Re: [Pearg] Call for adoption: draft-learmonth-pearg-safe-internet-measurement-02.txt

[Eric Rescorla <[e-mail]>]

On Mon, May 27, 2019 at 8:23 AM Vittorio Bertola <
[e-mail]> wrote:

>
> Il 27 maggio 2019 15:34 Eric Rescorla <[e-mail]> ha scritto:
>
>
> S 2. CONSENT
> The text in this draft leans pretty heavily on getting consent,
> either direct consent (including all users of the shared network)
> or "proxy consent".
>
> However, many of these kinds of studies don't really lend themselves
> to detailed consent from individual users of the browser -- let alone
> to from every user on the network they are on. As a concrete example,
> ad-type studies don't generally get any kind of consent at all.  For
> instance, here's the experimental setup for APNIC's DNSSEC
> measurements: https://labs.apnic.net/?p=341
>
>     The experiment uses an online advertisement campaign to deliver
>     the test code to end systems. When the end system is passed an ad
>     that is carrying the experiment the system runs embedded Adobe
>     Flash code. The code is executed when the ad is passed to the
>     user, and does not rely on a user "click" or any other user
>     trigger action. The active code interrogates one of two experiment
>     controllers by performing a URL fetch. The contents of the fetched
>     experiment control URL are a dynamically generated sequence of
>     four URLs. These four URLs are the substance of the test setup.
>
> It's worth noting at this point that the Web is a platform for running
> remote code, and by browsing you're opting into that, and ad studies
> just leverage that behavior.
>
> That's not very accurate, at least under European regulations. It's not
> "by browsing you're opting into that", it's rather that each website shows
> you a cookie consent popup, and that's where you provide your consent and
> opt into receiving various types of cookies, including the ones that make
> ad-based experiments work. If you reject advertising/customization cookies,
> of course the ad-based experiment should not work.
>
On top of that, the text asking for consent to these cookies should specify
> that you will not just be shown customized ads, but that personal
> information about you will be collected.
>

You may be misunderstanding my point here, as these studies don't really
rely on tracking cookies. If you're browsing the Web with JS on, your
browser will execute whatever code it gets served. That's just the nature
of the Web.The reason you use an ad network isn't primarily to take
advantage of tracking behavior but rather to cheaply get a large sample of
users (note that big sites like Google or Facebook can do this without
taking advantage of an ad network). Now, as it happens, ad networks do
generally use tracking cookies, and it's sometimes useful to use that for
targeting, but in general these studies run fine even in environments where
third party cookies are completely disabled, as in Safari ITP or Firefox
ETP.


By the way, the fact that "these kinds of studies don't really lend
> themselves
> to detailed consent from individual users of the browser" is not a legally
> valid justification for doing these studies without explicit user consent,
> at least if they collect personal information and unless they fall into a
> well specified set of exceptions.
>

This isn't really the appropriate place to discuss the legal parameters of
various methodologies, especially as they vary from jurisdiction to
jurisdiction. I would advise people to consult their own legal/compliance
departments rather than relying on advice they got on the Internet.

-Ekr