Re: TPE sec 6.11 on clearing granted exceptions

(Might not have responded to these points before when the thread title was changed.)

On Apr 26, 2013, at 1:31 AM, "Roy T. Fielding" <fielding@gbiv.com> wrote:

> On Apr 25, 2013, at 4:40 PM, Nicholas Doty wrote:
> 
>> I think in-band user-granted exceptions have at least two advantages over use of cookies in storing exception consent:
>> * DNT:0 can be sent even when there is no cookie or cookies are not sent
> If a
> user agent is not sending any cookies, sending DNT:0 is not going
> to help much.

We had a specific request (last June in Seattle) from companies like Google that it would be useful to receive DNT:0 even in contexts (like a Safari user loading a doubleclick ad) where cookies wouldn't be sent by the browser's cookie policy. It might be that services would use tracking based on other mechanisms (fingerprinting, say) in those situations, or that they would respond with a Set-Cookie header and certain browser implementations would store the header when it was in response to a request with DNT:0.

>> I think perhaps the SHOULD text is a little too specific; browsers are taking different approaches to clearing client-side state and while I think there probably always should be an option to clear all client-side state simultaneously, there will also very likely be implementations that clear cookies or other caches separately. I think the general principle of clearing state set and then subsequently accessible by JavaScript is an important one, and worth noting in the spec.
>> 
>> That would be a third advantage for using in-band exceptions: exceptions may be retained when a user chooses to clear cookies but not other client-side state.
>> 
>> Thanks,
>> Nick
> 
> I don't think I was clear.  Currently, the only advantage the UGE
> framework has is that it doesn't get cleared when cookies get cleared.
> If that isn't true, we should delete the entire framework and replace
> it with a named cookie that is sent along with the DNT:1 signal.
> Then we wouldn't have to wait until all browsers implement UGEs
> and we wouldn't have to implement two different opt-in consent
> mechanisms.

I believe there are other advantages beyond just persistence beyond cookies. (Users can configure their agents to control consent; users can manage all exceptions in a single place; first parties can make requests to change DNT communication to third parties without relying on non-standard means; third parties don't have to second guess signals.)

That being said, I do think persistence could be one advantage, since browsers often distinguish for users different kinds of clearing local state. Based on my understanding of the direction browsers are headed, it's likely that a "clear cookies" button wouldn't clear user-granted exceptions, but that a "clear all caches and site preferences" button would. (Hence my support for updating this section's text to be less specific.)

—Nick

Received on Saturday, 27 April 2013 00:26:04 UTC