New forum for web identity and security launches with involvement by Microsoft, MasterCard, Accenture, IBM

This week the wraps came off a new initiative to promote coordinated solutions to web identity and data security. It’s called the Trust over IP Foundation (ToIP), housed inside an affiliate of the San Francisco-based Linux Foundation and the leadership is familiar to technologists who have been working for at least a decade in the field.

“The highly specialized world of digital identity is opening itself to a wider audience,” declared reporter Ian Allison, in a thorough account at CoinDesk.com. A second news account of the unveiling said it was aimed at reducing fears about the use of personal data. Efforts may rely in part on a pending World Wide Web Consortium (W3C) “verifiable credentials” standard.

“Trust Over IP is a decision-making framework, not a specific governance network or a specific technology,” John Jordan, executive director of British Columbia’s digital-trust service, explained during a Thursday video webinar with 13 other co-collaborators.  “It is a place to come together to make good decisions.”

For decades, governments, businesses and individual technologists have been studying and experimenting with how to add a fundamental service to the Internet – the ability to be sure that a person is who they say they are, or that a piece of data can be trusted as authoritative. Most approaches to creating such an internet “trust layer” use a branch of mathematics called “cryptography”.  More recently, a field of inquiry known as “Self Sovereign Identity” (SSI) has emerged which relies on so-called “zero-knowledge proofs” to check credentials while preserving individual privacy.

For ToIP, the guiding intellectual concept is to use cryptography to move control of identity attributes and relationships away from account-based corporate and government data users and more toward the individuals themselves.

It is members of the SSI world who largely are behind forming of the ToIP organization, and its initial volunteer executive director is Drummond Reed, co-architect of several related web standards and a co-founder of the Sovrin Foundation. Reed works for Evernym Inc., a vendor of SSI solutions that has been involved in developing the W3C verifiable credentials standard. The BC provincial government is deploying SSI as a method of confirming online identity of individuals for government services.

Representatives of Accenture, IBM, MasterCard and Kiva were among those on Thursday’s call, and the entity running the ToIP — an affiliate of the Linux Foundation called the Joint Development Projects LLC — is part of a 501(c)6 entity who’s president is a Microsoft assistant general counsel, David Rudin.

In a phone discussion with Privacy Beat, Reed explained that ToIP will foster four “layers” around identity and security research and practice.

• A “public utility” layer including such entities as Sovrin, and more to come

• Companies that offer digital wallets or data-trust agency to consumers

• Organizations that issue, hold or verify digital credentials

• Entities which operate secure identity services within interoperable standards

“There will be many utilities, there will not just be one utility,” observed Dan Gisolfi, the IBM representative on Thursday’s video discussion.  Some will be nonprofit (like Sovrin) and some will be for-profit, Gisolfi suggested, with varying business models.

Reed said a “digital wallet” — software which contains credentials such as a driver’s license, medical records or subscription information — can be both within a consumer’s smartphone or stored on the web service of a trusted agent.

“We call them credential managers,” added Gisofi, who is CTO of the decentralized identity arm of IBM Security.  “It is not tied to a smart device but that will be the best experience.”

Founding Steering members include Accenture, BrightHive, Cloudocracy, Continuum Loop, CULedger, Dhiway, esatus, Evernym, Finicity, Futurewei Technologies, IBM Security, IdRamp, Lumedic, Mastercard, MITRE, the Province of British Columbia and SICPA. Contributing members include DIDx, GLEIF, The Human Colossus Foundation, iRespond, kiva.org, Marist College, Northern Block, R3, Secours.io, TNO and University of Arkansas.

PRIVACY AND COVID-19 TRACKING

• Massachusetts could pursue coronavirus contact tracing app, but not without addressing privacy concerns first, governor says | Steph Solis, Mass Live

• Work from Home Surveillance | Washington Post

• Government Absence Leaves Big Tech to Steer Privacy for Contact Tracing Apps | Mariam Baksh, NextGov

• Coronavirus tracking apps spark security concerns | Joseph Marks, Washington Post

• Tech Companies Take Privacy Reins During Virus Absent U.S. Law | Daniel Stoller,  Bloomberg Law

• How COVID tracing will work on your iPhone and protect your privacy | MacWorld

• U.K. Virus App Contains Privacy Loopholes, Rights Group Says | Natalia Drozdiak, Bloomberg

• France shames Apple for not sacrificing user privacy for COVID-19 app | Malcom Owen, Apple Insider

• French Minister Says ‘We Will Remember’ Apple Privacy Refusal | Helene Fouquet, Bloomberg

• Has coronavirus made us part with our online privacy? | Andray Domise, Maclean’s

• COVID-19: Tracking, data privacy and getting the numbers right | Berkeley News

• Would You Let The Government Track Your Smartphone If It Meant We Could Reopen Sooner? | David Freedman, Newsweek

• Smartphone-based automated contact tracing: Is it possible to balance privacy, accuracy and security? | Yvonne Taunton, UAB News

• UK contact-tracing app could fall foul of privacy law, government told | The Guardian

PERSONAL PRIVACY

• RESEARCH: How Americans see digital privacy issues amid the COVID-19 outbreak | Brooke Auxier, Pew Research

• VIDEO: Life With GDPR: CCTV and Data Privacy | Thomas Fox, JD Supra

• It’s Not Just Zoom. Google Meet, Microsoft Teams, and Webex Have Privacy Issues, Too. | Allen St. John, Consumer Reports

• Bill Gates’s vision for life beyond the coronavirus | Ezra Klein, Vox

• New Firefox service will generate unique email aliases to enter in online forms |  Catalin Cimpanu, ZDNet

CCPA WEEK SIXTEEN 

Over 900,000 signatures gathered for CCPA 2.0 ballot initiative; now will 623,212 be certified by June 25?

