index.html 46.7 KB

Raw Blame History Permalink

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html lang="en" dir="ltr">
<head>
	<title>Tracking Compliance and Scope</title>
	<meta http-equiv="Content-Type" content="text/html;charset=utf-8">


	<style type="text/css">
/*****************************************************************
 * ReSpec CSS
 * Robin Berjon (robin at berjon dot com)
 * v0.05 - 2009-07-31
 *****************************************************************/


/* --- INLINES --- */
em.rfc2119 {
    text-transform:     lowercase;
    font-variant:       small-caps;
    font-style:         normal;
    color:              #900;
}

h1 acronym, h2 acronym, h3 acronym, h4 acronym, h5 acronym, h6 acronym, a acronym,
h1 abbr, h2 abbr, h3 abbr, h4 abbr, h5 abbr, h6 abbr, a abbr {
    border: none;
}

dfn {
    font-weight:    bold;
}

a.internalDFN {
    color:  inherit;
    border-bottom:  1px solid #99c;
    text-decoration:    none;
}

a.externalDFN {
    color:  inherit;
    border-bottom:  1px dotted #ccc;
    text-decoration:    none;
}

a.bibref {
    text-decoration:    none;
}

code {
    color:  #ff4500;
}


/* --- WEB IDL --- */
pre.idl {
    border-top: 1px solid #90b8de;
    border-bottom: 1px solid #90b8de;
    padding:    1em;
    line-height:    120%;
}

pre.idl::before {
    content:    "WebIDL";
    display:    block;
    width:      150px;
    background: #90b8de;
    color:  #fff;
    font-family:    initial;
    padding:    3px;
    font-weight:    bold;
    margin: -1em 0 1em -1em;
}

.idlType {
    color:  #ff4500;
    font-weight:    bold;
    text-decoration:    none;
}

/*.idlModule*/
/*.idlModuleID*/
/*.idlInterface*/
.idlInterfaceID, .idlDictionaryID {
    font-weight:    bold;
    color:  #005a9c;
}

.idlSuperclass {
    font-style: italic;
    color:  #005a9c;
}

/*.idlAttribute*/
.idlAttrType, .idlFieldType, .idlMemberType {
    color:  #005a9c;
}
.idlAttrName, .idlFieldName, .idlMemberName {
    color:  #ff4500;
}
.idlAttrName a, .idlFieldName a, .idlMemberName a {
    color:  #ff4500;
    border-bottom:  1px dotted #ff4500;
    text-decoration: none;
}

/*.idlMethod*/
.idlMethType {
    color:  #005a9c;
}
.idlMethName {
    color:  #ff4500;
}
.idlMethName a {
    color:  #ff4500;
    border-bottom:  1px dotted #ff4500;
    text-decoration: none;
}

/*.idlParam*/
.idlParamType {
    color:  #005a9c;
}
.idlParamName {
    font-style: italic;
}

.extAttr {
    color:  #666;
}

/*.idlConst*/
.idlConstType {
    color:  #005a9c;
}
.idlConstName {
    color:  #ff4500;
}
.idlConstName a {
    color:  #ff4500;
    border-bottom:  1px dotted #ff4500;
    text-decoration: none;
}

/*.idlException*/
.idlExceptionID {
    font-weight:    bold;
    color:  #c00;
}

.idlTypedefID, .idlTypedefType {
    color:  #005a9c;
}

.idlRaises, .idlRaises a.idlType, .idlRaises a.idlType code, .excName a, .excName a code {
    color:  #c00;
    font-weight:    normal;
}

.excName a {
    font-family:    monospace;
}

.idlRaises a.idlType, .excName a.idlType {
    border-bottom:  1px dotted #c00;
}

.excGetSetTrue, .excGetSetFalse, .prmNullTrue, .prmNullFalse, .prmOptTrue, .prmOptFalse {
    width:  45px;
    text-align: center;
}
.excGetSetTrue, .prmNullTrue, .prmOptTrue { color:  #0c0; }
.excGetSetFalse, .prmNullFalse, .prmOptFalse { color:  #c00; }

.idlImplements a {
    font-weight:    bold;
}

dl.attributes, dl.methods, dl.constants, dl.fields, dl.dictionary-members {
    margin-left:    2em;
}

.attributes dt, .methods dt, .constants dt, .fields dt, .dictionary-members dt {
    font-weight:    normal;
}

.attributes dt code, .methods dt code, .constants dt code, .fields dt code, .dictionary-members dt code {
    font-weight:    bold;
    color:  #000;
    font-family:    monospace;
}

.attributes dt code, .fields dt code, .dictionary-members dt code {
    background:  #ffffd2;
}

.attributes dt .idlAttrType code, .fields dt .idlFieldType code, .dictionary-members dt .idlMemberType code {
    color:  #005a9c;
    background:  transparent;
    font-family:    inherit;
    font-weight:    normal;
    font-style: italic;
}

.methods dt code {
    background:  #d9e6f8;
}

.constants dt code {
    background:  #ddffd2;
}

.attributes dd, .methods dd, .constants dd, .fields dd, .dictionary-members dd {
    margin-bottom:  1em;
}

table.parameters, table.exceptions {
    border-spacing: 0;
    border-collapse:    collapse;
    margin: 0.5em 0;
    width:  100%;
}
table.parameters { border-bottom:  1px solid #90b8de; }
table.exceptions { border-bottom:  1px solid #deb890; }

