Digital Ad Lobby withdraws from Do-Not Track at WC3/Consumers confront 24/7 data tracking landscape/Fed. action needed on privacy
By: Jeff Chester | Sep 17 2013
Earlier today, the Digital Advertising Alliance (DAA) sent an email to the WC3 Tracking Protecting list withdrawing from the group. Its email, along with one from the IAB and from former WC3 co-chair Peter Swire, follows CDD's statement:
The DAA's opposition to a Do Not Track system that actually placed consumers in control is one of the key reasons the WC3 process has floundered. If the DAA power brokers--Google, Yahoo, and the ad giants, had really wanted to deliver new privacy protection clout to consumers, our work would have successfully finished a year ago. The DAA has not yet developed a serious way to fulfill its promise made to the White House in 2012--that they would give consumers the power to control data tracking. It's time for the White House to urge passage of consumer privacy safeguards that gives real ways online users can decide about how best to protect their privacy. Online consumers urgently require privacy safeguards, as they confront a Big Data powered data collection machine that closely tracks them wherever they are--whether on their mobile phones or in front of a personal computer.
The DAA members do not want to face a rival Do Not Track system emerging from the WC3--especially one that exposes the inadequacy of its approach. We found it disingenuous for the DAA to claim, as it does, that among its rationale for leaving the WC3 is the failure to reach consensus on "Defining a harm or problem it seeks to prevent," and "Defining the term “tracking." This is merely an excuse, since the DAA and most of the data collection companies comprising the WC3 group know very well the range and applications of their own tracking systems. They have even claimed that such tracking should be exempt from the very DNT process as well!
Now we are going to have dueling DNT initatives. The DAA wants to meet with consumer and privacy groups, among others, on its plans moving forward. The WC3 will likely continue its work, although many participants (including CDD) believe it cannot deliver a consumer privacy friendly approach for DNT.
Work to offer consumers some modest control over third-party data tracking--which is at the core of the current and limited DNT scheme--illustrates why we cannot rely on multistakeholder processes dominated by data collection companies to deliver better privacy for consumers. They have no incentive to do so; indeed, the expansion of data collection on individual users is occuring at an alarming rate. CDD will continue, however, to play a role at the WC3 and its DNT work as long as it can help ensure a better outcome. We will also meet with the DAA. But this sad episode in the annals of privacy underscore why both the EU and U.S. need to enact strong safeguards on data protection.
Here's the DAA email:
Dear Mr. Jaffe:
After serious consideration, the leadership of the Digital Advertising Alliance (DAA) has agreed that the DAA will withdraw from future participation in the World Wide Web Consortium (W3C) Tracking Protection Working Group (TPWG). After more than two years of good-faith effort and having contributed significant resources, the DAA no longer believes that the TPWG is capable of fostering the development of a workable “do not track” (“dnt”) solution. As we depart W3C and TPWG, DAA will focus its resources on convening its own forum to evaluate how browser-based signals can be used meaningfully to address consumer privacy.
During more than two years since the W3C began its attempt at a dnt standard, the DAA has delivered real tools to millions of consumers. It has grown participation; enhanced transparency with more than a trillion ad impressions per month delivered with the DAA’s Icon making notice and choice information available within one-click of the ad; educated millions of consumers and provided browser-based persistent plug ins. The DAA has also succeeded in applying its principles to all of the participants in the digital ecosystem. Furthermore, we have expanded these consumer safeguards into 30 countries and clarified how the DAA’s Principles apply in the mobile Web and app environments.
Going forward, the DAA intends to focus its time and efforts on growing this already-successful consumer choice program in “desktop,” mobile and in-app environments. The DAA is confident that such efforts will yield greater advances in consumer privacy and industry self-regulation than would its continued participation at the W3C.
Despite extension after extension of its charter year after year by the W3C, the TPWG has yet to reach agreement on the most elementary and material issues facing the group. These open items include fundamental issues and key definitions that have been discussed by this group since its inception without reaching consensus, including:
· Defining a harm or problem it seeks to prevent.
· Defining the term “tracking”.
· Identifying limitations on the use of unique identifiers.
· Determining the effect of user choice.