June 25 is the next important date that will likely determine if Californians could be voting on a privacy ballot initiative in the fall.  California Consumer Privacy Act (CCPA) originator Alastair Mactaggart announced on Monday supporters had gathered at least 900,000 signatures to put a second “California Privacy Rights Act” (CPRA) on the ballot.

By state law, now all the signatures have to be reviewed by county election officials across the state to verify that at least 623,212 of the signatures are legal. And that process has to be done quickly enough so that the California Secretary of State can certify on June 25 that the threshhold has been reached.

“…[I]f the random sampling verification process indicates that the number of valid signatures is within a narrow margin of the required threshold (i.e., less than 110% of the required number), the June 25 deadline would likely pass before the verification process could be completed,” three Hogan Lovells US LLP attorneys wrote in a blog summary of the ballot-qualification process, adding:  “If that occurs, the CPRA would be left off the ballot.”

If the law is on the ballot and passes  (one poll found it was supported by 88% of the state’s voters), it with add fresh privacy guarantees to those already established by the CCPA, including a new definition of “sensitive personal information,” a right to have wrong information corrected, new safeguards for children and a new California Privacy Protection Agency to take the enforcement load off the attorney general’s office.

RELATED LINKS

• Stay At Home Orders May Have Killed California’s Ballot Initiative to Expand CCPA [**Update – But Californians for Consumer Privacy Say Maybe Not**] | Christopher Fonzone, Sheri Porath Rockwell and Christopher Joyce, Data Matters

• CCPA 2.0 announces key signature threshhold for ballot initiative | Natalie Prescott, Mintz law firm

• BREAKING: Californians for Consumer Privacy Introduces California Privacy Rights Act for November 2020 Ball | Hunton Privacy Blog

CCPA ENFORCEMENT

• Coronavirus sparks new fight over California’s internet privacy law | Dustin Gardiner, SF Chronicle

• Calif. Internet Privacy Deadline Complicated by Coronavirus | Dustin Gardiner, Governing

• CPRA analysis: The ‘good’ and ‘bad’ news for CCPA-regulated ‘businesses’ | Jim Halpert, Lael Bellamy and Marco Berrios, IAPP

• Worried about CCPA? Devalue your company’s payment data | Ruston Miles, CFO Magazine

• Update: April 2020 California Consumer Privacy Act (“CCPA”) Litigation Tracker | Jena M. Valdetero, Bryan Cave Leighton Paisner

• Encryption’s impact on potential liability under CCPA | Soliman Hatef, IAPP

GDPR ENFORCEMENT

• European Authorities Ban Dirty Cookie Practices in GDPR Update | Shoshana Wodinsky, Gizmodo

• The EU is trying to fix its abysmal cookie consent policy | James Vincent, The Verge

• No cookie consent walls — and no, scrolling isn’t consent, says EU data protection body | Natasha Lomas, TechCrunch

• EDPB Publishes Updated Guidelines on Consent under the GDPR | National Law Review

• No cookie consent walls — and no, scrolling isn’t consent, EU warns | Natasha Lomas, Tech Crunch

• Guidelines on consent under Regulation 2016/679 |  European Data Protection Board

• A Renewed Focus on Cookies: New Irish DPC Cookies Guidance and Future Enforcement | McCann Fitzgerald

• FAQ on Consent for Electronic Direct Marketing | Ireland Data Protection Commission

• French CNIL Publishes Guidance on Web Scraping and Re-Use of Publicly Available Online Data for Direct Marketing | Hunton Privacy Blog

ADVERTISING TECH

Google appears to amp-up interest in leading changes to advertising technology that address privacy law, concerns

Postings this week on forums of the World Wide Web Consortium (W3C) and Google Groups appear to suggest that Google Inc. is taking an active interest in championing browser standards that could change the way digital advertising works under stepped-up privacy laws and concerns.

First, on Tuesday, Google Chrome engineer  Steven Valdez posted an “Intent to Experiment” with an idea called “Trust Token API.” Then, on Wednesday, Google colleague Yao Xiao posted to the Chromium.org blog an “Intent to Prototype: Federated Learning of Cohorts.”  What are these proposals and why does it matter?