.parameters th, .exceptions th {
    color:  #fff;
    padding:    3px 5px;
    text-align: left;
    font-family:    initial;
    font-weight:    normal;
    text-shadow:    #666 1px 1px 0;
}
.parameters th { background: #90b8de; }
.exceptions th { background: #deb890; }

.parameters td, .exceptions td {
    padding:    3px 10px;
    border-top: 1px solid #ddd;
    vertical-align: top;
}

.parameters tr:first-child td, .exceptions tr:first-child td {
    border-top: none;
}

.parameters td.prmName, .exceptions td.excName, .exceptions td.excCodeName {
    width:  100px;
}

.parameters td.prmType {
    width:  120px;
}

table.exceptions table {
    border-spacing: 0;
    border-collapse:    collapse;
    width:  100%;
}

/* --- TOC --- */
.toc a {
    text-decoration:    none;
}

a .secno {
    color:  #000;
}

/* --- TABLE --- */
table.simple {
    border-spacing: 0;
    border-collapse:    collapse;
    border-bottom:  3px solid #005a9c;
}

.simple th {
    background: #005a9c;
    color:  #fff;
    padding:    3px 5px;
    text-align: left;
}

.simple th[scope="row"] {
    background: inherit;
    color:  inherit;
    border-top: 1px solid #ddd;
}

.simple td {
    padding:    3px 10px;
    border-top: 1px solid #ddd;
}

.simple tr:nth-child(even) {
    background: #f0f6ff;
}

/* --- DL --- */
.section dd > p:first-child {
    margin-top: 0;
}

.section dd > p:last-child {
    margin-bottom: 0;
}

.section dd {
    margin-bottom:  1em;
}

.section dl.attrs dd, .section dl.eldef dd {
    margin-bottom:  0;
}

/* --- EXAMPLES --- */
pre.example {
    border-top: 1px solid #ff4500;
    border-bottom: 1px solid #ff4500;
    padding:    1em;
    margin-top: 1em;
}

pre.example::before {
    content:    "Example";
    display:    block;
    width:      150px;
    background: #ff4500;
    color:  #fff;
    font-family:    initial;
    padding:    3px;
    font-weight:    bold;
    margin: -1em 0 1em -1em;
}

/* --- EDITORIAL NOTES --- */
.issue {
    padding:    1em;
    margin: 1em 0em 0em;
    border: 1px solid #f00;
    background: #ffc;
}

.issue::before {
    content:    "Issue";
    display:    block;
    width:  150px;
    margin: -1.5em 0 0.5em 0;
    font-weight:    bold;
    border: 1px solid #f00;
    background: #fff;
    padding:    3px 1em;
}

.note {
    margin: 1em 0em 0em;
    padding:    1em;
    border: 2px solid #cff6d9;
    background: #e2fff0;
}

.note::before {
    content:    "Note";
    display:    block;
    width:  150px;
    margin: -1.5em 0 0.5em 0;
    font-weight:    bold;
    border: 1px solid #cff6d9;
    background: #fff;
    padding:    3px 1em;
}

/* --- Best Practices --- */
div.practice {
    border: solid #bebebe 1px;
    margin: 2em 1em 1em 2em;
}

span.practicelab {
    margin: 1.5em 0.5em 1em 1em;
    font-weight: bold;
    font-style: italic;
}

span.practicelab   { background: #dfffff; }

span.practicelab {
    position: relative;
    padding: 0 0.5em;
    top: -1.5em;
}

p.practicedesc {
    margin: 1.5em 0.5em 1em 1em;
}

@media screen {
    p.practicedesc {
        position: relative;
        top: -2em;
        padding: 0;
        margin: 1.5em 0.5em -1em 1em;
    }
}

/* --- SYNTAX HIGHLIGHTING --- */
pre.sh_sourceCode {
  background-color: white;
  color: black;
  font-style: normal;
  font-weight: normal;
}

pre.sh_sourceCode .sh_keyword { color: #005a9c; font-weight: bold; }           /* language keywords */
pre.sh_sourceCode .sh_type { color: #666; }                            /* basic types */
pre.sh_sourceCode .sh_usertype { color: teal; }                             /* user defined types */
pre.sh_sourceCode .sh_string { color: red; font-family: monospace; }        /* strings and chars */
pre.sh_sourceCode .sh_regexp { color: orange; font-family: monospace; }     /* regular expressions */
pre.sh_sourceCode .sh_specialchar { color: 	#ffc0cb; font-family: monospace; }  /* e.g., \n, \t, \\ */
pre.sh_sourceCode .sh_comment { color: #A52A2A; font-style: italic; }         /* comments */
pre.sh_sourceCode .sh_number { color: purple; }                             /* literal numbers */
pre.sh_sourceCode .sh_preproc { color: #00008B; font-weight: bold; }       /* e.g., #include, import */
pre.sh_sourceCode .sh_symbol { color: blue; }                            /* e.g., *, + */
pre.sh_sourceCode .sh_function { color: black; font-weight: bold; }         /* function calls and declarations */
pre.sh_sourceCode .sh_cbracket { color: red; }                              /* block brackets (e.g., {, }) */
pre.sh_sourceCode .sh_todo { font-weight: bold; background-color: #00FFFF; }   /* TODO and FIXME */

