Browser, Advertiser Arms Race Likely If W3C Fails, Stakeholders Say

The W3C stakeholders are “working hard” to meet the July deadline, said Peter Swire, the group’s co-chairman. “A ton of work has happened this week.” He encouraged attendees to read the stakeholder emails, posted on the W3C site (http://bit.ly/12jc7Kp). The group has “a very cleaned-up text” in its draft from this month, he said.

Industry representatives submitted proposed changes to the group’s draft prior to the weekly stakeholder call earlier this week (http://bit.ly/17FBzi2). The changes focus on data retention and “data hygiene” policies, said Mike Zaneis, senior vice president of the Interactive Advertising Bureau. The changes would establish “a way to have data minimization and de-identification standards put in place for all DNT users,” which would be a meaningful step toward privacy without radically affecting the business models in the online advertising industry, he said. “We could support a W3C standard around de-identification."

The industry proposal is “a huge change” from what the W3C stakeholders have been working on, said Aleecia McDonald, director-privacy at Stanford University’s Center for Internet and Society and former co-chairwoman of the W3C group. Initially, the goal of the W3C process was to create a way for users to express whether they want to be tracked online; then it became about limiting the ways third parties could use the data they collect from tracking users; now, it’s been reduced to requiring companies to inform users -- through their privacy policies -- how long those data are kept for, she said. “We've moved from limits on collection to ‘we will note in our privacy [policy] how long we keep this data.'” McDonald told us the industry proposals are not productive, as they bring up old issues and move further away from what the consumer advocates want. “There’s been activity in the last week, but not necessarily progress,” she said.

There remain major obstacles to the W3C stakeholders reaching consensus on a DNT mechanism, said Jonathan Mayer, a Stanford graduate student who participates in the W3C group and has worked with privacy advocates and browsers on cookie blocking. “We don’t agree on whether websites can set unique ID cookies in a browser,” he said. “This isn’t small stuff.” Stakeholders are also still debating how a browser must obtain user consent for DNT, he said.

Mayer said he hopes the group will meet its July deadline, but the group is “regrettably stuck.” If the group can’t reach consensus by the end of next month, it has a few options, including walking away, he said. The group could push back the deadline -- which would be “a little irresponsible” -- or “publish a vague text that doesn’t have a lot of substance,” which would also be counterproductive, he said. The group’s co-chairs could create a final draft without the group’s consensus, though this approach would have “serious legitimacy issues,” he said.

An arms race between browsers and trackers will likely develop if the W3C process fails, stakeholders said. “An arms race can develop between advertisers and user agents,” with “increasing measures and countermeasures” to protect consumer privacy and collect data, Swire said. An arms race like that “will serve no one,” said David Vladeck, former director of the FTC’s Bureau of Consumer Protection and current Georgetown University law professor. That’s “not a foundation for growth,” and is “no one’s vision for the future,” he said. Ultimately, technology companies have an incentive to provide users with the privacy mechanisms they want, said Ed Felten, former FTC chief technologist and current computer science and public affairs professor at Princeton University. “At the end of the day, the users and the user agents have the advantage in that arms race,” he said. “What users want can happen."

Browsers are already working to prevent tracking of their users, Mozilla and Microsoft representatives said. Microsoft’s Internet Explorer 11 will allow websites to ask for permission to track users who have DNT enabled, said Chief Privacy Officer Brendon Lynch. Through the IE11 preview, “a website can request an exception by asking permission to track users as they browse the site,” said the company’s website (http://bit.ly/1crkdlB). “If the user approves the request, Internet Explorer records an exception to the ‘Do not track’ rule and sends headers to the website that allow tracking.” Lynch said a successful W3C process would be preferable to an arms race. “Coming to a multistakeholder agreement is the ideal way to go,” he said.

Mozilla last week signaled its support for the Cookie Clearinghouse -- a Stanford project that would assist browsers in identifying which third-party cookies users with DNT enabled should see. “We view that as a responsible step forward,” said Mozilla Global Privacy & Public Policy Leader Alex Fowler. “Hopefully, a number of industry folks will get involved.” Fowler called on privacy and consumer advocates to more vocally support steps like Mozilla’s decision to support the Cookie Clearinghouse. “Ironically, we had more support from the industry ... than we did from the privacy community” when Mozilla announced its decision, he said.

Legislation is also a possibility if the stakeholders fail to come to consensus on DNT, presenters said. “Many in Congress will be more than disappointed if the stakeholders fail to reach an agreement,” Vladeck said. A W3C impasse “would demand action by Congress, prompted, likely,” by the White House, he continued. Vladeck predicted a DNT mechanism in the near future, “by consensus or compulsion.” Christopher Olsen, assistant director of the FTC’s Division of Privacy and Identity Protection, said he and others at the agency would prefer to see a stakeholder agreement succeed. “I don’t think the time is right” for legislation, he said. There are people in Congress who would support legislation, especially if the W3C process stalls or fails, he continued. “Perhaps if there’s an extension, that will send a signal for folks on the Hill."

Legislation would not necessarily enhance consumer privacy, said Erin Ryan, legislative counsel for Rep. Jackie Speier, D-Calif. “I'm not terribly optimistic in the current congressional environment that we can do anything real,” she said. Instead of legislation that gives users meaningful privacy options, Congress might produce “a Band-Aid” that would be “touted as something significant” and just appears to provide more privacy. “The worst thing we could do is pass legislation that tells people they have privacy when they really don’t,” she said. Ryan said she has “been somewhat optimistic” about the W3C process but would be “concerned” about the potential for real progress on privacy in Congress.