There it is and we're live and we're on. Oh excellent. Okay. Oh and we need a speaker and so let me get the white board It does I think that's I think that's mark Okay, I was gonna say Do we here at MIT have a Audio audio like the plug I have one. Oh, it's great Because this speaker sucks Yes Oh, it might work. Oh, no, you're right. So Yeah, we should just play through this so there's a speaker up there in the ceiling or something Okay, so I'm going to HDMI through this thing. So this might not work. Oh, okay. Oh, perfect. He's got one Excellent. I would expect the CTO to be carrying a Oh I know and then you can use it and then you can use it. Look at it. I have one. So Jim, you guys actually need to talk about it kind of. You know it's not that Jim, you just thought it would come up on the internet. Sorry, what's your name? I'm Des, I'm a great question. So all of the scientists here are in Medi-la. What's your name? I'm Des, I'm a scientist here in Medi-la. What's your name? I'm Des, I'm a scientist here in Medi-la. What's your name? D-A-C-Z-A. That's a nice name. Thank you. Okay. I'm on my console. Okay, it's pretty good. So I'm going to go back. So I need to be able to hear these people. Oh, I just haven't been saying anything. Can you hear me now? We can hear you now. Okay. Okay. Okay. Am I muted, Sharon? Okay. I'm going to go to full screen. How do I go to full screen? Let's see. We'll start by maximizing the browsers. Yeah, I'll talk to you there. That's fine. It's pretty good. Sean Bowman is used to be there. The weird thing about it is that it's only software in the 90s. Exactly. It's either one or two. It's like, whoa, two guys. Two guys still exist? I know. Or two guys. I never heard of two guys. Are you the starter? I got that one. Are you the starter? What are you doing? We had coffee here that I was going to buy, but instead, Adrian did, so I told him. Sorry, did you make that name? Bill? I don't know. I don't know what to say. Realistic guys, you're supposed to know. That's right. Adrian. Yes. You're close enough for me to sit with. Yeah. Should we have what? Have the remote people talk rather than you. Okay. Okay. Yeah. Okay. Remote people of the earth. Remote people of the internet. We just did a quick round of introductions in the room when we were getting to the setup, and maybe you could introduce yourselves as well. I'll just do a couple of things in the order that I see your faces on the little person bar at the bottom. And so Elizabeth, if you would be so kind as to come off mute and introduce yourself, that would be great. It's a little loud where I am, but I am a technology privacy lawyer who has been focusing on privacy and emerging tech for about eight years now. I am a partner at a boutique law practice in Washington, DC and focuses on blockchain AI machine learning. I'm also a global policy counsel to Evernim, which is building self-sovereign identity in part through sovereign technology. Great. And we have another person who's working on Indie in the room as well. So we know. There he is. Great. And Mark Lazar, you're the next face that appears. Can you introduce yourself? Hi, Mark Lazar. I'm CEO and co-founder of Open Consents. And I passed the chair of the Consent Receipt specification with Canterra. So I worked a bit with Mary on Consent Receipts and been following this topic for a really long time. So yeah, I really like the idea of consent cookies. We're looking forward to today. All the keys. Welcome back, Mark. And now Mary Potter is the next in line. Hey, Delta. Hey. Okay, so introduction. I don't know. I'm on the Customer Commons Board with Doc and have been working on various things around privacy and some kind of technology development for, I don't know, the past 15 years off and on and really want to build something in this space that actually changes things. So I was excited about today on the topic. Great. Welcome back, Mary. And it looks like Sam is the next person in the lineup. Yep. So Sam Curran, I've been a, not the longest but a long-time IW attendee and have ended up dabbling here and there in browser extra modifying user experience. So I'm also a contractor for Evernom.  Great. All right. So that's everybody that we have online at this point. Do you want to get us into the meat of the day, Doc? Yes. So a little more background for the people who showed us since we started. We're not at the beginning of this. There's a workshop, well the Internet Identity Workshop is put on twice a year at the Computer History Museum in Silicon Valley. And it's an unconference of topics or whatever anybody wants to bring up. And there was a session there, there are actually a series of sessions, but the last session, which is on the last one, the three days of the workshop, was on what we called, the title was GDPR Consent Cookie. Over the prior two days, people in both the advertising business and in our general cabal agreed that there's an opportunity right now to jump ahead of the GDPR on the user side, on our side, with a, it was a wonderful word that I had for you yesterday, a technical