/* Predefined variables and functions (for instance glsl) */
pre.sh_sourceCode .sh_predef_var { color: #00008B; }
pre.sh_sourceCode .sh_predef_func { color: #00008B; font-weight: bold; }

/* for OOP */
pre.sh_sourceCode .sh_classname { color: teal; }

/* line numbers (not yet implemented) */
pre.sh_sourceCode .sh_linenum { display: none; }

/* Internet related */
pre.sh_sourceCode .sh_url { color: blue; text-decoration: underline; font-family: monospace; }

/* for ChangeLog and Log files */
pre.sh_sourceCode .sh_date { color: blue; font-weight: bold; }
pre.sh_sourceCode .sh_time, pre.sh_sourceCode .sh_file { color: #00008B; font-weight: bold; }
pre.sh_sourceCode .sh_ip, pre.sh_sourceCode .sh_name { color: #006400; }

/* for Prolog, Perl... */
pre.sh_sourceCode .sh_variable { color: #006400; }

/* for LaTeX */
pre.sh_sourceCode .sh_italics { color: #006400; font-style: italic; }
pre.sh_sourceCode .sh_bold { color: #006400; font-weight: bold; }
pre.sh_sourceCode .sh_underline { color: #006400; text-decoration: underline; }
pre.sh_sourceCode .sh_fixed { color: green; font-family: monospace; }
pre.sh_sourceCode .sh_argument { color: #006400; }
pre.sh_sourceCode .sh_optionalargument { color: purple; }
pre.sh_sourceCode .sh_math { color: orange; }
pre.sh_sourceCode .sh_bibtex { color: blue; }

/* for diffs */
pre.sh_sourceCode .sh_oldfile { color: orange; }
pre.sh_sourceCode .sh_newfile { color: #006400; }
pre.sh_sourceCode .sh_difflines { color: blue; }

/* for css */
pre.sh_sourceCode .sh_selector { color: purple; }
pre.sh_sourceCode .sh_property { color: blue; }
pre.sh_sourceCode .sh_value { color: #006400; font-style: italic; }

/* other */
pre.sh_sourceCode .sh_section { color: black; font-weight: bold; }
pre.sh_sourceCode .sh_paren { color: red; }
pre.sh_sourceCode .sh_attribute { color: #006400; }

