Desirable elements of "UA Policy"

[krgovind]

UA Policy is a key aspect of First-Party Sets that should define what constitutes an acceptable set.

One key principle that has been proposed in the privacy models of various browsers is the notion of being owned and operated by the same organization.

• Note: This has been challenged in Arbitrary/opaque nature of "organizations" as the arbiter of first-party sets #14, Expand Set Eligibility Beyond a Single Organization #17, and Enforcement of organizational structure within FPS #18. It has been suggested that the same organization requirement be dropped in favor of a UX signal indicating affiliation to the user.

What are other key elements that are desirable to capture in the UA Policy?

What properties of user understanding (as enshrined in the page URL) can the policy cover?

[dmarti]

One way to cover legit cases of "same organization, different domains" would be to borrow a design idea from IAB TCF and include a URL for a common privacy policy that applies to all domains in the set. (The TCF vendor list includes a policyUrl member for every defined vendor.)

That way, for example, yimg.com and yahoo.com would already be able to be part of the same set, because they are administered by the same owner under the same policy. Other organizations that wanted the benefit of first party status would need to make a publicly checkable committment.

[krgovind]

As raised on a CG call: the DNT specification may also serve as good precedent here: https://www.w3.org/TR/tracking-compliance/#party

[pbannist]

While it's useful that other work has been done on defining "party" more clearly, I don't think the definition in the tracking compliance document is very helpful. When we move into the very fuzzy world of corporate ownership, I believe that the words in that definition are insufficient.

A simple example is the status of companies in China. A huge number of companies in China are fully or partly owned by the government. By the definition in the DNT specification, that could easily make all of those companies the same party as each other, when I imagine that isn't what most people would view as a desirable outcome.

I'm sure there are many, many other issues that can be identified here, not least the issue of even knowing what companies own which other companies - that fact alone is often not public.

[jwrosewell]

ICANN are responsible for the subjects of this proposal. Have ICANN been involved in the debate and their opinion sought on solutions? Anything that does not involve ICANN seems like a "hack".

[johannhof]

I think this issue has been superseded by various other policy discussions, so I'll close it.