capability, a technical capability that will have the effect of taking down the consent walls that are sure to go up in front of every website. The way that the advertising industry is dealing with a feminine spirit of the GDPR, but not the letter of it, in other words, an irritant to the letter of it, is to put us all through the same kind of consent exercise that we see right now in European sites. This site uses cookies, and it's just an irritant, but they want to have a larger irritant that has more consents on it that basically say, we can track you to the ends of the earth. So, and now you've consented, and they are now, I guess, in little terms safe, there's something like that from the EU. Since the spirit of the GDPR, there's somebody with a letter and somebody said, resettles 29 or something, and perhaps Elizabeth, or somebody else who's talked to us about this, can bring this up. The, I'm just going to skip that part. I'm just going to go straight to, what we want to do is provide a hack that will take those walls down and tell them we're not consenting, we're consenting to not being tracked by third parties on your site. We are consenting to original cookies of the original kind, which we want to lead design, which are to remember state. In other words, we don't want to turn off our shopping carts, we don't want to turn off being remembered by the site. We do want to turn off being tracked off the site, which is the whole idea behind the GDPR. Now, as I understand it, there are to a cookie spec something like 40 different bits that can be flipped or something, and I'm moving into a technical territory that, actually, Sam, can you take over on this? What is it in the cookie that has variables in it that leave open us sticking something in there that expresses our form of consent? Let me explain the basic mode of this thing. The idea is that when you go to a site, you'll be on the belt, throw up a consent wall, and you go express your consent, and then that consent will be recorded in the form of a cookie that's crafted in a very particular way. And then that cookie, on subsequent revisits, can be read and they can avoid throwing up the same, just use the values of the cookie. And our opportunity here, is rather than, since they've published the spec on how the cookie is actually created, and there's also some JavaScript options as well that we have, but the short answer is since they've published how this is created, we have the opportunity of empowering the user to create their own cookie that represents what they want. And then having it be already in place by the time you go to a site or rapidly thereafter so that their consent wall is not the consent wall you get, but rather a user experience that we have the opportunity of crafting and basically impersonating their cookie and sort of subvert their own internal process and the cookies just aren't there to be provided. Okay, that's good. Is everybody clear on what Sam just said? I'm not clear. Okay. Okay, we have two fun clears here. Hey, tell me why you're trying to fill in the gaps. Can you say it again, I guess, more slowly and then slightly differently with like synonyms? No. Come on, let's steal that one. I could try and steal an accent, but I'm terrible at that. I don't do that. So, okay. So, more technical, less technical? More like high level and what exactly are you doing? Yeah, make it a little more high level, a little bit less technical and then let us drill down to the technical when we have an understanding of what you're saying. Okay, so these are chunks of information. It's usually a string that are presented by websites to the browser and the browser can save that and then represent it to the website on subsequent visits.  So, cookies are typically presented, they're given to a browser by the server you're visiting and then they're just transferred back without modification. So, that's the internationalizing, the IAB, right, International Advertising Board, whatever. It's called Interactive Advertising Bureau. It's basically an international... So, the interactive... they have this standard that they've created on how their own servers that are participating are going to be creating this cookie and passing it to users' browsers after they go through a consent wall. And what I mean by consent wall is a series of questions that they have to ask yes or no questions on all the different types of things they consent for because of the GDPR. So, the sneaky part is that with a browser extension, we can actually encourage the site to make a cookie of our own design. So, rather than forcing you the consent wall that the IAB is planning, we can simply craft the... according to these preferences, we can craft a cookie which follows the same format as the one that they would be handing out. But it already represents what they want to happen. And that means the... we can plant the cookie, it will get read by the relevant sites, and then the... is that we're very much in line with the spirit of what they're trying to do, but we're sort of verting and doing it differently