Meeting minutes
[Wendy review agenda for today]
Wendy: I saw a few comments that we not go into wider discussion today; may be more input to that
… people may want to focus on tech proposals and business use cases
… happy to take that input for today
… at a future meeting, see if we have shared agreement on the focus
… or if that develops from these conversations
… we have been working basically, taking proposals from participants
… the agenda is all of yours to shape with agenda requests and comments
… with that
… any other agenda thoughts today?
@: Please mute if you are not speaking
Wendy: and if in irc please "present+"
… starting off with introductions, do we have any new participants to the group who would like to introduce themselves?
@: Hello
Introductions
I'm Ben Humphry on behalf of IAB
… be that liaison for now
Wendy: Welcome, Ben
… anyone else?
Wendy: We now have more than 180 participants in the group
IDFA
Wendy: Valentino, you suggested we talk about IDFA
Valentino: after Apple released...changes for how IDFA works in their devices
… wondered if, from a tech perspective
… seems simple and solve the majority of the problems
… wondering it has never been explicitly stated
… why using an IDFA solution is not ok
… why this would not be acceptable for Chrome, Safari, Edge, or Firefox
… that they use a solution asking for user consent when tracking, effectively
hober: We consider addition of prompt for privacy
… adding IDFA equivalent would be a regression
… we are not planning to bring it, even with a prompt
Kleber: I agree with what Tess said
… identifier like what IDFA is, would be a privacy regression for the Web
… having global identifier at all would be worse state
… than cookies
… from Chrome's POV
… bears repeating
… user prompts are occasionally a useful tool
… but it is actually very hard to find times when the user prompt is the right answer to a user problem
… asking a user to say yes/no, there is huge obligation to make sure user knows what they are saying yes to
… implications are so varied
… don't think we found a way to make sure the user is well informed
… it is the wrong sort of question to ask the user if we can avoid it in any way
Alex, TechLab: I'm curious what your perspective
… for Tess and Michael
… that on fragmentation of privacy experiences for users
… My own POV to throw out there
… the more you make a diverging expectations for users, the less likely they are to know what is going on
… the less likely you know what is going on, the more fearful. you are
… I hear what you are saying in terms of regression
… but what about fragmentation, even across Apple products?
Wendy: Invite anyone who wants to respond to queue up
AramZS: I am find if folks want to respond
… the idea of this universal ID is very favored
… generally I think most users see their privacy situation as something negotiated with the page they are on
… and not across device, app, site experience in way it is now
… Working with publishers
… working with universal ID is counter-productive
… let browsers and app systems to decide
… but as we move to opt-in/opt-out experience, which I think is unavoidable from regulatory perspective
… have to be with entity in which they are interactive
… not all...publishers
… do think having this idea of universal ID is fundamentally taking it out of the control of the scope of that relationship
… that is for the worst for advertisers, publishers and users
… takes away ability for them to understand where data goes, who is responsible
… takes it out of their hands
… within this group
… that presents more of a problem than a solution
… not something we are interested to see moving forward, even anonymous or pseudo-anonymous ID system; does not seem like the way to go
<alextcone> on the record - I was not promoting a universal ID system. Just asking a UX question.
Ben, Facebook: Tess and Michael
… responding to your comments about regression of web platform, but step forward from app platform
… want to understand how to interpret
… this will converge on still more private place
… should we assume app world heads in same direction as web
… and eliminated for same reasons?
… and ID heads to dust bin?
… are there future radical changes?
… would be good to know about them more than two months out
Wendy: Thanks for info sharing
James: just an observation
… the CMA report talks about a common user identifier
… wanted to let group know about that
… and perhaps consider presenting the report
<hober> I had queued to simply say that Apple does not comment on future plans or product releases.
Wendy: please mute if you are not speaking
… lots of people on the call
<AramZS> Can you link that report please for the minutes?
Wendy: as Tess notes, Apple does not comment on future plans
Bleparmentier: should we understand that the GID
… is also going to disappear?
… is all what we are doing going to apply to the apps world, or is it separate issue?
