RE: issue-199

Mike,

I respectfully disagree.  Obfuscating the ID breaks the association with the actual user/device.  That said, I agree this has the risk of being reversed so a blend of technical, operational, and administrative controls must be brought to bear to keep this from occurring.

De-identification doesn’t allow for profiling in a manner that could affect a user’s experience (no way to get back to the user).

Do Not Track can be achieved by breaking the link between a unique ID and cross-site activity (URLs) – and this could result in a profile of the user’s interest resulting from aggregate scoring – but this would not allow a user’s historical activity to be retrieved.

- Shane

From: Mike O'Neill [mailto:michael.oneill@baycloud.com]
Sent: Wednesday, July 10, 2013 11:55 AM
To: Shane Wiley
Cc: public-tracking@w3.org
Subject: RE: issue-199

Hi Shane,

How can it be possible to remove the association between a device and a UID other than deleting it or ensuring it is deleted by the UA after a short duration. If the UID is there (and present in every transport level request if it is in a cookie) it uniquely points to the device where it is stored or derived. This identity is available to the receiving server as well as any actor with similar access to the data stream or the same document origin.

If you transform the UID in retained data by setting it to another UID (say by using a hash function), this does not break the association because there is a 1to1 mapping. There is no practical point in doing it.

De-identified data can only be classed as such if there is no linkage. The “yellow” state can be imagined as an intermediate stage before de-identification but is only relevant for permitted uses (such as the detection of unique visitors for analytics or frequency capping), and there is no need for it to exist for more than a few hours.

If we end up defining de-identified as including the ability to link individuals to a profile it would be a travesty, and people will see through it. The arms race has already started with an explosion of blunt cookie and script blockers. If there is not a sensible response to people’s real privacy concerns the usefulness of the web (and consequently the profitability of many business models) will be severely diminished.

Mike


From: Shane Wiley [mailto:wileys@yahoo-inc.com]
Sent: 09 July 2013 19:30
To: Mike O'Neill; 'achapell'; npdoty@w3.org<mailto:npdoty@w3.org>; tlr@w3.org<mailto:tlr@w3.org>
Cc: public-tracking@w3.org<mailto:public-tracking@w3.org>; jeff@democraticmedia.org<mailto:jeff@democraticmedia.org>
Subject: RE: issue-199

Mike,

Deidentification is about removing the association between a unique ID (any source:  cookie, digital fingerprint, etc.) and the actual/specific user/device.  In this context:

Red:  actual user/device
Yellow:  not actual user/device but events are linkable (and only usable for analytics/reporting)
Green:  not actual user/device and events are not linkable (outside the scope of DNT)

- Shane

From: Mike O'Neill [mailto:michael.oneill@baycloud.com]
Sent: Sunday, June 30, 2013 3:01 PM
To: 'achapell'; npdoty@w3.org<mailto:npdoty@w3.org>; tlr@w3.org<mailto:tlr@w3.org>
Cc: public-tracking@w3.org<mailto:public-tracking@w3.org>; jeff@democraticmedia.org<mailto:jeff@democraticmedia.org>
Subject: RE: issue-199

Alan,

Persistent identifiers and their duration should be discussed as part of the red/yellow/green permitted use debate. Browser fingerprinting identifiers are qualitatively different from those stored in cookies or localStorage because they are effectively infinite in duration, so I thought it best to extend the defs. to make that clear.


Mike


From: achapell [mailto:achapell@chapellassociates.com]
Sent: 30 June 2013 22:39
To: michael.oneill@baycloud.com<mailto:michael.oneill@baycloud.com>; npdoty@w3.org<mailto:npdoty@w3.org>; tlr@w3.org<mailto:tlr@w3.org>
Cc: public-tracking@w3.org<mailto:public-tracking@w3.org>; jeff@democraticmedia.org<mailto:jeff@democraticmedia.org>
Subject: RE: issue-199

Do we want to specify technologies here?


Cheers,

Alan Chapell
917 318 8440



-------- Original message --------
From: Mike O'Neill <michael.oneill@baycloud.com<mailto:michael.oneill@baycloud.com>>
Date: 06/30/2013 3:33 PM (GMT-05:00)
To: Nicholas Doty <npdoty@w3.org<mailto:npdoty@w3.org>>,tlr@w3.org
Cc: public-tracking@w3.org,jeff@democraticmedia.org<mailto:public-tracking@w3.org,jeff@democraticmedia.org>
Subject: issue-199

Nick, Thomas

Dr Dix’s letter reminded me that we need to have some reference to browser fingerprinting being ruled out when DNT is set. I have amended the definitions accordingly.

Do you want me to modify the wiki?



A persistent identifier is an arbitrary value held in, or derived from other data in, the user agent whose purpose is to identify the user agent in subsequent transactions to a particular web domain. It may be encoded for example as the name or value attribute of an HTTP cookie, as an item in localStorage or recorded in some way in the cache.

The duration of a persistent identifier is the maximum period of time it will be retained in the user agent. This could be implemented for example using the Expires or Max-Age attributes of an HTTP cookie so that it is automatically deleted by the user agent after the specified time period is exceeded.

Browser fingerprinting is a method of tracking based on creating a persistent identifier from other information either inherent in the content request or already stored in the user agent. Such an identifier may not need itself to be stored in the user-agent as it can be calculated again in subsequent transactions. It follows from this that its duration is effectively unlimited.

Justification.

With the duration definition, restrictions on permitted uses could then be made that limit the duration of persistent identifiers. Because browser fingerprinting cannot be given a finite duration this tracking method should not be used when DNT is set even if it is for a permitted use. In reality browser fingerprinting solely based on examining initial content requests is usually not an effective tracking method because the combination of IP addresses and other headers are not sufficiently user specific, but we should rule out at least the more complex form when DNT is set.
Mike