</style><link href="http://www.w3.org/StyleSheets/TR/W3C-WD" rel="stylesheet" type="text/css" charset="utf-8"></head>
<body style="display: inherit; "><div class="head"><p><a href="http://www.w3.org/"><img width="72" height="48" src="http://www.w3.org/Icons/w3c_home" alt="W3C"></a></p><h1 class="title" id="title">Tracking Compliance and Scope</h1><h2 id="w3c-working-draft-14-november-2011">W3C Working Draft 14 November 2011</h2><dl><dt>This version:</dt><dd><a href="http://www.w3.org/TR/2011/WD-tracking-compliance-20111114/">http://www.w3.org/TR/2011/WD-tracking-compliance-20111114/</a></dd><dt>Latest published version:</dt><dd><a href="http://www.w3.org/TR/tracking-compliance/">http://www.w3.org/TR/tracking-compliance/</a></dd><dt>Latest editor's draft:</dt><dd><a href="http://www.w3.org/2011/tracking-protection/drafts/tracking-compliance.html">http://www.w3.org/2011/tracking-protection/drafts/tracking-compliance.html</a></dd><dt>Previous version:</dt><dd>none</dd><dt>Editors:</dt><dd><a href="http://cdt.org/">Justin Brookman</a>, <a href="http://cdt.org/">CDT</a></dd>
<dd><a href="http://google.com/">Sean Harvey</a>, <a href="http://google.com/">Google</a></dd>
<dd><a href="http://cdt.org/">Erica Newland</a>, <a href="http://cdt.org/">CDT</a></dd>
<dd><a href="http://Google.com/">Heather West</a>, <a href="http://google.com/">Google</a></dd>
</dl><p class="copyright"><a href="http://www.w3.org/Consortium/Legal/ipr-notice#Copyright">Copyright</a> © 2011 <a href="http://www.w3.org/"><acronym title="World Wide Web Consortium">W3C</acronym></a><sup>®</sup> (<a href="http://www.csail.mit.edu/"><acronym title="Massachusetts Institute of Technology">MIT</acronym></a>, <a href="http://www.ercim.eu/"><acronym title="European Research Consortium for Informatics and Mathematics">ERCIM</acronym></a>, <a href="http://www.keio.ac.jp/">Keio</a>), All Rights Reserved. W3C <a href="http://www.w3.org/Consortium/Legal/ipr-notice#Legal_Disclaimer">liability</a>, <a href="http://www.w3.org/Consortium/Legal/ipr-notice#W3C_Trademarks">trademark</a> and <a href="http://www.w3.org/Consortium/Legal/copyright-documents">document use</a> rules apply.</p><hr></div>
	<div id="abstract" class="introductory section"><h2>Abstract</h2>
		<p>This specification defines the meaning of a Do Not Track preference and sets out practices for websites to comply with this preference.</p>
	</div><div id="sotd" class="introductory section"><h2>Status of This Document</h2><p><em>This section describes the status of this document at the time of its publication. Other documents may supersede this document. A list of current W3C publications and the latest revision of this technical report can be found in the <a href="http://www.w3.org/TR/">W3C technical reports index</a> at http://www.w3.org/TR/.</em></p>
		<p>This is the First Public Working Draft, consisting of an outline of the issues raised so far by the working group  with a few points raised during discussion.</p>
	<p>This document was published by the <a href="http://www.w3.org/2011/tracking-protection/">Tracking Protection Working Group</a> as a First Public Working Draft. This document is intended to become a W3C Recommendation. If you wish to make comments regarding this document, please send them to <a href="mailto:public-tracking@w3.org">public-tracking@w3.org</a> (<a href="mailto:public-tracking-request@w3.org?subject=subscribe">subscribe</a>, <a href="http://lists.w3.org/Archives/Public/public-tracking/">archives</a>). All feedback is welcome.</p><p>Publication as a Working Draft does not imply endorsement by the W3C Membership. This is a draft document and may be updated, replaced or obsoleted by other documents at any time. It is inappropriate to cite this document as other than work in progress.</p><p>This document was produced by a group operating under the <a href="http://www.w3.org/Consortium/Patent-Policy-20040205/">5 February 2004 W3C Patent Policy</a>. W3C maintains a <a href="http://www.w3.org/2004/01/pp-impl/49311/status" rel="disclosure">public list of any patent disclosures</a> made in connection with the deliverables of the group; that page also includes instructions for disclosing a patent. An individual who has actual knowledge of a patent which the individual believes contains <a href="http://www.w3.org/Consortium/Patent-Policy-20040205/#def-essential">Essential Claim(s)</a> must disclose the information in accordance with <a href="http://www.w3.org/Consortium/Patent-Policy-20040205/#sec-Disclosure">section 6 of the W3C Patent Policy</a>.</p></div><div id="toc" class="section"><h2 class="introductory">Table of Contents</h2><ul class="toc"><li class="tocline"><a href="#introduction" class="tocxref"><span class="secno">1. </span>Introduction</a></li><li class="tocline"><a href="#scope-and-goals" class="tocxref"><span class="secno">2. </span>Scope and Goals</a><ul class="toc"><li class="tocline"><a href="#goals" class="tocxref"><span class="secno">2.1 </span>Goals</a></li><li class="tocline"><a href="#success" class="tocxref"><span class="secno">2.2 </span>Success Criteria</a></li></ul></li><li class="tocline"><a href="#definitions" class="tocxref"><span class="secno">3. </span>Definitions</a><ul class="toc"><li class="tocline"><a href="#first-party" class="tocxref"><span class="secno">3.1 </span>First Party</a></li><li class="tocline"><a href="#third-party" class="tocxref"><span class="secno">3.2 </span>Third Party</a></li><li class="tocline"><a href="#transactional-data" class="tocxref"><span class="secno">3.3 </span>Transactional data</a></li><li class="tocline"><a href="#tracking" class="tocxref"><span class="secno">3.4 </span>Types of Tracking</a></li><li class="tocline"><a href="#deidentified" class="tocxref"><span class="secno">3.5 </span>De-identified data</a></li><li class="tocline"><a href="#consent" class="tocxref"><span class="secno">3.6 </span>Consent</a></li><li class="tocline"><a href="#meaningful-interaction" class="tocxref"><span class="secno">3.7 </span>Meaningful Interaction</a></li></ul></li><li class="tocline"><a href="#compliance" class="tocxref"><span class="secno">4. </span>Compliance with an expressed tracking preference</a><ul class="toc"><li class="tocline"><a href="#first-party-compliance" class="tocxref"><span class="secno">4.1 </span>First Party Compliance</a></li><li class="tocline"><a href="#intermediary-compliance" class="tocxref"><span class="secno">4.2 </span>Intermediary compliance</a></li><li class="tocline"><a href="#third-party-compliance" class="tocxref"><span class="secno">4.3 </span>Compliance by a third party</a></li><li class="tocline"><a href="#sensitive" class="tocxref"><span class="secno">4.4 </span>Compliance regarding Sensitive Information</a></li></ul></li><li class="tocline"><a href="#users" class="tocxref"><span class="secno">5. </span>User interactions</a></li><li class="tocline"><a href="#interaction" class="tocxref"><span class="secno">6. </span>Interaction with other tools</a><ul class="toc"><li class="tocline"><a href="#overrides" class="tocxref"><span class="secno">6.1 </span>How should a tracking preference interact with user overrides?</a></li><li class="tocline"><a href="#interactions" class="tocxref"><span class="secno">6.2 </span>Interaction with existing user privacy controls</a></li><li class="tocline"><a href="#education" class="tocxref"><span class="secno">6.3 </span>User Education and Communication</a></li><li class="tocline"><a href="#compliance" class="tocxref"><span class="secno">6.4 </span>Enforcement/Compliance</a></li></ul></li><li class="tocline"><a href="#misc" class="tocxref"><span class="secno">7. </span>Random issues for triage</a></li><li class="tocline"><a href="#not-scope" class="tocxref"><span class="secno">8. </span>Out of Scope or Postponed Issues</a></li><li class="tocline"><a href="#references" class="tocxref"><span class="secno">A. </span>References</a><ul class="toc"><li class="tocline"><a href="#normative-references" class="tocxref"><span class="secno">A.1 </span>Normative references</a></li><li class="tocline"><a href="#informative-references" class="tocxref"><span class="secno">A.2 </span>Informative references</a></li></ul></li></ul></div>


