Consent Hack Day at Media Lab

Event site: https://mitmedialab.github.io/Consent-HackDay/

UX Mockups

Note: These are just rough mockups, subject to change, pretend they're drawn on back of napkin.




UI Todo:

  • Add badge/icon indicator to extension icon to denote that the site you've visited acknowledged your preferences etc.

ConsentHackDay

Functional Aspects

  1. Provide individuals an easy to use method for expressing they do not consent to add tracking in a way that services must comply with

  2. What is the policy? (Content)

  3. How is the policy rendered for user independently of whoever created it? (format, language, display)

  4. How is the policy coded? (Which bits mean what?)

GDPR Connection

Other considerations

  • Substitutability
    • Where you inherit policies from
    • Where you get the rendering

… carrots for the ad industry

  • Intent casting
  • Better signaling
  • Better programmatic framework
  • Eliminate fraud and malware
  • Speed up load time
  • Increasing operational efficiencies in a world where consent is in play
  • Risk reduction, efficient audit reporting
  • IAB Europe clearly states in their documents that the 'cookie' solution is a temporary measure. We can help them with design inputs that are more person-friendly.

Technical Aspects

  • There is a cookie capability that could be a good fit. There are a handful of flags that can be set.

IABE Cookie Format: https://www.google.com/url?q=https://github.com/InteractiveAdvertisingBureau/GDPR-Transparency-and-Consent-Framework/blob/master/Draft_for_Public_Comment_Transparency%2520%26%2520Consent%2520Framework%2520-%2520cookie%2520and%2520vendor%2520list%2520format%2520specification%2520v1.0a.pdf&sa=D&ust=1523464528097000

JSON file for purposes & vendors (from above link): https://vendorlist.consensu.org/vendorlist.json

IAB JS Library: https://www.google.com/url?q=https://github.com/InteractiveAdvertisingBureau/GDPR-Transparency-and-Consent-Framework/blob/master/Draft_for_Public_Comment_Transparency%2520%26%2520Consent%2520Framework%2520Formatted%2520CMP%2520JS%2520API%2520v1.0.pdf&sa=D&ust=1523464528097000

GDPR https://gdpr-info.eu

Registered CMPs http://advertisingconsent.eu/iab-europe-transparency-consent-framework-list-of-registered-cmps/

CMP Registration Video https://www.youtube.com/watch?v=X25npcxInFU

List of Laws from EC https://ec.europa.eu/digital-single-market/en/laws/76023/3565

Organizations who could participate

  • Kantara Initiative https://kantarainitiative.org
    • Consent & Information Sharing WG - Produced the Consent Receipt Specification
    • Consent Management Solutions WG - Developing a compendium of consent management practices from companies that claim to 'do' consent management. Will become a Best Current Practice doc then a certification program.
  • EFF
  • IEEE
  • Wymsical/Wault
  • AARP
  • Consumer Reports
  • Consumer Federation of America
  • Girl scouts, boy scouts, PTA ("keep kids safe" - > GDPR)
  • HIE of One
  • Hyperledger Indy
  • Sovrin Foundation
  • TUCOWS (hover et al.)
  • OpenConsent
  • Customer Commons
  • IAB Europe :)
  • EU supervisory authorities
    • CNIL - France
  • Aligned Orgs/Companies/etc.
    • DCN (formerly Online Publishers Association in USA)
    • ITEGA
    • Mozilla
    • Cliqz Browser
    • Brave Browser
    • IAB Lab
    • Berkman Klein Center (Kathy Pham)
    • Medium
    • PRX
    • RadioPublic

Quick Hack Teams

  • Elizabeth
  • Dazza
  • Robert Mahari
  • Stephanie
  • Andrea Servida - DG Connect e-governnment & trust unit

hang out link: https://hangouts.google.com/call/f71g1SrzihwRublHgFC2AAEE

  • Sal (seek a privacy dashboard for individuals)
  • Sean
  • Hanno
  • Sam
  • Sherry
  • Andrew (from time to time)

