Re: [w3ctag/design-reviews] First-Party Sets (#342)

> The other abuse angle to this is data sharing between domains that are legitimately owned by the same organisation (in a legal sense of eg. an ultimate parent company controlling the orgs that have registered the domains) but where doing so would subvert end user expectations about how their data might be used.

Does the privacy policy of the website govern this data usage? I'm wondering if the two requirements to (a) surface group identity/association information; and (b) serve a common privacy policy address this?

> One example might be state-owned enterprises, where a government could have a controlling interest in organisations across a variety of different sectors, and may put them all into a valid FPS and thus be able to track users between them. Common branding in this case might also be expected by the user but identity tracking or other data sharing remains undesirable. Another might be an individual has a controlling interest in a variety of organisations in different sectors, and because of the way company ownership is defined in the relevant jurisdiction can legitimately (in a legal sense) put them in an FPS, which would pass vetting by the enforcement entity, but still result in a tracking network that is harmful to users.
> 
> Other alternate company structures I'm thinking about are things like co-operatives which might be owned equally by members. Domains registered by the co-op can be in the same FPS but be used for a variety of purposes and result in harmful tracking.

Thank you! I don't have an answer for handling this right now, but I've captured it in privacycg/first-party-sets/issues/75

> I'm sure I saw or heard mention of a maximum set size at some point, but can't find that now. What is your current thinking on a reasonable maximum set size? 

This is still an open issue: privacycg/first-party-sets/issues/29



-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3ctag/design-reviews/issues/342#issuecomment-973319015