Separating Publisher and Advertising Technology Concerns in Success Criteria Will Create Needed Depth

[AramZS]

Adding comments inline and questions and reasoning below.

[AramZS]

What follows is the reasoning for the proposed changes.

[AramZS]

This combines two separate technical concerns, contextual-based tracking activity, which does not require de-anonymizing users to perform, and behavioral-tracking which is a very different set of technical concerns, even to the extent that they are covered by regulatory policies. . Behavioral tracking has a significantly larger scope, of which mapping consumption of content might be considered a part, but not a whole, We need to consider how technology involved in behavioral tracking represents a unique relationship to cross-site behavior and concerns. "Content consumption activity" does not define "behavior" which should also include tracking of geolocation, IP level data, system level data, Bluetooth beaconing, and network level data, all of which concern all of us in this group. I would like to discuss some changes in this phrasing to make the separation of concerns here clearer.

[AramZS]

JMK: Aram correctly points out that targeting based on current content consumption is distinct from targeting based on past content consumption. However, he believes attributes based "behavior" should be expanded to the non-text-based "contextual" factors of device, connection, geolocation factors.

I believe we should keep these important factors grouped into at least one distinct set of factors from content consumption activities--since the latter has far more privacy risks than bandwidth speed or device type choices by people.

My response:

I firmly disagree that these factors should be grouped into a single concern. Multiple investigations have shown that bandwidth speed and device type (among a number of other behavioral identifiers, including a variety available to apps) are both primary in the use of 1 to 1 identification of devices and users and that the process of identification to a single user via their device fingerprint or geolocation has caused significantly more concern to web users than the idea that they consumption of particular content might de-anonymize them. The significant thing here is that the chance of content consumption identifying a user goes down significantly if that user's information is stripped of device factors. As such these are significantly different behaviors that we must engage on in a separate basis.

I really don't think we can move forward unless we separate these factors (context-based tagging of users vs behavioral and fingerprint tagging) into different concerns, especially because they have radically different technical requirements.

[AramZS]

Most publishers would, I suspect, find points of difference from ad technology companies in concerns and descriptions of success. For example the two parties have different requirements in their interactions with users and see different regulatory issues in legal frameworks. I think we need to revise this representation as it stands here and throughout. We should aim for a more appropriate separation of concerns to resolve some of the issues privacy, both as a technical and legal challenge, brings forth. I’d like feedback from the authors about how we can rephrase this section to make those changes clearer.

[darobin]

Much agreed. Success criteria between publishers and adtech have historically not be in full alignment and conflating them won't bring clarity to the discussion. Success criteria for each should be produced separately, and then the community can decide what to focus on in terms of priorities and which to favour in case of conflict. Adtech is not represented in the Priority of Constituencies, which I would say is a bug.

[AramZS]

JMK: Aram correctly points out that publihsers and ad tech companies' interests are not always aligned and hence their concerns and requirements should be clearly called out, so developers can understand how their specifications may impact them.

However, this document does attempt to distinguish their distinct concerns and requirements. I would more granular feedback as to which interests or concerns are not yet included but should be.

My response:

I agree with @darobin here, these two interests need to be clearly delineated overall in order to find a solution. Otherwise we are essentially tricking ourselves into solutions that will degrade both relationships and interests between both parties down the line. Clear delineated constituencies are one of the things my edits attempt to bring to this document overall.

I do not have an edit given here, but I highlighted this specific phrasing because it definitely implies that these interests are the same. (emphasis mine)

This document considers web advertising from three points of view[POINTS]: that of individual web users (both in aggregate and individually), publishers and their partners (both authors and the business model that funds them) and the delivery access mechanism (both connectivity and navigation).

makes it seem to me that the document intends to bucket interests as follows:

• web users
• publishers and their partners
• delivery access mechanisms

as indicated by the phrase 'three points of view'. I disagree with the idea that these represent three coherent singular points of view. There are arguably at least four (separating publishers from ad tech) but could be more than that. I'm not sure if it even makes sense to try and represent all four of those views within a single document, because in some cases those points of view may differ radically (an ad exchange, for example, prioritizes scale to an extent that drives their interests in a far different way than a local paper). As noted by @darobin it might even make sense, because these interests differ, to split them into different documents for clarity's sake. (Especially considering that one could argue that even publishers on their own do not constitute a monolithic single view, though that is an argument for another time.) But even if we do not do that, we need to make it clear up top that the publisher and ad tech concerns are not a singular coherent point of view. And developer changes will impact those concerns very differently which we would want to create feedback around and a conversation for such changes that would allow participants to weigh and understand those different impacts to different parties and interests.