	<div id="introduction" class="section">
		<!--OddPage--><h2><span class="secno">1. </span>Introduction</h2>
	  	<p>This specification defines the meaning of a Do Not Track preference and sets out practices for websites to comply with this preference.</p>
	</div>

	<div id="scope-and-goals" class="section">
	  	<!--OddPage--><h2><span class="secno">2. </span>Scope and Goals</h2>

		<div id="goals" class="section">
			<h3><span class="secno">2.1 </span>Goals</h3>
			<p>What are underlying user concerns, and goals, that we hope a tracking preference recommendation will address?</p>
			<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/6">ISSUE-6</a>: What are the underlying concerns? Why are we doing this / what are people afraid of?</p>
			<ol>
				<li>Using the internet by definition involves the exchange of data across servers; the web cannot exist without it. In addition, commerce and the commercialization of content on the web often involves personalization of both content and advertising by websites, their advertisers, and their partners. Given the realities of this environment, this standard seeks to provide an exceedingly straightforward way for users to gain transparency and control over data usage and the personalization of content and advertising on the web.</li>
				<li>CDT document: The user experience online involves the unintentional disclosure and commercial compilation of many different kinds of user data among different entities, comprising a wide range of practices that could be called "tracking." At the most basic level, online communication requires the exchange of IP addresses between two parties. Completion of e-commerce transactions normally involves the sending of credit card numbers and user contact information. Social networking sites often revolve around user-provided profiles. Much web content is supported by advertising and much of this advertising is linked to either the content of the page visited or to a profile about the particular user or computer. Complex business models have arisen around the online data flows. DNT mechanisms should, at their core, empower users to prevent the collection and correlation of data about Internet activities that occur on different sites. Users expect control over who is tracking them and how tracking data may be shared.</li>
				<li>Open issues:
					<ol>
					<li>What is this solution attempting to address that has not been addressed by previous solutions such as opt-out cookies, browser-level cookie blocking, etc? (i.e. other technologies? something else?)</li>
					<li>Are there any unintentional dangers/harms to either users or web commerce that the standard is seeking to avoid while achieving its primary goal?</li>
					</ol>
				</li>
			</ol>
			<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/8">ISSUE-8</a>: How do we enhance transparency and user awareness? Explain the scope of this tracking document in the context of Do Not Track</p>
  		</div>

	  	<div id="success" class="section">
			<h3><span class="secno">2.2 </span>Success Criteria</h3>
	  		<p>Explain the success criteria. What do we want this specification to achieve?</p>
		</div>

	</div>

	<div id="definitions" class="section">
		<!--OddPage--><h2><span class="secno">3. </span>Definitions</h2>

		<div id="first-party" class="section">
	   		<h3><span class="secno">3.1 </span>First Party</h3>
			<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/10">ISSUE-10</a>: What is a first party?</p>
			<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/49">ISSUE-49</a>: Third party as first party - is a third party that collects data on behalf of the first party treated the same way as the first party?</p>
			<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/26">ISSUE-26</a>: Providing data to 3rd-party widgets -- does that imply consent?</p>
			<p>Options for discussion:
				</p><ol><li>Should we define first party based on company and affiliation, or organizational boundaries, or corporate structure?
					<ol><li>A first party is the entity (and its commonly branded affiliates) that owns or controls the web site the end user visits. An affiliate is an entity that Controls, or is Controlled by, or is under common Control with, another entity; or an entity where the relationship to another entity is evident to end users through co-branding or similar means.</li>
						<li>The entity that is the owner of the website or has control over the website with which the user interacts and its affiliates.</li>
						</ol></li>
					<li>Should we define first party based on domain owner, common branding and user expectation?
					<ol><li>The domain that the user visits.</li></ol></li>
					</ol>
					<p>In addition, a domain that hosts a third-party visible widget or window that is clearly identified and branded as being controlled and operated by a party separate and distinct from the first party becomes a first party itself when a user engages in "meaningful interaction" with the window or widget.</p>
	  		<p class="issue">There has also been a discussion whether we should distinguish between first and third party. Is this a useful road to go down?</p>
	  	</div>

		<div id="third-party" class="section">
			<h3><span class="secno">3.2 </span>Third Party</h3>
			<p>A third party is any entity other than a first party as defined above. A user is neither a first party nor a third party.</p>
			<p>Open questions:</p><ol><li>Third party data collection for first party use?</li></ol><p></p>
		</div>

		<div id="transactional-data" class="section">
			<h3><span class="secno">3.3 </span>Transactional data</h3>
			<p>Transactional data is information about the user's interactions with various websites, services, or widgets which could be used to create a record of a user’s system information, online communications, transactions and other activities, including websites visited, pages and ads viewed, purchases made, etc.</p>
			<p class="issue">Our definition should be technology independent (cookies, flash cookies, etc)</p>
			<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/16">ISSUE-16</a>: What does it mean to collect data? (caching, logging, storage, retention, accumulation, profile etc.)</p>
		</div>