The Trust Token API idea was first proposed by Valdez as a method for advertisers to learn some information about individuals across websites without having really specific identity information. “Preventing fraud is a legitimate use case that the web should support,” Valdez writes. “But it shouldn’t require an API as powerful as a stable, global, per-user identifier,”

Federated Learning of Cohorts (FLoC), is named for its intent — to create “flocks” of users with similar interests or attributes that advertisers can target without having to gather personal information on specific individuals. One approach would be to let the user’s web browser software select the ad to show according to some interest or demographic information provided by the user.

FLoC has been discussed since last year on a W3C-GitHub email list for “Improving Web Advertising.” It was detailed Feb. 6 by Google’s Josh Karlin in a GitHub forum posting as a new way that browsers could enable interest-based advertising on the web, in which the companies who today observe the browsing behavior of individuals instead observe the behavior of a cohort (or “flock”) of similar people.”

Advertisers want to reach consumers likely to be interested in their message so FloC addresses that desire through a mechanism of storing within the web-browser software your attributes and then sharing them into a “flock” that is somehow anonymized. This approach is thought to be one way of complying with emerging laws such as the California Consumer Privacy Act (CCPA) and alternative to the current real-time-bidding ad-technology ecosystem which relies upon third-party cookies and a dizzying array of opaque and largely ungovernable user-data managing efforts.

“A key part of the reason we plan to prototype this approach is to measure its privacy properties, and study what Chrome can do to minimize any privacy impact,” veteran Google ad-tech engineer Michael Kleber wrote about the FLoC plans on the company blog.

But Eli Gray, a privacy engineer at Transcend Inc., was among those expressed concern in a responsive post. He wrote: “FLoC feels like a privacy anti-feature to me and I am strongly against this ever shipping without further justification. We should instead be encouraging contextual advertising solutions. Ad networks should target their ads based on the content being viewed, not on the ‘cohort’ viewing the content.”

Kleber replied by citing disputed Google research that some publisher websites would earn less revenue in a shift from user-targeted advertising to advertising placed on web pages contextually relevant to their message. “That’s why Chrome is committed to exploring new techniques that support the ads-funded ecosystem but are built with privacy guarantees from the outset.”

The Chrome web browser is controlled by Google. Thus the FLoC idea would preserve Google’s control over user data. (DISCLOSURE: ITEGA, the sponsor of Privacy Beat, has supported “UDEX”, an initiative anonymized user-data cohorts as a non-profit service.)

ADVERTISING TECHNOLOGY (see Quote of The Week)

• Programmatic market a ‘mess’ with half of money still not reaching publishers | Omar Oakes, Campaign Live

• Time for change and transparency in programmatic advertising | Abi Gibbons, ISBA

• Publishers only receive half of an ad spend | Josh Sternberg, Media Nut

• Of the money advertisers spend on digital ads, half of it vanishes before reaching publishers | Joshua Benton, Nieman Lab

• Digiday Guide: Everything you need to know about the end of the third-party cookie | Digiday

• Facebook tracking tech error crashes multiple big apps | Rachel Lerman, Washington Post

• First-Party Data the Best Bet for Post-Cookie ID: Ian Hocking, South China Morning Post | Grace Dillon, ExchangeWire

• Tracing apps could mean exchanging privacy for sociability; experts call it ‘a dangerous trade off’ | Jeff Andreas, Radio NL

• Adweek Together: The Future of Programmatic Advertising | Chris Ariens, AdWeek

• Programmatic Ad Market Proves Resilient, Analysts See Demand Shifting To CTV From Linear TV | Joe Mandese, MediaPost

• As The Trade Desk reports quarterly earnings, stock approaches new high | Yahoo Finance

PRIVACY BUSINESS

• As Pandemic Decimates Startups, Privacy Industry Holds Strong | Benjamin Powers, CoinDesk

• BigID Privacy Portal helps orgs manage consumer data rights and privacy preferences | HelpNet Security

• PE’s $1.1B battle for the .org domain may not be over |  Leah Hodgson, Pitchbook

PRIVACY LAW & POLICY

• Our privacy is on the clock | Billy Easley and Neema Singh Guliani, The Hill

• Uniform Law Commission Could Resolve The State And Federal Impasse On Internet Privacy Legislation | Roslyn Layton, Forbes

• Pandemic Privacy: Republican Senators Announce Plan to Introduce COVID-19 Consumer Data Protection Act of 2020 | Ropes & Gray

• Critics Warn Covid-19 Digital ‘Privacy’ Bill Is Really ‘Anti-Privacy’ Bill in Disguise | Andrea Germanos, Common Dreams

• Senate expected to approve House-passed surveillance powers bill next week | The Hill

• U.S. Senators propose COVID-19 data privacy bill | Stephen Warwick, Android Central

• The COVIDSafe bill doesn’t go far enough to protect our privacy. Here’s what needs to change | Katharine Kemp and Graham Greenleaf, The Conversation

• Safeguarding Privacy Through Law and Technology | David Hoffman and Gal Ringel, CPO Magazine

• Republican senators to introduce the COVID-19 Consumer Data Protection Act | Müge Fazlioglu, IAPP

• TikTok faces privacy lawsuit over biometric data collection | Sara Merken, Reuters