Concerned about the TPWG’s inability to resolve such basic issues, the DAA wrote a letter to you on October 2, 2012, expressing its strong concern with the W3C’s foray into setting public policy standards. In particular, the letter noted that the W3C “has been designed to build consensus around complex technology issues, not complex public policy matters.” In response, despite the turmoil evident at that time, you personally assured us that appropriate procedures and policies would be applied to the process and the W3C’s retention of Professor Swire would settle and bring legitimacy to the process.
In the ensuing eight months that led up to the July 2013 deadline imposed on the TPWG, the DAA worked in good faith with other stakeholders, supporting proposals consistent with recommendations from the U.S. Administration and the former chairman of the Federal Trade Commission. Unfortunately, these efforts were rejected out of hand by TPWG co-chair Peter Swire, who jettisoned the long-accepted W3C procedure in order to anoint his own path forward. As others in the working group have substantiated, as a result of Swire’s actions there is no longer a legitimate TPWG procedure. Jonathan Mayer, commenting on the working process, stated, “We do not have clear rules of decision. And even if we were to have procedural commitments, they could be unilaterally cast aside at any time. This is not process: this is the absence of process.” Roy T. Fielding, Senior Principal Scientist at Adobe, highlighted the dictatorial approach taken by chairs who have eschewed participant input and subrogated participants’ right to vote on issues.
In recent weeks, you have indicated to TPWG participants that you have no intent to revisit acts or processes (or the lack thereof) that occurred leading up to July 2013, and instead plan to move forward. However, it is not possible to move forward without an accounting for the previous flagrant disregard for procedure.
Today, parties on all sides agree that the TPWG is not a sensible use of W3C resources and that the process will not lead to a workable result. For example, Jonathan Mayer, in his recent letter of resignation from the TPWG, stated: “Given the lack of a viable path to consensus, I can no longer justify the substantial time, travel, and effort associated with continuing in the Working Group.” John Simpson, the director of the Consumer Watchdog’s privacy project, commented on the news of the departure of TPWG co-chairman Professor Swire: “Peter Swire gave it a good shot, but I don’t think that he or anybody can get this group to a general consensus.” These participants and others who previously supported the TPWG now conclude that the process has devolved into an exercise in frustration on all sides without any meaningful increase in consumer choice or transparency.
The DAA agrees with these parties on this matter. Therefore, rather than continue to work in a forum that has failed, we intend to commit our resources and time in participating in efforts that can achieve results while enhancing the consumer digital experience. The DAA will immediately convene a process to evaluate how browser-based signals can be used to meaningfully address consumer privacy. The DAA looks forward to working with browsers, consumer groups, advertisers, marketers, agencies, and technologists. This DAA-led process will be a more practical use of our resources than to continue to participate at the W3C.
With the departure of the latest TPWG co-chair as well as a key staff member, and no definitive process to move forward, the DAA recommends that that the W3C should not attempt to resurrect a process that has clearly reached the end of its useful life.
The DAA will continue to move forward in its own area of expertise, advancing consumer control, transparency, and other critical practices through its own program.
Lou Mastria, CIPP, CISSP
Digital Advertising Alliance
This email was sent by IAB to the WC3 list on September 13, 2013 and is related:
Dear TPWG Chair, W3C Staff, and fellow TPWG Members,
In accordance with the September 13th deadline for feedback on "the proposed plan", I respectfully provide the following feedback on the proposed plan and process:
IAB, DAA, DMA, and NAI incorporates by reference, their objections submitted on July 12, 2013. See http://www.w3.org/2002/09/wbs/49311/datahygiene/results.
In addition to renewing their objections to the use of the Editors' draft as the basis for moving forward, IAB, DAA, DMA, and NAI also respectfully submit the following feedback in opposition to proceeding with the proposed plan:
1. Genuine Working Group consensus cannot be achieved through the proposed plan and it remains entirely unclear what "consensus" means or how it is reached.