Business: Describe "Go to Market" Use Case in Engineerable Way

  • Doc
  • Joyce
  • Dazza
  • Sean
  • Stephanie
  • Kathy
  • Bill
  • Adrian
  • Dmitri

End of Day Report Outs

Business (Go-to-Market)

Ideas

  • Getting Mozilla, et. al. to add this to the browser
  • Getting EFF to put this in Privacy Badger
  • Getting friendly startups
  • Q: What differentiates the different CMPs?
  • Two approaches: 1. Customer Commons listed as CMP 2. Customer Commons hijacks CMP's UI

Buildable description (scope)

  • Make an engineerable spec, something buildable, that we can evaluate against the intention
  • New Deal on Data (HBS - Sandy Pentland)

DRAFT Indications for Use:

  • Indications for Use for each Party:
    • Provide data subjects a method for expressing they do not consent to profiling in a manner acceptable to data controllers.
    • Provide data controllers language and technology crafted to be compliant with GDPR and provide a clear understanding of data subject's ad-tech requirements.
    • Provide data processors with reduced risk by helping the data controller offer guidance that are GDPR compliant and reflect the data sububject's ad-tech requirements.
  • Definitions
    • Tracking is: ad tracking, profiling by third parties
    • Data subjects are defined by the GDPR
    • Manner acceptable is a cookie or equivalent

GDPR Article 6 - Lawfulness of processing

Purposes Data Subject Controller Processor
Consent
Contractual Obligation
Legal Obligation
Protect a person
In Public Interest
Legitimate Interest

Elevator Pitch

A cookie that puts the individual in front of the data flow on websites, and sites in alignment with the GDPR. The cookie signals consent to site tracking, but not to third party tracking.

Narrative to Technical Engineering Teams

Narrative to Users (Tech Wizards and Muggles)

Go to Market

Possible promotional partners

  • Linux Journal
  • (See others above)

Use customer commons as a certification provider

  • Very heavy, slow process - lots of work

Benefits

Data Subjects

  • Peace of mind
  • Removal of consent wall
  • Faster load time

Data Controllers (= IAB E publisher)

  • Reduced operating cost / risk
  • Align values with data subjects (= less friction e.g. on-boarding)
  • Reduced incentives for ad-blocking

Data Processor

  • Reduced operating cost / risk

IAB E

Publisher (website owner)

Vendor (owns ad inventory / ad tech / data broker)

Civil Society / GDPR DPA

Technical (Hack the Cookie)

Table to be updated! Link above up to date

Purposes IAB E Says Customer Commons Says
Storage and access of information You can ask us to delete/forget when you want
Personalisation Tracking (GDPR: Profiling)
Ad selection, delivery, reporting My topic prefs and exclusions
Content selection, delivery, reporting Where do I see the logs?
Measurement Only aggregate info allowed (at least c. 10 subjects)
Duration?
Features
Matching Data to Offline Sources You won’t use my data to correlate me with my offline self
If you link my devices through pivotal data points I supply implicitly or explicitly, you will notify me?
Precise Geographic Locations
Vendors

Basic Chrome Extension demonstrating cookie setting mechanism: https://github.com/TelegramSam/ConsentCookieManager

Legal (Terms and Rules)

Questions:

  • To what degree does a blanket "do not track me" cookie satisfy the GDPR requirements for specific consent?
  • Does a chrome extension give the data subject sufficient clear info?
  • What are the requirements of GDPR's certification idea and how could we satisfy them? Could this act as an additional incentive?
  • What are the transparent icons GDPR speaks about, who defines them (UI task)?

Roadmap

  1. Customer Commons Cookbook/ Commandments
  2. User can set config
    • Cookies
  3. Service provider can
    • accept
    • reject
  4. Accept by service provider
    • Acknowledge
  5. Options
    • (Simple Email - Day 1)
    • CMP - Day 1
    • Consent/Info receipt - ?
Select a repo