[jwrosewell]

The document updated yesterday starts to break out these differences. I think more work is needed and would like to setup a conference call to resolve this point across multiple contributors.

[AramZS]

Open functioning societies suppress technology all the time, electric chairs, polluting exhaust systems, microbeads, etc... just to name a few. While you could argue that these are more general tech categories on which societies apply regulations, I would say that this - in a statement document that I presume wants publisher support - is over-extensive in its descriptive scope and counter some of the public arguments that publishers have made in regard to specific web technologies. Indeed, some look towards the active end of 3p as a suppression of an incorrectly adopted technology. Marking for removal. Suggested replacement to handle these concerns and focus in on the societal impact that concerns us, along with the specific focus we should have as a group.

[darobin]

Trust is essential to publishers, and third-party tracking (by data controllers) is a violation of trust. The progressive disappearance of third-party tracking mechanisms is an opportunity to make the Web more publisher-friendly and much more in line with user expectations.

Historically, advertising has acted as a subsidy on content production that has been key to ensuring that access to quality journalism is not a luxury good. But the manner in which digital advertising has evolved has instead made privacy into a luxury good such that only those who can forgo the subsidy from advertising can have privacy. Both privacy and journalism are cornerstones of democracy; people should not have to choose between them.

I agree with the goal of defining what acceptable data processing is for the Web and hope to submit a proposal along those lines (to another group). I think that is best left as a general consideration.

[jwrosewell]

@darobin I'm aligned on your statements related to the need to define acceptable data processing and that people should not have to choose between privacy and access to quality journalism.

We also agree that advertising funds the majority of people's access to web content, including quality journalisim. Accordingly we highlighted this access as an important success criteria for any proposal.

As we improve the web to make it more user friendly and publisher friendly, we need to ensure that marketers funding of people's access is not undermined whilst respecting people's trust choices.

In relation to improving web advertising this document does outline some requirements concering data processing by publishers, advertisers and their supply chain. I look forward to reading your draft document on acceptable data processing when it is ready.

[AramZS]

'degrade the efficacy' is poorly defined and implies that the current suite of proposals would do so, but that is not clearly proven. Propose we rephrase.

[AramZS]

The section starting with 'While end users...' does not encompass all relevant interests. We should add detail here to be clear about all the interests we wish to understand and handle with any feedback within this group.

[AramZS]

JMK: Multiple studies have shown that as you degrade the accuracy, granularity, and timeliness of the data feeding algorithms the worse they perform -- hence the efficacy of marketers' algorithms will be degraded as we reduce the quality of inputs into them.

I agree with the the rephrasing, but suggest it is incomplete as it leaves out the above point.

This comes back to the top point - the worse they perform compared to what? I don't think a 'worse' or 'better' performance is the primary concern we need to engage with so much as the processes that exist and if we need those processes to continue. I am not sure it is useful to try and set the bar at 'zero degradation'. As such, unless you have a more specific phrasing here to consider, I think we should leave this edit as is.

[AramZS]

Interoperable networks in general and this one in specific does not just require improved documentation but also improved and reliable controls. As an example: publishers may want to set specific higher levels of privacy beyond defaults while still using vendors that can serve more than one site. Proposed rephrase.

[darobin]

I think it's important to think beyond transparency & control. Those defined ethical data processing in the 70s, but things have changed a bit since.

[AramZS]

Not exactly correct in original phrasing as far as I can see. I think the correct phrasing would be as changed here.

[AramZS]

Non-specific. What, in this context, is content consumption? In the previous uses of the phrase in this document it seems like you are implying 'behavioral' trends here. I think it would be better to be more specific about the general, non-technical, requirements and leave the question of the technical fulfillment of those requirements to other documents.

How about this instead?

[AramZS]

Too general. How about this replacement.

[darobin]

This would benefit from a clearer definition of publishers, too. The definition that adtech has usually used for this has been "anything with inventory". I can write fart apps and torchlight apps that'll turn a profit at any scale. That's not the same as what people usually think of as publishers.

[jwrosewell]

"Publishers" is defined using the W3C terminology listed here. This ensures the term "Publisher" will be familar to all W3C members across multiple documents.

I think your point is to distinguish between all publishers from quality publishers, which is the function of the healthy market operations, whereas the prupose of this document is to ensure an open market exists, and the impact on this market. This document can help authors evaluate their proposals even at the conceptual stage to ensure they're improving the web.