The W3C contends that "[t]he Editors' Draft (based on the June draft) represents the most promising path toward consensus of the Working Group on the Tracking Compliance document." (Sep. 3, 2013 email from M. Schunter to firstname.lastname@example.org). But it is clear from the TPWG's unsuccessful efforts in June and July to reach consensus with the June draft that the June draft does not present a viable document from which to reach consensus. Although the term consensus is often used, it is unclear as to exactly what that term means or what is actually required to reach consensus. In conjunction with moving forward with a document that cannot create consensus, the W3C has also expressed its intention to close one issue per week starting in October. Id. "If there is no consensus, then the Chairs will issue a Call for Objections. In this case, the resolution will be based on the Chairs' assessment of the relative strength of the arguments. Working Group decisions made through a Call for Objections are also documented in a revision of the Editors' Draft." Id. This process of arbitrary decision making will likely create a disjointed patch-work document that would be neither the product of the working group nor a cohesive compliance document that could be adopted. Mr. Fielding, who has significant W3C experience, has expressed similar concerns with the co-chairs taking over the decision making process for the working group:
<fielding> In general, W3C staff have often (over 15+ years) made the mistake that they can speed the process of a working group by making decisions for the WG in the form of "simplifying". In all such cases, the WG derails ... making decisions for the WG means that there is no reason to have a WG, since you aren't letting us make the decisions that matter. Hence, in the future, stop trying to wag the dog -- let the group make its own decisions and act as a facilitator,
<fielding> not a judge.
Found at http://www.w3.org/2013/09/04-dnt-minutes.
2. The Due Dates suggest that the Poll is an exercise in futility.
Because the W3C is proceeding with Option 1 prior to the opening of the poll to discuss other options, it is apparent that the W3C is intent on moving forward with the proposed plan regardless of the outcome of the Poll. "The clear recommendation from the Chair/Staff is to make progress with Options 1 or 2." (Sep. 3, 2013 email from M. Schunter to email@example.com). We note that Option 2 only pushes out the hard issues to a later version of the standard. Unfortunately, the hard issues, those that cannot find consensus, are at the heart of the standard itself. Indeed, the W3C has suggested that the technology is not ready for a DNT standard: "Thus, we are focused on the appropriate DNT solution for release in 2013-14 which we call DNT 1.0. As technology and user references evolve, we fully expect that there will be further releases that address scenarios that are not well addressed today." (Sep. 3, 2013 email from M. Schunter to firstname.lastname@example.org)(emphasis added). DAA, IAB, NAI, ANA, AAAA, DMA object to the W3C's approach of moving forward before the analysis of the poll results.
3. Move the issue closing process to one based on membership voting. This would fast track the process and could still allow for a formal objection process to follow. This mirrors the escalation structure to ACRs and has been discussed in the past. This process would be limited to W3C membership as they represent actual implementers of standards.
4. Consensus and decision-making
o What exactly is the standard for consensus?
o If the standard is "least strong objections," then please clarify what this means? Does it mean least strong substantively, or least strong in terms of the vigor of the objection, e.g. "my business will be killed by this and I can't live with it!"
o Whose opinions count in weighing consensus, e.g. invited experts or multiple reps from a single organization?
a. Who is an invited expert and how are they chosen?
b. Third parties are the primary target of this standard, and the companies likely to be most impacted economically. Why are so few represented directly in the working group, and what will be done to increase their participation?
c. Understanding that there should be a periodic review of invited experts per W3C rules (http://www.w3.org/2004/08/invexp "Principles Guiding Invitations and Periodic Review"), can you please disclose when such reviews have occurred, if ever, on which invited experts, the determination of those reviews, and the rationale used for such determination? If no such review has been conducted, can you please supply the rationale for not conducting the reviews and indicate when such reviews will take place?
d. In our opinion, most of the "invited experts" represent organizations "which have significant business interest in the results from W3C" noting that the W3C rules themselves state "this might even include some not-for-profit organizations."
e. At least two invited experts have submitted their formal resignation from the working group, but have not yet been removed from the TPWG official roster.
a. What is the meaning of "The Working Group will not design mechanisms for the expression of complex or general-purpose policy statements."
b. What is the intent of this limitation?
c. What is the meaning of "The group will actively engage governmental, industry, academic and advocacy organizations to seek global consensus definitions and codes of conduct."
d. See participation above. What has the group done to ensure active engagement with /all/ relevant stakeholders, especially those who will likely be most impacted by this standard?
7. What are the criteria and milestones for continuing or winding down the group, if progress is not made?
8. W3C process requires an implementation and testing phase. How will this apply to the compliance specification? Can elements of the compliance spec become "features at risk"? What about crucial elements of the technical spec that are closely coupled with the policy?
9. Provide detailed timelines and decision criteria for each Formal Objection being considered prior to requesting WG input.
10. More firmly state within the updated plan that driving towards a standard that will achieve broad industry adoption is a core goal (otherwise, why are we here?).