than they had originally planned on this happen. So, yeah. That implies that the cookie is not signed by anybody. I was just thinking about it. So, according to their current spec, it's not signed or anything in any way? We can change that. It's just basically a format of what the contents of the cookie are. Why would they not introduce a signature? I'm not questioning this. We're just going to... I think they would have done that really quickly. Yeah. I think the individual or its self-solving provider would be the signatory of that cookie, right? No, no, no. I'm saying... What you're saying is if you create your own cookie, the next step is that they will sign their cookies and then it will... our cookies will not be accepted because they're not signed. Right? Hopefully, we can embarrass them and just sign them. I mean, I think that... I mean, if that's the routine... Well, they would have to be signed in our cookie. Or not. So, nothing about cookies actually has to be signed and it appears because of their spec that they're not signed. Sure. Which means if they actually signed it, it would be harder for us to craft our own and replace them. Okay. Not signing it makes our job easier. Yeah. But also if they add signatures to the... if they sign their cookies, that changes their spec, does it not? It does. There's the cookie specification and there's also apparently a JavaScript library that is in play that we also might be able to interact with that's independent of the cookie per se. But yes, it appears then that this is kind of the approach that they've taken which gives us the opportunity that we have. I guess... Do we have a hypothesis as to why either they can't sign the cookie or they don't want to sign the cookie? Well, they don't know anything about this yet, I suppose. So, a question, I guess... possibly my question, Sam, is one, can we as individuals generate our own cookie that they're going to respect? B, do they have to sign it or not? Is that even an option? Is that something they can technically record on their side? It's something we talked about at the last session. They might present a cookie that we could say in a grease-monkey way and rewrite. Is that on the table as well? Well, it's signed. That's a question for you, Sam. Dave's on, too. Oh, Dave's on, too. Is the same... Sam, are you still... Yeah, I am. Okay, so the process of planting a cookie... browsers don't provide APIs for you to directly interact with the cookie store. So we would use the grease-monkey technique that Doc mentioned where you inject a user script with a browser extension onto the page where the domains are that you actually want to plant the cookie from, then the JavaScript that plants the cookie. And we can both read cookies that way and we can write cookies that way. And there's nothing that prevents us from overriding a cookie that they had previously sent. Right. So, Hong here, I have a question. What is the wild card for this cookie? Will it be read by any domain and written off? What's the real settings? So, there's only two real ways to read a cookie. One is to be the server that set the cookie and there's rules about domains and how they set them. The other way is if you're on the user agent, if you're at the browser, which we can do with an extension, then you can actually read the cookies. No one else really can. So, we had hoped that Privacy Badger would be in this conversation. Dave Huesby was on the line, used to work in Mozilla and communicated with Cooper Quinton, who was still a maintainer for Privacy Badger. Nothing's happened on the Privacy Badger front so far, but it doesn't mean it can't. It just hasn't happened so far. They're an obvious case because they're not an ad blocker. And this could be a real nice hack on them because right now, as Adrian said at the last session, for a muggle or even a smart wizard looking at the Privacy Badger interface, when it gives you a list of all the different trackers there might be there, it's pretty obscure. It's pretty hard to tell what's going on. So, it would be a fun thing for this just to be a cool default that Privacy Badger has. That's a way of telling a site not to track. There's another side of this, or maybe Davey might want to unpack a little, which is that the way the IABE, IABE Europe has this set up, they want to record these consents in a single domain that has a number of subdomains for each advertising intermediary that can all be opted into or out. Their fantasy is that you're going to say yes to Google, yes to Facebook, and yes to Oath, and maybe no to all the other ad tech guys because they've never heard of them. I mean, I think that's possibly what they're thinking. But it doesn't matter, but there's this domain side to it which is there's a domain and there's a subdomain. All things can be recorded down in this subdomain. But Sam, a point that you made in the last session was that you could have this cascade from one to the other to the other to the other as you go from site to site to site. I don't know how that works. Do you want to refresh us on