		<div id="tracking" class="section">
			<h3><span class="secno">3.4 </span>Types of Tracking</h3>
			<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/5">ISSUE-5</a>: What is the definition of tracking?	</p>
			<p>Note: This section will obviously be the topic of conversation and will need significant work; the current text merely represents a straw man and a starting point. It may be useful to decide, first, whether we are working to prevent XYZ or allow only ABC.</p>
			<p class="issue">For now, we are using "behavioral tracking" as the term of interest in the scope of this document, though we may want to refer in all cases to "tracking" instead.</p>
			<p>Behavioral tracking is the collection and retention of transactional data about the web-based activities of a particular user, computer, or device across non-commonly branded entities in a form that allows activities across non-commonly branded entities to be attributed to a particular user, computer, or device, over time, for any purpose other than the explicitly-excepted purposes specified below.</p>
			<p class="issue">Depending on the conclusion of first vs. third parties issues, this definition of tracking may not include references to common branding.</p>
			<p>We expect to discuss several activities as potential exemptions including the following:
				</p><ol><li>Third party non-behavioral ad and content delivery.</li>
					<li>Third party analytics and other siloed service providers.</li>
				<li>Certain third party ad reporting.</li>
				<li>De-identified cross-site analytics or market research and/or data that is, with high confidence, not reasonably linkable to a specific user, computer, or device.</li>
				<li>Data collected for fraud prevention and other security purposes.</li>
				<li>Behavioral tracking that is obviously necessary to complete a transaction that the user has affirmatively chosen to engage in.</li>
			</ol><p></p>
			<p class="issue">Should we explicitly identify goals and use cases in order to evaluate these exemptions?</p>
			<p class="issue">We may want to talk about including a data minimization piece to these exceptions</p>
			<p>For the purposes of this specification, here are some examples of activities associated with tracking:
				</p><ol><li>Third party behavioral advertising.</li>
					<li>Non de-identified cross-site analytics or market research.</li>
					<li>Third party behavioral tracking not conducted for an exempted purpose.</li></ol>
			<p></p>
			<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/7">ISSUE-7</a>: What types of tracking exist, and what are the use cases for these types of tracking?</p>
			<p class="issue">Should we address the association of first party data with third party data? What does this standard say about a first party associating offline data from a third party with their own data and then using that in targeting? How about the first party associating it with third party data and/or selling it to a third party? </p>
		</div>

		<div id="not-tracking" class="section">
			<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/34">ISSUE-34</a>: Possible exemption for aggregate analytics</p>
			<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/22">ISSUE-22</a>: Still have "operational use" of data (auditing of where ads are shown, impression tracking, etc.)
			</p><p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/23">ISSUE-23</a>: Possible exemption for analytics
			</p><p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/73">ISSUE-73</a>: In order for analytics or other contracting to count as first-party: by contract, by technical silo, both silo and contract</p>
			<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/24">ISSUE-24</a>: Possible exemption for fraud detection and defense</p>
			<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/25">ISSUE-25</a>: Possible exemption for research purposes</p>
			<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/28">ISSUE-28</a>: Exception for mandatory legal process</p>
			<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/75">ISSUE-75</a>: How do companies claim exemptions and is that technical or not?</p>
			<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/31">ISSUE-31</a>: Minimization -- to what extent will minimization be required for use of a particular exemption? (conditional exemptions)</p>
			<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/36">ISSUE-36</a>: Should DNT opt-outs distinguish between behavioral targeting and other personalization?</p>
			<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/74">ISSUE-74</a>: Are surveys out of scope?</p>
			<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/92">ISSUE-92</a>: If data collection (even very specific with IP address, user agent, referrer) is time-limited, with very limited retention, is that still tracking?</p>
			<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/72">ISSUE-72</a>: Basic principle: independent use as an agent of a first party</p>
			<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/89">ISSUE-89</a>: Does DNT mean at a high level: (a) no customization, users are seen for the first time, every time. (b) DNT is about data moving between sites.</p>
			<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/97">ISSUE-97</a>: Re-direction, shortened URLs, click analytics -- what kind of tracking is this?</p>
		</div>

		<div id="deidentified" class="section">
			<h3><span class="secno">3.5 </span>De-identified data</h3>
			<p class="issue"> If we provide an exception for de-identified cross-site research/analytics, we will need to define de-identified data .</p>
					<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/20">ISSUE-20</a>: Different types of data, what counts as PII, and what definition of PII</p>
					<p class="issue">Note: this may be irrelevant - the rest of the spec does not mention PII</p>
		</div>

		<div id="consent" class="section">
			<h3><span class="secno">3.6 </span>Consent</h3>
			The term “affirmative, informed consent” is used throughout this document. While this terminology may ultimately be modified, some options for explaining the underlying idea are presented below:
			<p></p>
			 Option:
				<ol><li>"Affirmative, Informed Consent to be Tracked" means consent given by an affirmative action such as clicking a consent box in response to a clear and prominent request to ignore a "Do Not Track" setting that is distinct and separate from any other notifications or requested permissions.</li>
					<li>"Affirmative, Informed Consent to be Tracked" means that the a mechanism to provide for or facilitate the acquisition and storage of permission to ignore the header has been made available to the user and the user has meaningfully interacted with the mechanism in a way that makes clear her intent to grant this permission.</li>
					<li>No definition, leaving the definition of consent to local rules.</li>
					</ol><p></p>
			<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/69">ISSUE-69</a>: Should the spec say anything about minimal notice? (ie. don't bury in a privacy policy)</p>
		</div>

		<div id="meaningful-interaction" class="section">
			<h3><span class="secno">3.7 </span>Meaningful Interaction</h3>