11. We need clear criteria for reopening issues. The "new information" standard is overly vague and inconsistently applied.
12. We need assurances about the process for closing issues, including addressing the problem of having to continually raise and re-raise issues. We need a predictable, rational process for bringing issues to close.
13. What is the status of the global considerations effort?
14. Who is the new co-chair? It is impossible to express our faith or lack of it in the poll without knowing who will co-lead the group going forward.
15. What is the status of FTC participation, and who is speaking for the FTC? Is Ed Felton speaking for FTC? Or Paul Ohm?
16. What is the status of the PAG?
Respectfully submitted on 9/13/2013, on behalf of the DAA, IAB, NAI and DMA,
Chris Mejia, DAA & IAB
Finally, one sent on 17 September from Peter Swire:
To the Working Group:
I note with sadness but not surprise the decision today by the Digital Advertising Alliance to withdraw from the Tracking Protection Working Group of the World Wide Web Consortium. In announcing their departure, they chose my actions as the most convenient excuse for leaving the process: “Unfortunately, these efforts were rejected out of hand by TPWG co-chair Peter Swire, who jettisoned the long-accepted W3C procedure in order to anoint his own way forward.”
I share the frustration in the DAA message with the inability of the Working Group to achieve better results. I believe a fair review of the history, however, shows that the views of the DAA and its members were valued and included in months of hard work together in the Group:
(1) I met individually with the leadership of each DAAmember during the “listening tour” in late 2012, after I was named co-chair.
(2) A major part of the agenda at the February Face-to-Face, in Cambridge, was based on the DAA proposal concerning ways to limit access to a user’s lifetime browsing history.
(3) DAA proposals and language were discussed in detail during weekly teleconferences for the next several months. Indeed, a repeated theme on the list during this period was the concern from consumer advocates that a disproportionateamount of time of the Group was being spent on DAA proposals.
(4) In the lead-up to the May Face-to-Face in California, there were intensive negotiations on what became known as the Draft Framework, which became the agenda for our three-day meeting. The DAA was deeply enough involved in these negotiations that its General Counsel, Stu Ingis, presented the Draft Framework to the Group in one of its calls.
(5) Coming out of the May meeting, the full group, including the DAA, issued a consensus document that enough progress had been made that we should continue to work toward the long-agreed Last Call deadline of the end of July.
(6) As an effort to have one clear text that would be the focus of the Group’s efforts, we then had the summer process to create proposed language and then comments on a base text. Among the change proposals, by far the greatest amount of time on the Group calls was devoted to the text proposed by the DAA and those associated with it.
(7) Both co-chairs, supported by W3C staff, then issued approximately 40 single-spaced pages of decision documents. These documents contained a massive number of footnotes and citations to the comments submitted by Working Group members. Based on the record developed by the full Group, these documents explained reasons why the June Draft would remain the base text rather than the proposal submitted by the DAA and those associated with it. In brief, the criteria for a standard that we discussed in Cambridge, based on the overall record, would not be met by the proposal submitted by the DAA and others.
Based on this history, the DAA views were simply not rejected “out of hand.”
My own view is that the Working Group does not have a path to consensus that includes large blocs of stakeholders with views as divergent as the DAA, on the one hand, and those seeking stricter privacy rules, on the other. I devoted my time as co-chair to trying to find creative ways to achieve consumer choice and privacy while also enabling a thriving commercial Internet. I no longer see any workable path to a standard that will gain active support from both wings of the Working Group.
When participants don’t get the outcome they want on substance, they often blame the procedure. As an imperfect human being, and one working within the W3C processes for the first time, I am sure that I could have done better at various points on procedure. The actual procedure that led to the July decision came directly from my close discussions with W3C staff, and used the mechanism for resolving a disputed issue that the Working Group established and used before I became co-chair.
I intensely share the frustration that all the hard work by members of the Working Group has not created a consensus path forward. I believe there is consensus in the Working Group that members have worked very hard, and I worked very hard, to find apath forward. I put almost all of my other professional work on hold, at financial cost to myself, to try to find a solution on Do Not Track.
Going forward, there are cogent reasons for stakeholders to continue to work, inside and outside of W3C, to develop standards and good practices for commercial privacy on the Internet.
We knew coming in that this was a hard problem. It remains a hard problem. The procedures at W3C this summer are not the reason that it became hard.
With best wishes to all of you,