W3C home > Mailing lists > Public > public-tracking@w3.org > October 2012

Re: Third-Party Web Tracking: Policy and Technology Paper outlining harms of tracking

From: David Wainberg <david@networkadvertising.org>
Date: Tue, 16 Oct 2012 12:46:26 -0400
Message-ID: <507D8F62.2090804@networkadvertising.org>
To: Rigo Wenning <rigo@w3.org>
CC: public-tracking@w3.org, Alan Chapell <achapell@chapellassociates.com>, Shane Wiley <wileys@yahoo-inc.com>, Vincent Toubiana <v.toubiana@free.fr>, Jeffrey Chester <jeff@democraticmedia.org>, Jonathan Mayer <jmayer@stanford.edu>

On 10/16/12 9:48 AM, Rigo Wenning wrote:
> We solve the problem of unauthorized making and access to a dossier
> made of more than one data item. There are parallels.
So, this is getting more specific: "a dossier of more than one data 
item." Can you elaborate? Why is it only more than one item? Is there a 
small number that is also acceptable, such as 3 or 5? Is there a time 
element? This sounds like the type of specific problem for which we 
might be able to tailor a solution.
> Users today make a risk judgment about the potential abuse of their
> data. The common opinion is that once it is out, data will be
> abused. The limits only lie within the creativity of the folks
> abusing the data. Conclusion: don't give them data.
There is little to no basis for this very broad statement. That is why 
we need to zero in on specific issues and real-world risks.

>> Vincent recently raised one specific case -- access to server
>> logs in a civil legal proceeding -- which is very helpful for
>> discussion. It can help us to zero on the specific problems that
>> are applicable, and then focus on specific, reasonable solutions
>> to those problems. I'm truly baffled by the reluctance to do more
>> of this.
> Sure, retention times in one of those. If you have a certain k-
> anonymity and a certain effort to de-anonymize, the risk is
> mitigated and we can go back to the user and tell them that their
> fears are not justified. It is all about making trust for the market
> place...
Again, this is an over-broad statement. It's hard to say without talking 
about specific data and specific risks whether k-anonymity is the needed 
solution. For the type of data most 3rd party advertising companies 
hold, k-anonymity is infeasible and unnecessary. Can you point to a real 
risk applicable to particular data that counters this position? No one 
has done so yet.
> So yes, I agree. We have business needs and consumer fears. And we
> need to navigate in that matrix, also for the permitted uses.

Received on Tuesday, 16 October 2012 16:46:55 UTC

This archive was generated by hypermail 2.3.1 : Friday, 3 November 2017 21:44:58 UTC