			<p>One option for the definition of meaningful interaction is:</p><ol><li>"Meaningful
Interaction" with a widget or window initially presented on a
third-party basis means affirmatively clicking on such content (except
to stop, close, silence, or otherwise impair the rendering of such
content) or otherwise engaging with the content in a manner that would
reasonably be interpreted to express an intention to interact with that party. A user merely moving her cursor across the widget or window does not constitute "meaningful interaction." </li></ol><p></p>
		</div>
	</div>


	<div id="compliance" class="section"><!--OddPage--><h2><span class="secno">4. </span>Compliance with an expressed tracking preference</h2>

		<div id="first-party-compliance" class="section">
			<h3><span class="secno">4.1 </span>First Party Compliance</h3>
			<p>Options:</p>
			<ol>
			<li>This standard imposes no requirements on the operators of first-party entities.</li>
			<li>If the operator of a first party domain receives a request to which a DNT header is attached, that operator <em class="rfc2119" title="must not">must not</em> transmit behavioral tracking data in identifiable form about that user to a third party with the intention or knowledge that the third party shall store and use the data in a way that links that data to other information about a specific person or device, UNLESS that operator has received the affirmative, informed consent to be tracked and such consent has not been subsequently rescinded.</li>
			</ol>
			<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/55">ISSUE-55</a>: What is relationship between behavioral advertising and tracking, subset, different items?</p>
			<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/17">ISSUE-17</a>: Data use by 1st Party</p>
			<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/30">ISSUE-30</a>: Will Do Not Track apply to offline aggregating or selling of data?</p>
			<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/54">ISSUE-54</a>: Can first party provide targeting based on registration information even while sending DNT</p>
			<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/59">ISSUE-59</a>: Should the first party be informed about whether the user has sent a DNT header to third parties on their site?</p>
			<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/9">ISSUE-9</a>: Understand all the different first- and third-party cases.</p>
			<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/91">ISSUE-91</a>: Might want prohibitions on first parties re-selling data to get around the intent of DNT</p>
		</div>

		<div id="intermediary-compliance" class="section">
			<h3><span class="secno">4.2 </span>Intermediary compliance</h3>

			<p class="issue">This issue is being addressed in the Tracking Preference Expression specification.  </p>
			<p class="issue">ISSUE-95: May an institution or network provider set a tracking preference for a user?</p>
		</div>

		<div id="third-party-compliance" class="section">
			<h3><span class="secno">4.3 </span>Compliance by a third party</h3>
			<p>If the operator of a third-party domain receives a request to which a DNT header is attached, that operator <em class="rfc2119" title="must not">must not</em> engage in behavioral tracking of that user UNLESS that operator has received the affirmative, informed consent of that user to be tracked and such consent has not been subsequently rescinded. If data is collected for an excepted purpose, the operator <em class="rfc2119" title="must not">must not</em> use that data for any other purpose.</p>
			<p>If the operator of a third-party domain receives a request to which a DNT header is attached, that operator <em class="rfc2119" title="must not">must not</em> use previously collected behavioral tracking data to inform the third party's decision as to what content to render for the user in response to the request, or otherwise alter the user's experience based on the previously collected behavioral tracking data UNLESS that operator has received the affirmative, informed consent of that user to be tracked and such consent has not been subsequently rescinded.</p>
			<p>If the operator of a third-party domain receives a request to which a DNT header is attached, that operator <em class="rfc2119" title="must">must</em>/<em class="rfc2119" title="should">should</em>/<em class="rfc2119" title="may">may</em> delete previously collected behavioral tracking data about that user, EXCEPT that operator <em class="rfc2119" title="may">may</em> retain previously generated reports based on data about aggregated behavioral tracking data from multiple users' data even if those reports were based in part on previously collected behavioral tracking data about that user.</p>
			<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/19">ISSUE-19</a>: Data collection / Data use (3rd party)</p>
			<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/88">ISSUE-88</a>: different rules for impression of and interaction with 3rd-party ads/content</p>
			<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/32">ISSUE-32</a>: Sharing of data between entities via cookie syncing / identity brokering</p>
			<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/71">ISSUE-71</a>: Does DNT also affect past collection or use of past collection of info?</p>
		</div>

		<div id="sensitive" class="section">
			<h3><span class="secno">4.4 </span>Compliance regarding Sensitive Information</h3>
			<p>This specification does not provide for heightened levels of protection for sensitive categories of data, including children's data. </p>
			<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/15">ISSUE-15</a>: What special treatment should there be for children's data?</p>
		</div>
	</div>

	<div id="users" class="section">
		<!--OddPage--><h2><span class="secno">5. </span>User interactions</h2>
		<p>How should tracking and the availability of choices regarding tracking be conveyed to users?</p>
		<p class="issue"> Is this in scope for the document?</p>
		<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/41">ISSUE-41</a>: Consistent way to discuss tracking with users (terminology matters!)</p>
		<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/37">ISSUE-37</a>: Granularity based on business types and uses</p>
		<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/38">ISSUE-38</a>: Granularity for different people who share a device or browser</p>
	</div>

	<div id="interaction" class="section">
		<!--OddPage--><h2><span class="secno">6. </span>Interaction with other tools</h2>

