates. Assuming an entity otherwise meets the standard set forth in the definition of Control, such practices would clearly satisfy and permit inclusion in the definition of Affiliate. However, such branding on a Web site or inclusion in a privacy notice is not required under the Principles as in some instances the complexity of corporate affiliates driven by corporate legal principles pose practical operational challenges.

And very best,
Rachel



From: Craig Spiezle [mailto:craigs@otalliance.org]
Sent: Tuesday, October 09, 2012 11:58 PM
To: Rachel Thomas; public-tracking@w3.org<mailto:public-tracking@w3.org>
Subject: RE: ACTION-267 - Propose first/third party definitions from existing DAA documents

This is helpful.

Just so we are all on the same page can you clarify affiliate vs. non-affiliate.   Is it correct to assume affiliate means a wholly owned entity?

So a Third Party who collects data from an affiliate is not a third party.  So this would or could mean a totally separate brand which the user has no knowledge of?

Thanks

From: Rachel Thomas [mailto:RThomas@the-dma.org]<mailto:[mailto:RThomas@the-dma.org]>
Sent: Tuesday, October 09, 2012 1:16 PM
To: public-tracking@w3.org<mailto:public-tracking@w3.org>
Subject: ACTION-267 - Propose first/third party definitions from existing DAA documents

Folks – As promised, I am submitting the Digital Advertising Alliance (DAA) definitions of “first party” and “third party” for consideration / inclusion in section 3.5<http://www.w3.org/2011/tracking-protection/drafts/tracking-compliance.html#first-third-parties> (“First and Third Parties”) of the W3C TPWG "Tracking Compliance and Scope” document.  Below are both formal definitions and related commentary from the DAA Self-Regulatory Principles for Multi-Site Data<https://www.aboutads.info/resource/download/Multi-Site-Data-Principles.pdf>.


FIRST PARTY


Definition: A First Party is the entity that is the owner of the Web site or has Control over the Web site with which the consumer interacts and its Affiliates.

Commentary: The actions of agents and other entities that similarly perform business operations of First Parties are treated as if they stand in the shoes of First Parties under these Principles and thus such actions are not included in Multi-Site Data.



THIRD PARTY


Definition: An entity is a Third Party to the extent that it collects Multi-Site Data on a non-Affiliate’s Web site.

Commentary:  As described in the OBA Principles, in certain situations where it is clear that the consumer is interacting with a portion of a Web site that is being operated by a different entity than the owner of the Web site, the different entity would not be a Third Party for purposes of the Principles, because the consumer would reasonably understand the nature of the direct interaction with that entity. The situation where this occurs most frequently today is where an entity through a “widget” or “video player” enables content on a Web site and it is clear that such content and that portion of the Web sites is provided by the other entity and not the First Party Web site. The other entity (e.g. the “widget” or “video player”) is directly interacting with the consumer and, from the consumer’s perspective, acting as a First Party. Thus, it is unnecessary to apply to these activities the Principles governing data collection and use by Third Parties with which the consumer is not directly interacting.

Very best,
Rachel

Rachel Nyswander Thomas
Vice President, Government Affairs
Direct Marketing Association
(202) 861-2443 office
(202) 560-2335 cell
rthomas@the-dma.org<mailto:rthomas@the-dma.org>

Join us at DMA2012 Conference and Exhibition
The Global Event for Real-Time Marketers
October 13-18, 2012 | Las Vegas, NV
Register NOW & SAVE up to $200 |www.dma12.org<http://www.dma12.org>