FW: ACTION-267 - Propose first/third party definitions from existing DAA documents

Rachel,

 

To make this intelligible to software components like user-agents or
regulatory audit scanners and the like, the "legal entity" responsible for
operating a web site or making decisions on whether it can record data
(track) will have to be declared. At the moment all we have is the host
domain name and this is the only way we have to transparently differentiate
3rd from 1st parties. To do the same under your definition we will need a
reference to the legal entity in the tracking resource or somewhere similar.

 

Mike

 

From: Rachel Thomas [mailto:RThomas@the-dma.org] 
Sent: 10 October 2012 15:48
To: Craig Spiezle; public-tracking@w3.org
Subject: RE: ACTION-267 - Propose first/third party definitions from
existing DAA documents

 

Hi Craig, great question - let me try to clarify with some additional info
from the DAA principles.  Below is the definition of "affiliate" as well as
some commentary on the definition from the DAA's Self-Regulatory Principles
for Online Behavioral Advertising.  (Also, please note that while there is
not an explicit definition of "affiliate" included in the DAA's
Self-Regulatory Principles for Multi-Site Data, the same definition applies
in that context as well).

 

AFFILIATE

 

Definition: An Affiliate is an entity that Controls, is Controlled by, or is
under common Control with, another entity.

 

Commentary (relating to definitions of both "affiliate" and "control"):
These terms set an objective test to separate related First Party entities
from Third Parties and others. An Affiliate is defined as an entity that
Controls, is Controlled by, or is under common Control with, another entity.
The definition of Control sets out two alternative tests, which reflect a
commonly understood definition of a single entity. The first alternative
looks to whether one entity is under significant common ownership with the
other entity. The second alternative looks to whether one entity has the
power to exercise a controlling influence over the management or policies of
the other. In addition, each entity must be subject to Online Behavioral
Advertising policies that are not materially inconsistent with the other
entity's Online Behavioral Advertising policies. The combination of Control
and governance by similar Online Behavioral Advertising policies renders the
two entities Affiliates of each other.  

 

The tests for Control are unrelated to brand names. As a result, different
brands, if they otherwise meet one of the tests for Control, would be
treated as Affiliates rather than Third Parties.

 

The starting point for whether two or more affiliated consumer-facing Web
sites constitute a First Party under the Principles is whether the Web sites
are the same company. The use of the term Affiliate is intended to allow
affiliated companies that are in the same corporate family to share
information within that family as if they are the same company, thereby
benefitting from their collective assets. The treatment of Affiliates is not
intended to create a means for companies that are in reality unrelated in
corporate structure (and, therefore, that consumers would never expect would
be sharing information,) to avoid providing the choice required under these
Principles. In many cases companies can readily be transparent either in
branding on the Web sites or through clarity in the privacy notices of their
particular Affiliates. Assuming an entity otherwise meets the standard set
forth in the definition of Control, such practices would clearly satisfy and
permit inclusion in the definition of Affiliate. However, such branding on a
Web site or inclusion in a privacy notice is not required under the
Principles as in some instances the complexity of corporate affiliates
driven by corporate legal principles pose practical operational challenges.

 

And very best,

Rachel

 

 

 

From: Craig Spiezle [mailto:craigs@otalliance.org] 
Sent: Tuesday, October 09, 2012 11:58 PM
To: Rachel Thomas; public-tracking@w3.org
Subject: RE: ACTION-267 - Propose first/third party definitions from
existing DAA documents

 

This is helpful.

 

Just so we are all on the same page can you clarify affiliate vs.
non-affiliate.   Is it correct to assume affiliate means a wholly owned
entity?

 

So a Third Party who collects data from an affiliate is not a third party.
So this would or could mean a totally separate brand which the user has no
knowledge of?  

 

Thanks 

 

From: Rachel Thomas [mailto:RThomas@the-dma.org] 
Sent: Tuesday, October 09, 2012 1:16 PM
To: public-tracking@w3.org
Subject: ACTION-267 - Propose first/third party definitions from existing
DAA documents

 

Folks - As promised, I am submitting the Digital Advertising Alliance (DAA)
definitions of "first party" and "third party" for consideration / inclusion
in section 3.5
<http://www.w3.org/2011/tracking-protection/drafts/tracking-compliance.html#
first-third-parties>  ("First and Third Parties") of the W3C TPWG "Tracking
Compliance and Scope" document.  Below are both formal definitions and
related commentary from the DAA Self-Regulatory Principles for Multi-Site
Data
<https://www.aboutads.info/resource/download/Multi-Site-Data-Principles.pdf>
.

 

FIRST PARTY

 

Definition: A First Party is the entity that is the owner of the Web site or
has Control over the Web site with which the consumer interacts and its
Affiliates. 

 

Commentary: The actions of agents and other entities that similarly perform
business operations of First Parties are treated as if they stand in the
shoes of First Parties under these Principles and thus such actions are not
included in Multi-Site Data.

 

THIRD PARTY

 

Definition: An entity is a Third Party to the extent that it collects
Multi-Site Data on a non-Affiliate's Web site.

 

Commentary:  As described in the OBA Principles, in certain situations where
it is clear that the consumer is interacting with a portion of a Web site
that is being operated by a different entity than the owner of the Web site,
the different entity would not be a Third Party for purposes of the
Principles, because the consumer would reasonably understand the nature of
the direct interaction with that entity. The situation where this occurs
most frequently today is where an entity through a "widget" or "video
player" enables content on a Web site and it is clear that such content and
that portion of the Web sites is provided by the other entity and not the
First Party Web site. The other entity (e.g. the "widget" or "video player")
is directly interacting with the consumer and, from the consumer's
perspective, acting as a First Party. Thus, it is unnecessary to apply to
these activities the Principles governing data collection and use by Third
Parties with which the consumer is not directly interacting. 

 

Very best,

Rachel

 

Rachel Nyswander Thomas

Vice President, Government Affairs

Direct Marketing Association

(202) 861-2443 office

(202) 560-2335 cell

 <mailto:rthomas@the-dma.org> rthomas@the-dma.org

 

Join us at DMA2012 Conference and Exhibition

The Global Event for Real-Time Marketers

October 13-18, 2012 | Las Vegas, NV

Register NOW & SAVE up to $200 |  <http://www.dma12.org> www.dma12.org