Kleber: Tess said Apple doesn't comment on future plans
… i cannot comment on future plans of Android
… Chrome and Chromium project is extremely open source development
… before we start writing any code
… we publish a document about the long-term vision for where we think this idea is going
<jrosewell> Karen : for the minutes the report is the CMA report url here - https://assets.publishing.service.gov.uk/media/5efc57ed3a6f4023d242ed56/Final_report_1_July_2020_.pdf
<joshua_koran> Here is the CMA report that recommends a Common ID to address challenges of competition and to help smaller organizations compete with larger ones
Kleber: so people can plan reasonably far ahead
<joshua_koran> https://assets.publishing.service.gov.uk/media/5d03667d40f0b609ad3158c3/audit_final_report_02.pdf
Kleber: more open than other software platforms, including Android and iOS
… the more we figure out way for web to work in absence of identifiers
… this can inform what any other platforms decide to do in the future
<bleparmentier> Thx for the answer
Wendy: Thanks, that also relates back to the overall project here
… we have heard a lot about the interests in removing cross-site tracking vectors in the web
… and offering substitutes and
… non-individually identifying measurement opps through the APIs
… primary focus is the web
… to the extent that those insights are useful on other platforms
… or crosses between web and app platform
… the proposals and alternatives may be useful for those contacts as well
wbaker: Following up on Verizon Media viewpoint
… we have had a lot of discussion at our offices
… how to go build next generation web
… we know where the web is going
… browsers have been extremely clear
… people in our office look for ways for old systems to persis
… our job is to work the new APIs
… safe harbor...across browser version releases
… provides the guarantees that we want to see
… we have knowledge about what that safe harbor is
… kudos to Facebook for publishing
… also on GitHub
<wseltzer> https://github.com/w3c/web-advertising/blob/master/support_for_advertising_use_cases.md
wbaker: some our easy, some are beyond research -- aspirational values and capabilities
… sooner than later someone will figure out how to build it
… this group is to figure how to make it work in a vialble way
… we're in 8 and 9 in stack
… needs to be commercially viable
… our job is to use the safe harbor API
… and what the manufacturers want
Wendy: Thank you, Wendell
… thanks for inviting that discussion
Danny: So, thank you very much
… and thank you for the conversation
… two presumptions here that have been stated
… a potential global identifier is off the table because they consider it a regression in privacy protection
… the second assumption
… ability to ID an individual lies in first party
… but I don't think there is consensus across all segments
… California law...
… consumer cannot engage with vendor
… cannot understand cross-site tracking is hard to accept
… I don't agree with it; don't think there has been enough research on it
… I would argue if you had a regulated global ID
<marguin> Should let Danny know to use irc to add himself to the queue instead of the raise hand feature of webex (or conversely, check webex for raised hands?)
Danny: you could make a lot of progress on privacy
… the largest fines have been for privacy violations on first parties
… understand that those assumptions are not consensus-based assumptions
Wendy: If you are trying to raise a hand in webex, I am looking more at irc
… anyone else?
… I think we are hearing from the web browsers
… that as user agents, they don't see their role to facilitate cross-site tracking
… if folks want to persuade them that users want something different
… that that is a plausible direction for conversation
… but the way the web develops
… what folks want to implement and use and develop
James: I appreciate what Danny just said
… there is a problem around "folks"
… who are the folks and who gets to decide it
… the W3C has a broad group of stakeholders to consider, not just the browser vendors
… that doesn't seem to be how the W3C is working in practice
… I have some concerns and this is not the venue to address
… my observation as a newbe over the last few months
Wendy: Thank
… we are getting more input from different people on these calls
… getting input from lots of different stakeholders
… when it gets to be a W3C chartered Working Group
… it needs to go for consensus
… and any stakeholder may raise an objection
… and any objection must be met with reasoned discussion
… before W3C can make a Recommendation
… Consensus is part of the Recommendation process
… Here we are in discussions
… we are hearing the browsers are not inclined to add more cross-site tracking to the web
… that is not a veto
… it is not something they are seeing their customers demanding
… that is potentially suggesting
… if we try to recommend that through the working group process, it would be met with objections
… it is good to get the heads-up in the process if that is not of interset
Ben: So I wanted to.. while on topic of Safari and iOS changes
… changes are broader than access to IDFA
… relates to tracking in general
… not strictly IDFA
… it makes it seem like advertising use cases that we have documented are not feasible
… Apps that show ads in native apps and clicking on ad takes you to a web site
… used in many applications [names]
… at present there is no privacy preserving solution
… SKAdNetwork works for app-to-app and Private Click Measurement works for web-to-web
… no privacy preserving solution to measure the aggregate count of number of conversions
… of app to web advertising
… Safari is not supporting advetising
… and this is a ban to some extent
… by virtue of making critical advertising use cases impossible
AramZS: so I have a question
… the IDFA discussion is super interesting as it represents some of the pieces of thought around how we approach web advertising
… forgive me if I am mistaken
… it's a app based feature
… and this is not an app focused group?