[wseltzer]

Where did you find that piece of history? A 1999 working draft is probably not the most useful reference for an evolving ecosystem. It's fine to adopt new more specific definitions for a new document.

[jwrosewell]

I've seen it used as a normative source in other relatively recent W3C documents so used it to ensure terms would be familiar to W3C participants rather than redefine them. I don't recall exactly which document it was in.

[AramZS]

Not enough under this section. As a publisher we have a number of additional concerns that we’d like to see here. Proposed additions follow.

[AramZS]

Should include this.

[AramZS]

Fig. 1 "Ethical data protection and processing protects freedom"

This figure should break out advertising technology vendors as a separate interest group. Theoretically one that sits in the center of the triangle. This is a more accurate representation considering the large marketplace footprint of companies that are solely ad technology and will give us a better representation of the concerns involved.

[AramZS]

Fig 2: "Advertising Funds the Open Web"

The role of "Access providers" here is unclear. I assume the intent is to note the role of browsers, the caption is, however, not illustrative of the interests of browsers. This figure also erases the role of ad technology in the ecosystem as a system connecting marketers and publishers. This image should be adjusted to make the relationships clearer.

[AramZS]

Fig. 3 "Choice Improves Value" lacks clarity.

I don't find it particularly readable or informative and it should either be struck from the document or revised.

[AramZS]

Issues with Sources:

• Major publishers disagree over if the Google study cited at Impacting these marketer interests, reduces publishers' revenue earned represents an accurate window into the future or even meaningful data overall in predicting the impact of a systemwide change. We should remove the reference to it.

• This document cites some GDPR documents but does not cite meaningful privacy definitions and examinations that impact our overall consideration of what privacy means. Lacking a presence here are almost all of the cited works at https://www.eff.org/issues/international-privacy-standards. While I do not presume that every source linked there needs to be present in this document, the GDPR isn't the only definition of privacy and we should consider more contexts then a single source.

[AramZS]

The two opening comments require feedback from the author, as I do not propose a specific change, but would like to open a discussion here about how to make them more precise, as I have indicated in the comments. So let's not merge this PR until we resolve those discussions especially.

[darobin]

I agree that we really should not cite that Google study. People in adtech should know better than most that it doesn't hold water. If it were in a peer-reviewed publication it would almost certainly have been retracted already.

[jwrosewell]

@AramZS @darobin and others.

Thank you so much for comments and amendments. If like me you find GitHub hard to work with when it comes to group documents I have shared Word links to the documents. They are here.

1. Success Criteria
2. Self-Review Questionnaire: Interoperability, Choice, Accessibility and Accountability

As the document does not require authentication you'll edit as a guest. Could you add your name or initials next to comments or changes so we can see who made them.

I've copied @AramZS comments and amendments across from this pull request.

[jwrosewell]

@darobin @AramZS - Garrett Johnson presented these slides a month ago to the group. Facebook added a slide on their results. Could this collection of studies be used?

[darobin]

It's been a while since I looked at that group of studies, but my recollection is that they are all about the wrong counterfactual. They look at this question: "In a world in which everyone is doing 3PBT and therefore everyone expects it, what is the cost to one participant refusing to do 3PBT?" But the actual question of interest is "What is the cost to participants if the entire world stops doing 3PBT such that it is not expected by the market?"

[joshuakoran]

Thank you Robin for pointing out that the existing studies compare marketers’ valuation of publisher inventory when they have and do not have access to a pseudonymous userID. If the W3C and browser community were removing all userIDs and all behavioral targeting, then your proposal of revising the analysis over the change in marketer value that relies on all market actors not having user IDs would indeed be useful.

However, the proposed change reduces or eliminates three existing value-drivers for the inventory of small publishers:

1. cross-publisher and cross-domain use of userIDs that impacts marketers control over media spend (e.g., frequency capping),
2. interest-based advertising (which is increases in value to marketers when smaller publisher inventory is enhanced by behavioral data associated with prior activities beyond the publisher’s property), and
3. measurement of its effectiveness (e.g., multitouch or view-through attribution).

We can likely agree that the largest publishers who will be able to provide frequency capping at scale and interest-based advertising at scale will be impacted less than the smaller publishers by the proposed changes. Indeed, the Google study looked at their largest publishers and found there was a greater impact on the smaller publishers than the largest, even when looking only within the largest publishers they monetize.

Moreover, the detailed findings within the CMA final report provides further evidence of the lack of a level playing field that would be exacerbated without greater interoperability. Publishers like DMG, News Corp, Telegraph, Guardian, among many others contributed extensively to those findings.

