Do-Not-Track Legislation Delayed Even as W3C Working Group Makes Progress

Despite significant opposition, the W3C DNT working group released its so-called first final draft definitions for “tracking” and “party” (CD Dec 12 p8). The working group issued final definitions for “collect,” “use,” “share” and “facilitate” a week later. Working group co-Chairman Justin Brookman, director of the Center for Democracy and Technology’s Project on Consumer Privacy, told us the group is “still on track” to meet its goal of closing out a technical preference expression (TPE) document by “early 2014,” with a final draft in the months to come. It was the first result the group had produced since shifting its focus to completing a TPE document before deciding whether to move to a compliance document (CD Oct 11 p12). To some, it was the first real result the group had ever produced in its two-plus years of discussions.

"Yes, progress!” Interactive Advertising Bureau Senior Vice President and General Counsel Mike Zaneis told us. “I'm only half kidding -- I think we're gratified we're actually working on tangible definitions so we can scope the project and know what is covered and what is not.” Others said they think the working group is trying to “railroad through” definitions against the group’s wishes, as KBM Group Chief Privacy Officer Brooks Dobbs put it after a November meeting. And some have held firm that the group shouldn’t be defining terms such as “tracking” -- normally part of a compliance document -- in the TPE specification. “The W3C technical specification should concentrate on the pure DNT signaling protocol that is required between the client devices and the server devices,” said Network Advertising Initiative Counsel and Senior Director of Technology Jack Hobaugh.

Meanwhile, the DAA -- a consortium of ad and marketing trade associations -- launched its own DNT discussions in October, saying it was frustrated with the halting W3C talks (CD Oct 9 p16, Oct 15 p12). The DAA’s talks have moved quickly, Direct Marketing Association Vice President-Government Affairs Rachel Thomas told us. With existing compliance documents for such things as online behavioral ads (http://bit.ly/1cXhxj9), the group -- which had roughly 20 people at its first meeting -- was able to quickly agree on the contentions definitions that have stalled the W3C group for years, Thomas said.

"We got further in the first 10 minutes in our first meeting than the W3C has to date,” IAB’s Zaneis said, saying the group knocked out definitions of “tracking” and “collect” immediately. The group has had three meetings, with plans to continue the talks after the New Year, Zaneis and Thomas said. The group’s process has not been public, unlike the W3C process, which is conducted almost entirely over a public email forum (http://bit.ly/1fuVGz8). But like W3C, the DAA group is “hopeful” that its own “set of principles will be finalized by very early next year,” Zaneis said. “The DAA has a strong history of being able to implement and enforce compliance programs.” And compliance should come first, Thomas said: “You do the policy and then you figure out the technology."

With both groups set to wrap their respective documents sometime in early-to-mid 2014, participants have speculated the two might combine W3C’s TPE specification and DAA’s compliance specification for a whole DNT standard. “Putting my consumer hat on, if they can” generate consensus on a compliance document, “great,” Brookman told us after the DAA announced its talks in October. The two groups pull from the same community, and there’s some overlap between the two groups, participants have told us. But the two groups’ work isn’t necessarily related, Thomas said. While “in W3C terms” the DAA document could be considered a compliance document, Zaneis said, it’s more “an extension of DAA principles.” On the other side, “the W3C’s definitions have been written in a vacuum without further context,” Hobaugh said, “and could cause issues down the road when an attempt is made to reconcile these definitions with full compliance regimes” developed by either group.

If neither group -- individually or together -- can produce a successful DNT standard, observers have said Congress and the FTC might step in (CD June 28 p7). No DNT agreement “would demand action by Congress,” David Vladeck, former director of the FTC Bureau of Consumer Protection and current Georgetown University law professor, said this summer at a Consumer Action conference.

Capitol Hill’s focus has turned back to data collection after a long dormancy. Senate Commerce Committee Chairman Jay Rockefeller, D-W.Va., introduced a DNT bill in February (CD March 1 p10), followed by a hearing on the issue in April (CD April 25 p7). Then Congress took a long hiatus from DNT for most of 2013 -- until its final month. Sen. Ed Markey, D-Mass., reintroduced his Do Not Track Kids Act, which would prohibit the collection of personal information for anyone under the age of 13 without parental consent and require user consent for those ages 13 to 15. And the mid-December release of a long-awaited data broker investigation and subsequent hearing on the issue brought consumers’ rights to opt out of data collection to the fore during the Senate’s final week of 2013 (CD Dec 19 p7).

Consumers’ rights to access their own data “meshes nicely with the FTC’s ongoing interest in a universal, simple, persistent, and effective Do Not Track mechanism that allows a consumer to stop companies from mining cyberspace for information about her for marketing purposes,” said FTC Commissioner Julie Brill (CD June 27 p9). Brill and the FTC have encouraged industry stakeholder solutions for both a DNT standard and a method for consumers to access, correct and decline to have data collected about them. Brill has pushed for a centralized online data hub for consumers, an initiative she calls “Reclaim Your Name” (CD Dec 20 p6).

The commission has also been involved with the DNT talks, Zaneis said. The DAA’s definition of “tracking” in its DNT standard allows certain “exceptions” for things such as market research and product development. The FTC “has come to us with” the opinion that “market research is overly broad,” said Zaneis. “You know what, that is a substantive critique of the program.” The DAA working group is attempting to narrow the language to limit data collection to “only what we think of as true market research,” Zaneis said.

Tracking is also on the FTC’s 2014 agenda. The commission plans a Feb. 19 workshop on mobile device tracking. One of the questions set to be addressed: “What information and choices are provided to consumers about this type of tracking?” In 2014, both the W3C and DAA groups hope to help answer that question not just for mobile device tracking, but also for all types of tracking.