… I don't think W3C contributes guidance on how private companies run their app stores and operating systems
… I am interested in discussing IDFA as example of the wider web
… I am not interested in just discussing it on our own
… I don't think we have the right people here or interest
… Not sure if Apple people are taking this back to their iOS teams...am I incorrect?
Wendy: Ask Ben to say why raising it here?
Ben: WebKit platform renders WK Web view
… and use various types of measurement
… private click measurement is one of the options to use
… I find this App/Web discuss extremely frustrating because it doesn't align to advertising
… as we relate business use cases, there is no wall
… if we change the WebKit platform without considering all but one type of use case
… as BG talking about web and app
… if this is not right place, what forum is there to talk about advertising use cases that span app and web
… I put in a bug report
… sounds like there is no place for this discussion
<bleparmentier> +1 Ben
<alextcone> +1 Ben
Wendy: I have closed queue after current people
<joshua_koran> +1 Ben
Wendy: Apps use web technologies for that reason
<jrosewell> +1 Ben
Wendy: a part of the discussion is well in scope
… I don't see this as forbidden
… do we have the right people here to help think through the responses
James: to add another interface with web and app, there is the network as well
… and how web browser talks to network
… which generally comes under pervue of IETF
<alextcone> Ben, I will say that while we do not control device and OS manufacture at Tech Lab, we absolutely want to convene voices about cross channel approaches to predictable privacy and expected addressability.
James: might provide a model to answer the excellent question from Ben
Alex: I would like to +1 Dan
… agree with Aram we don't have people to answer problems of app-based world
… Ben is spot on that we should be talking about user's journey
… I am looking at three devices with different content forms
… how do we progress for more privacy for user
… where each individual experience has different experiences and practices
… which may happen with the web
… how can this possibly be better for users
… I am not being an advocate for universal ID
… but asking question of how to get to better user expereinces
… and not just seeing proprietary experiences and utility app manufacturer
<joshua_koran> +1 Alex - how does this further One Web?
Wendy: These sounds like good conversations to have in the Privacy Interest Group (PING)
Kris: I do think this is the appropriate area to talk about web adv and in-app adv
… change to on-line advertising
… when advertisers are advertising online
… they use data from web, apps
… from user experience, this is very blended
… keeping that separate
… understand some folks only deal with web adv, but don't think that is only focus
<alextcone> Josh, like I said to Ben S, while Tech Lab doesn't have the control over device and OS and utility apps that are represented here, we all the same want to be a place where we can think across distribution channel.
Aram: I definitely agree with Ben there needs to be a venue to discuss these things
… not so sure it is
… excuse me I am getting this wrong; the IDFA stuff and APp stuff is OS level decision
… not necessarily a web decision
… I am very sympathetic to realities of why one wants to be in app store
… if this change diverts from example we set on web
… if web were to support more business friendly options
… then poss remove oneself from building app in the long-run
… we have that ability on the web
… they are useful in that regard
… the Apple app store does not...we would see a more competitive marketplace
… anyone can make choice to not build an app on a particular platform
… we all by necessity exist on the web
… and decisions we make inform the app-level decisions
… not sure if this is right place to do it; agree with Ben, maybe not right place
… just want to be clear on my perspective; I want to use my time most effectively in this group
<blassey> would spinning up an app advertising BG make sense?
<jrosewell> blassey: I'd rather not. There are already too many groups, documents, processes, threads, etc to follow ;-)
Aram: not sure operating system features discussion is best use of time
… leave that to the consensus building part of the agenda
<Chapell> +1 Alex - also, keeping things separate can get complicated. Do users understand that their data may be shared across multiple devices and contexts as they move from Youtube App to Maps App to Google searches on Chrome?