		<div id="overrides" class="section">
			<h3><span class="secno">6.1 </span>How should a tracking preference interact with user overrides?</h3>
			<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/66">ISSUE-66</a>: Can user be allowed to consent to both third party and first party to override general DNT?</p>
			<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/67">ISSUE-67</a>: Should opt-back-in be stored on the client side? [Not sure this doesn't belong in the technical spec]</p>
			<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/83">ISSUE-83</a>: How do you opt out if already opted in?</p>
			<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/93">ISSUE-93</a>: Should 1st parties be able to degrade a user experience or charge money for content based on DNT?</p>
		</div>

		<div id="interactions" class="section">
			<h3><span class="secno">6.2 </span>Interaction with existing user privacy controls</h3>
			<p>If the operator of a third-party domain receives a request to which there is no DNT header attached but detects that it has set an "opt-out" cookie for that particular device, the operator <em class="rfc2119" title="may">may</em> comply with the behavioral tracking prohibitions on third-party domains that receive the DNT header as specified in x.x (currently 4.3) of this specification, and <em class="rfc2119" title="must">must</em> comply with the assurances that the operator previously made to the user in association with the user "opting out" from the third party and the setting of the opt-out cookie.</p>
			<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/35">ISSUE-35</a>: How will DNT interact with existing opt-out programs (industry self-reg, other)?</p>
			<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/52">ISSUE-52</a>: What if conflict between opt-out cookie and DNT?</p>
			<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/53">ISSUE-53</a>: How should opt-out cookie and DNT signal interact?</p>
			<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/58">ISSUE-58</a>: What if DNT is explicitly set to 0 and an opt-out cookie is present?</p>
			<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/56">ISSUE-56</a>: What if DNT is unspecified and an opt-out cookie is present?</p>
			<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/57">ISSUE-57</a>: What if an opt-out cookie exists but an "opt back in" out-of-band is present?</p>
			<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/33">ISSUE-33</a>: Complexity of user choice (are exemptions exposed to users?)</p>
			<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/65">ISSUE-65</a>: How does logged in and logged out state work</p>
		</div>

		<div id="education" class="section">
			<h3><span class="secno">6.3 </span>User Education and Communication</h3>
			<p>How do we educate and communicate with users? Is that out of scope?</p>
		</div>

		<div id="enforcement-compliance" class="section">
			<h3><span class="secno">6.4 </span>Enforcement/Compliance</h3>
			<p class="issue"> If there is a response header, this is likely unnecessary</p>
			<p>Options:</p><ol><li>In order to be compliant with this specification, an operator of a third-party domain must either do no behavioral tracking, or make a public statement or otherwise deliver a statement to the user asserting intent to comply with the header. </li><li>In order to be compliant with this specification, an operator of a third-party domain must make a public statement or otherwise deliver a statement to the user asserting intent to comply with the header.</li><li>In order to be compliant with this specification, an operator of a third-party domain must either not engage in behavioral tracking or clearly and unambiguously assert in the privacy policy governing that domain that it is in compliance with this specification.</li></ol><p></p>
			<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/21">ISSUE-21</a>: Enable external audit of DNT compliance</p>
			<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/45">ISSUE-45</a>: Companies making public commitments with a "regulatory hook" for US legal purposes</p>
		</div>
	</div>

	<div id="misc" class="section">
		<!--OddPage--><h2><span class="secno">7. </span>Random issues for triage</h2>
	    <p>This specification does not place limitations on the use of geolocation technologies by the operators of third-party domains.</p>
	   	<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/39">ISSUE-39</a>: Tracking of geographic data (however it's determined, or used)</p>
		<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/12">ISSUE-12</a>: How does tracking require relation to unique identities, pseudonyms, etc.?</p>
	    <p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/14">ISSUE-14</a>: How does what we talk about with 1st/3rd party relate to European law about data collector vs data processor?</p>
		<p class="issue">Do we need a section on existing law/relationships etc?</p>
	</div>
	<div id="not-scope" class="section">
		<!--OddPage--><h2><span class="secno">8. </span>Out of Scope or Postponed Issues</h2>
		<p class="issue"><a href="http://www.w3.org/2011/tracking-protection/track/issues/94">ISSUE-94</a>: Is "Do Not Track" the right name to use?</p>
			<p></p><ol><li>To what extent does the definition of tracking need to equal the dictionary definition?
				<ol><li>Could create user confusion if the definition does not comport with dictionary.</li></ol></li>
				<li>Could deal with confusion through education and messaging; we're dealing with a technical standard here, not a dictionary of common usage. User is never going to guess the meaning correctly all the time.</li>
				<li>To what extent does the term "Do Not Track" have investment behind it, and to what extent must it reflect the end specification? Should the phrase as slogan stay if the end definitions do not support it exactly?
					<ol><li>Momentum behind the name as a slogan</li>
						<li>The urge to define "tracking" stems from the concern that  "do not track" sounds like it will forbid all tracking.  That, of course, also is not our intention so we feel compelled to redefine the word "track" to curtail its scope (in more of a legal document type of context).</li></ol></li>
				<li>To what extent must the definition minimize confusion?</li></ol><p></p>
	</div><div id="references" class="appendix section"><!--OddPage--><h2><span class="secno">A. </span>References</h2><div id="normative-references" class="section"><h3><span class="secno">A.1 </span>Normative references</h3><p>No normative references.</p></div><div id="informative-references" class="section"><h3><span class="secno">A.2 </span>Informative references</h3><p>No informative references.</p></div></div></body></html>