RE: Third-Party Web Tracking: Policy and Technology Paper outlining harms of tracking

Vincent,

I don't believe that's a valid use case for this particular situation for the following reasons:


*         No harm ever came to users

*         Following a market's Legal system should not be seen as a failure of DNT

*         This data would have fallen under 1st party rules (widget "meaningful interaction" after pressing the PLAY button)

Other examples?

- Shane

From: Vincent Toubiana [mailto:v.toubiana@free.fr]
Sent: Thursday, October 11, 2012 2:26 PM
To: Shane Wiley
Cc: Alan Chapell; Jeffrey Chester; public-tracking@w3.org; Jonathan Mayer
Subject: Re: Third-Party Web Tracking: Policy and Technology Paper outlining harms of tracking

On 10/11/2012 10:36 PM, Shane Wiley wrote:
Again - please help us understand real-world, tangible harms to consumers from the existence of data attached to pseudo/anonymous identifiers that is not used to directly alter a user's experience (no profiling/targeting).  We've discussed breach concerns and government intrusion but have no documented cases - are there others?

Thank you,
Shane

HI Shane and Alan,

I think I have another documented case: the Youtube vs Viacom where Youtube almost had to share pesudonymous data (including IP addresses) with Viacom. It is relevant because Youtube may act as a third party (i.e. an autostarting video embedded in an iframe, see Viacom claims below). Fortunately the two companies reached an agreement, but that was very close.
If I remeber correctly, Youtube might have been forced to disclose all logs, because IP addresses were (according to Google policy) not identifiable information. Unfortunately, Youtube kept a lot of data (12 terabytes) and a shorter retention period would have certainly helped.

How would that be translated in permitted uses? Ultimately to address this issue, there should be no log retention and no permitted uses. More realistically, I guess that anything that would result in a shorter retention period and data minimization would help in such case. That's how I interpret permitted uses: less data kept for a shorter period of time so that such data disclosure (while still being an issue) would have less dramatic effect. In the long term, these retention period should get even shorter if data scientist come up with scalable tools that can provide the same functionality with less data.

Please find below some reference to the Viacom vs Youtube (from  http://www.zdnet.com/blog/btl/youtube-vs-viacom-googles-ip-wins-users-lose/9242).

I hope this answers your question.


Vincent



Plaintiffs seek all data from the Logging database concerning each time a YouTube video has been viewed on the YouTube website or through embedding on a third-party website. They need the data to compare the attractiveness of allegedly infringing videos with that of non-infringing videos. A markedly higher proportion of infringing-video watching may bear on plaintiffs' vicarious liability claim, and defendants' substantial non-infringing use defense. Defendants argue generally that plaintiffs' request is unduly burdensome because producing the enormous amount of information in the Logging database (about 12 terabytes of data) "would be expensive and time-consuming, particularly in light of the need to examine the contents for privileged and work product material."

And.

Defendants argue that the data should not be disclosed because of the users' privacy concerns, saying that "Plaintiffs would likely be able to determine the viewing and video uploading habits of YouTube's users based on the user's login ID and the user's IP address". But defendants cite no authority barring them from disclosing such information in civil discovery proceedings, and their privacy concerns are speculative.