Minimal Support for Definitions of ‘Tracking,’ ‘Party’ in DNT Working Group Poll

The World Wide Web Consortium-backed group is trying to conclude its work on a technical preference expression (TPE) document before deciding whether to move to a compliance document (CD Nov 21 p16). The surveys -- the group’s first attempt at closing out issues since shifting its strategy -- indicate resistance remains to moving any definitions over from the compliance specification.

Working group members objected to the “tracking” definitions for a host of reasons: Too broad, too narrow, too vague, overly reliant on undefined terms, unnecessary, incomprehensible to a lay audience. The first option focused on data collection and context: “Tracking is the collection of data regarding a particular user’s activity across multiple distinct contexts and the retention, use, or sharing of data derived from that activity outside the context in which it occurred.” The second option was slightly more concise and focused on data retention and use: “In general terms, tracking is the retention or use after a network transaction is complete, or sharing, of data that is, or can be, associated with a specific user, user agent, or device."

Eleven members voted against the first definition, while two voted in favor. “It is really just a punt to another misunderstood and not agreed upon term, ‘context,'” wrote KBM Group Chief Privacy Officer Brooks Dobbs in opposition. “It’s probably not comprehensible to users,” wrote Apple Embedded Media Director David Singer. The reference to “data derived” is “over-broad [sic] in that it could include data and data uses that should not reasonably fall within the definition of tracking, including, for example, aggregate data, or other data that is not tracking data,” wrote David Wainberg, National Advertising Initiative counsel.

"Objecting to this definition because you don’t like relying on undefined terms is nothing more than a delaying tactic,” wrote Adobe Principal Scientist Roy Fielding, who authored the definition. “The reason context is not defined as part of this definition is because the scope of what a user considers to be same-context is an orthogonal question,” an isolated or unrelated issue, Fielding wrote. Microsoft supported either the first or second definition “to help define use and retention approaches for DNT, although we note that option A may be slightly easier for nontechnical readers to comprehend,” wrote Director of Logistics Amy Colando.

Nine members objected to the second tracking definition, while three expressed support, “no objection,” or “I could probably live with this definition.” Baycloud Systems Chief Technology Officer Mike O'Neill was the one full support vote. Consumer Watchdog Privacy Project Director John Simpson, who said he “could probably live” with option two, added, “I think the Working Group would be best served if we avoided trying to define Tracking.” Dobbs, writing in opposition, said the second definition “appears to be saying tracking is X unless somewhere else we say it isn’t, but we don’t have that somewhere else done yet.” Fielding, author of the first definition, objected to definition two “because it includes any retention of personal data, including that by first party sites,” he wrote. In some instances -- such as online banking or a Flickr account -- people might want some data retained, he wrote.

Of the two definitions offered for “party,” only one received notable support. Critics derided the preferred definition for delineating the terms “first party” and “third party” within the definition. Doing so is outdated and anticompetitive, argued several respondents. “It needlessly, without a relevant privacy-related rationale, discriminates against small independent companies that are affiliated by means other than ownership, and that may have substantial privacy protections in place,” Wainberg wrote.

The definition’s strongest supporter, Yahoo Vice President-Privacy and Data Management Shane Wiley, said the differentiation “meets current expectations and understanding of these terms as used with self-regulatory standards and supports baseline concepts captured in most privacy laws around the globe.” Apple’s Singer didn’t object to the definition, but didn’t outright support it, suggesting clarifications instead. Colando indicated Microsoft might support the definition if “necessary clarifications” were added. “For example, the distinction between first and third party should rely on reasonable, objectively determined criteria, rather than subjective determination of a user’s intention,” she wrote.

The group’s chairs have to Dec. 11 to decide on a final definition for the two terms, if they want to produce a definition at all. Working group Co-Chairman Justin Brookman, director of the Center for Democracy & Technology’s Project on Consumer Privacy, did not give any indication of which way the chairs were leaning.