when is sharing data for some ancillary purpose consistent with privacy principles?

[npdoty]

There seem to be open questions about when it might be acceptable and consistent with a privacy threat model for the Web for some data to be shared about a user's actions that isn't directly necessary for the user's current action.

This might be to enable some generally beneficial ancillary functionality, or for harm reduction purposes (alternatives to more invasive data collection that will happen otherwise), or where it's just not feasible to minimize data in the short/medium term.

Examples could include:

• Reporting APIs, Beacon, performance measurements, debugging/troubleshooting
• statistics on links clicked or advertising attribution
• User-Agent string/hints used for analytics

This discussion was prompted in part by #133 (introducing a principle on not sharing data unless necessary for overt immediate goals) and in part by text around collective privacy/governance. #121 may also be an example.

[yoavweiss]

Related: w3ctag/design-principles#368

[yoavweiss]

I think we need to make a clear distinction between ancillary data that is not available by other means, and ancillary data that is 1:1 equivalent with other data that's available to the web site for functional purposes. The former is purely ancillary, while the latter is somewhat different.

[npdoty]

Ancillary uses of data is somewhat independent of what data is accessed (that is, data itself isn't ancillary or not).

#182 is proposed for handling cases where data is otherwise available (either currently or indefinitely).

[torgo]

We're closing this as we believe we addressed this in #184 and #182.

[npdoty]

#216 is proposed to revise answers to this question.

[torgo]

Agreed to close due to imminent merger of #216.