Wendy: That is the end of this subject for now
SPARROW reporting proposal
<wseltzer> https://github.com/WICG/sparrow/blob/master/Reporting_in_SPARROW.md
SPARROW
Wendy: talk about SPARROW reporting propsosal
bleparmentier: :
bleparmentier: reporting proposal
… remind why we proposed these changes
… and also discuss in terms of how we can go forward and have a smart, constructive debate on technical subjects
… many too many people to discuss it
… or maybe we schedule three or four future focused discussions
… maybe next Thursday we can discuss it
… Michael maybe you can confirm
… a meeting on very technical questions
… the main intention is to have a very technical discussion
… and explain why we propose the new reporting proposal
… we understand the concerns of the browsers, but they do not address the concerns
… such as safety
… optional use cases
… another proposal
… for preserving privacy
… reaches bar of privacy
… by the browser
… encourage everybody to review the proposal
… would be useful if you would share your feedback
… maybe we can have a very constructive meeting Thursday in one week on the technical bits
… if everybody ok
Wendy: thank you
Michael: I can confirm we are planning to have a meeting like this
… we will post on Turtledove and SPARROW Repos
… those repos have moved to Web Platform CG
… we will have occasional one-off phone calls and more conversations in GitHub
… we will announce in-person calls on mailing lists
… in case people are interested
… as mentioned, it will be a technical discussion of implementation details
… what is possible in Turtledove and SPARROW and looking at privacy implications
… that will happen Thursday, a week and two days from now
Wendy: I saw that those repositories have moved to WICG
… anyone is free to join that CG
… I think a good work mode is to get occasional reports or updates
… to see business use cases being met as tech specs are being developed there
… great, thanks for bringing that to our attention
… interested folks should watch the issue repository for its details
CMA Report; Success Criteria
Wendy: James, you wanted to talk about CMA Report and Success Criteria
<AramZS> Please link the report into the minutes?
James: CMA report, competition and markets authority report
… one thousand eight hundred pages
… not an easy read
… starting to have a grasp of key things
… introduction of common user ID
… some talk about separation of various components
… won't go into detail now
… I think it is highly relevant to this group
… have not heard anyone say this is not an informational group
… Like to invite CMA to present their report to this group
… Second reason I think this is phenominally important
… could apply to what could become law in UK
… each call takes two person weeks to be involved
… and then time to follow the other discussion
… hard to be in all these different groups
… another example might be control, what entities have control over what things
… and whether it will be relevant
… and whether Google and Apple may change their policies as a result of the report
… useful to have some input
Wendy: I not that many of participants in this group have provided input and responses in the proceedings there
AramZS: I just want to note, I like the idea of having this org present their findings to W3C
… can we link to report in the minutes for reference?
<krischapman> https://www.gov.uk/cma-cases/online-platforms-and-digital-advertising-market-study#final-report
<jrosewell> https://www.gov.uk/cma-cases/online-platforms-and-digital-advertising-market-study
Wendell: I worry that we are as a group becoming a policy shop
… that is not why I came here, or why I guided my org to do policy
… we have policy people
… they don't come and talk here
… they talk other places amongst themselves
… I worry that developing policy tracts and doing things that regulators do is not technical and is not going to help the business
… and then we get back to browser vendors saying they don't want their software used in certain ways
… there is some hope upon reading these 1800 pages that these tech developers would reconsider
… we are not basing our plans at Verizon Media around such a reconsideration
… SPARROW is a model for how to move forward in building a private and safe web
Wendy: thank you, I think from W3C we often hear our members wanting us to focus on technical challenges of interoperability
… what should we be building, APIs and user interfaces and leave the layer 8 and 9 to other venues
… if this report offers help in focusing the technical interop and use case, I would encourage us to use it that way
James: I am not advocating for a policy discussion in this group, but we need to be informed of major policy developments
… why the invite should come from the W3C
… wonder Wendy if you are best to explore?
Wendy: yes, I can explore it
… I have not gotten deep into the report
James: I can make introductions to CMA
… but I cannot represent the W3C, I am a newbie
… to Wendell's comments
… if there is a credible decision from a regulator, we need to be informed about it
… we need to know about it
… so we can adapt our business plans
… help everyone stay current; that's why I think it is relevant as well
Wendy: thank you; I assume that many of the participants are already deeply involved
… with other people in their organization
… rather than those participating in these calls
… ask people to consider if we have the discussion in this call
<krischapman> +1 to Wendell's comment on focusing mainly on the technical details here
Wendy: or would it be repeating to different people in orgs something they have chosen others to specialize on
… when are we best placed to do in this group
James: to be informed; if there is a changing position that we would need to know in this group
<arnaud_blanchard> happy to take Wendell's comment on SPARROW, either through these calls or on the github
Wendy: ok, thank you
… there are lots of links in the irc to the report
… and its supplemental material
… thank you for your offer of an introduction; I will follow up with you on that
… Thanks for the call here
… we are at the end
… we keep pushing off the more procedural question
… of might we do a virtual F2F or other more intense meeting
… at some point, or other changes to the work mode that would help us to make progress
… Those who participated in the 2-4 hours Privacy CG, encourage people to think about what that might look like
… and whether our work might be helped by a longer, intense focus
… and if we have proposed presentations at a meeting like that
… please send proposed agenda items and topics you want to discuss next time
… Likely to see you again on the 14th, except those in France
… thank you