Re: [Pearg] Call for adoption: draft-learmonth-pearg-safe-internet-measurement-02.txt

[Vittorio Bertola <[e-mail]>]

Il 27 maggio 2019 15:34 Eric Rescorla <[e-mail]> ha scritto:

S 2. CONSENT
The text in this draft leans pretty heavily on getting consent,
either direct consent (including all users of the shared network)
or "proxy consent".

However, many of these kinds of studies don't really lend themselves
to detailed consent from individual users of the browser -- let alone
to from every user on the network they are on. As a concrete example,
ad-type studies don't generally get any kind of consent at all.  For
instance, here's the experimental setup for APNIC's DNSSEC
measurements: https://labs.apnic.net/?p=341" rel="nofollow">https://labs.apnic.net/?p=341

    The experiment uses an online advertisement campaign to deliver
    the test code to end systems. When the end system is passed an ad
    that is carrying the experiment the system runs embedded Adobe
    Flash code. The code is executed when the ad is passed to the
    user, and does not rely on a user "click" or any other user
    trigger action. The active code interrogates one of two experiment
    controllers by performing a URL fetch. The contents of the fetched
    experiment control URL are a dynamically generated sequence of
    four URLs. These four URLs are the substance of the test setup.

It's worth noting at this point that the Web is a platform for running
remote code, and by browsing you're opting into that, and ad studies
just leverage that behavior.

That's not very accurate, at least under European regulations. It's not "by browsing you're opting into that", it's rather that each website shows you a cookie consent popup, and that's where you provide your consent and opt into receiving various types of cookies, including the ones that make ad-based experiments work. If you reject advertising/customization cookies, of course the ad-based experiment should not work. On top of that, the text asking for consent to these cookies should specify that you will not just be shown customized ads, but that personal information about you will be collected.

By the way, the fact that "these kinds of studies don't really lend themselves
to detailed consent from individual users of the browser" is not a legally valid justification for doing these studies without explicit user consent, at least if they collect personal information and unless they fall into a well specified set of exceptions.

Ciao,

--

Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
[e-mail] 
Office @ Via Treviso 12, 10144 Torino, Italy