We may disagree around the net benefits of the tradeoffs proposed changes, but I hope we can all agree that they would negatively and disproportionately impact smaller publishers more than larger ones.

[jwrosewell]

@AramZS - Joshua Koran and myself have been through the suggested changes and comments in the word version of the document. The responses and changes are now ready for your review. If you could mark the comments / changes as resolved in the comment where you agree. Where you don't then just mark as needing more discussion and/or add more information. I can then determine how best to settle the differences between multiple contributors. In the main any adaption has been to recognise the needs of marketers to understand what happens after an ad is served across the whole campaign, and recognising that some societal issues vary in different geographies.

Thank you so much for adding to and improving the publishers perspective on these important issues. It will be interesting to learn how close the document now is to other publishers positions.

[darobin]

@joshuakoran I do not deny that there is value in frequency capping, interests targeting, and measuring effectiveness (though I have a healthy level of doubt with respect to the idea that anyone is doing multitouch credibly, and even a lot of VT is of dubious quality). However I don't believe that user IDs is necessarily the only way to achieve these outcomes.

Are you saying that you think that putting a price on vanishing 3P identifiers should look not just a 3P targeting but also these other aspects? If so, why not, but then it should also include costs such as the loss of audience value due to leakage to third parties. I'm not sure anyone has those numbers? Alternatively, if you're simply using these numbers to establish, say, frequency capping as a valid use case I don't think that's necessary. It's clearly a top demand from marketers, and if we can deliver it without undue risk then I think it's a done thing. (That assessment will be harder for targeting since the risks aren't just to privacy, but also to fairness.)

Sure enough, relying on IDs is easier. It's a shame there was no self-regulation to keep them safe for users and publishers.

[joshuakoran]

@darobin We agree that the various marketer use cases above each factor into the how marketers value inventory and hence their demand for those sources that will provide it.

My point was that most of these use cases will still be available within the largest vertically-integrated publishers, whereas the current proposals diminish the timeliness, granularity and accuracy of the data supporting these same use cases when marketers try to advertise across different publishers.

I am not debating that many people believe this to be an appropriate tradeoff. I am merely asking we acknowledge the foreseeable impact.

[darobin]

@joshuakoran But I think that's precisely the part I don't understand. The whole point of doing standards work is to find solutions, but you seem to be preemptively making the case that this is a net loss instead of potentially recoverable through other means. Or am I missing something?

[AramZS]

I agree with @darobin here - the fundamental argument that is being set forward with these data samples is that there can only be losses and those losses are unpreventable, but I don't think that's the case from our perspective. I obviously can't speak for all publishers here, but in my personal industry experience working with a variety of publisher sizes and looking at the current state of the marketplace I think it would be inaccurate to say that the current status quo works in a way helpful to small publishers, much less those of any size. The continued failure of many small and medium-sized publishers seems to show that the current state of 3p (or the footprint of ad tech in general) does not help them stay afloat. If it did surely less of them would be shutting down right? And the idea that an overall change in technology would impact marketer spend seems unlikely too. Changes in technology have been ongoing within web advertising for two decades plus now and spend seems to only be going up.

I agree we need to handle certain measurement, fraud and frequency use cases in whatever the future technology is, but our current status quo does not have to be the only way to do so.

I will examine the word document shortly.

[AramZS]

In the interests of clarity, I'm copying over some direct responses to my comments to here and my responses.

[AramZS]

I struck these examples. Response is:

JMK: Should OECD (https://www.oecd.org/) be cited about the needs to regulate inappropraite or unethical uses of technology?

[AramZS]

JR: I would delete this section. It is wrong to focus on one data protection principle, in this case accountability, in the absence of the others. In addition, it is not tenable to claim that accountability creates a requirement for “each participant that has access to data collection and processing to abide by its responsibility not to abuse the data under its control”. Data protection law does not say that data should be widely shared in order that recipients can decide whether to then protect it, and account for their actions. On the contrary, it says the opposite: data must not be exposed to unnecessary risk. This entire section should be removed.

[JWR] Article 24 of GDPR requires Controllers to “implement appropriate technical and organisational measures to demonstrate processing is performed in accordance with this regulation”. For this reason I think the paragraph is compatible with the GDPR. Could you advise if there is a better interpretation of Article 24?

I think my changes here around transparency and control lend a potential level of specificity to resolve this conflict, but it seems from this comment that it might make sense to make the ideas of "transparency" more clearly defined. I'm not sure who JR is? But would adding some more details here around transparency required for data handling under both a desire for accountability and a concern for regulation help with these questions?