that? So this is one of the technical things that I'm not entirely sure of. When you load resources on a single webpage from let's say example.com, but you from a.com and b.com and c.com, the resources that load from a.com have the opportunity to set their own cookies. And this is the trick being used by the European branch of the IAB to be able to pose on how that actually happens. So if you just have a.com, then there's rules on, it's pretty easy and most browsers currently block what's called as third party cookies that way. So the trick is to have an a.example or like an IAB.example.com that's a sub main of example.com that can point to the IAB servers and that's where the cookie is actually set. And so one of the tricky parts of doing the grease monkey trick is how we can actually set a cookie on a very specific subdomain instead of the main domain that the page is coming back from. And that's one of the open questions on our specific approach. To be clear, what we're talking about is somewhat of an arms race in that they're going to do this. And we can co-opt it and it works really well until they decide to change it. If they change it thoroughly and do a good job, it would make it very difficult. The thing that's working to our benefit is that these people are not known for their technical prowess in developing technologies and it's a large organization which means that they're going to be unlikely to change things week to week to week because of the organization which means that it's a little bit easier for interested parties like us to keep up with what we desire. That was one of my questions. Does this seem more as a bit of an arms race adversarial attack on this or is it more like a here's another suggested way of doing things and maybe that'll help you be better and they might also hop on board with, I don't know, maybe they see a couple of these user-generated companies and they're like, oh, we never thought of it that way. And have that more as drive key or more just like this, go on arms race. We are taking it all a branch approach to this. We don't want it to, it's very tempting and possibly very effective to take a head on. What we talked about in the last session was there are carrots and sticks here and there are actually more carrots than there are sticks and by consenting not to be tracked offsite by third parties, we are not saying, don't show me ads. What it leaves open is the kind of advertising we had for the eternity until they started tracking us about 10 years ago. So just to put this in a Bertman fellow sense, I was at the fellow session in 07 when Chris Sagoyan who is now with the ACLU said, hey, there's such a thing as do not call, why don't we do this thing called do not track. And he got together with the guy's name, I forget, like Dan Kaminsky was one and the other was a guy at Mozilla to come up with your original do not track. And the IAB decided after Mozilla when Dave was there said, we're going to turn on do not track by default because that's really what people want. And the IAB waged a $100 million campaign to crush Mozilla. And so none of the other browser make a spell in behind it because they wanted Mozilla dead or whatever and Mozilla backed off. But that gave us all of ad blocking because the history of ad blocking has gone up exactly in track with that. So what but what we want to do is make clear that in our PR on this which there will be in my other one of my other cats editor-in-chief in Linux Journal and is that we want the advertising business to succeed. We don't want to equate the success of the web or the commercial web to tracking based advertising which is the IAB does.  So this is false. As part of this we this is Mary Joyce and I are three members of the customer comments board and customer comments now has the courtesy of the cyber law clinic at Berkman and Harbour Law the our first user side term first party where they near the first party individuals the first party that says go ahead and show me as I base on tracking and having that as a clear then this isn't a matter of consent this is a matter of contract this is like we're proffering a term and you accept that and there's a protocol called J-Link that some of us in this cabal are involved with that that's currently imagined through whether that's ready by the 25th or not is an open question but that's on the table as well I think for our purposes here and being able to hack something by the 25th of May the thing we're paying most attention to is what kind of thing can we do with this cookie Adrian it seems that we might consider a two phase strategy phase one maybe simultaneously phase one is how do we display to the customer what the cookie that they place represents in our way of doing it rather than whatever was offered by whatever site set the cookie and that would effectively introduce standardization of privacy policies which is a huge step to be allowed customer comments for instance can be keeper of the standardized privacy policy interpretation rather than it being scattered amongst all of the lawyers and IEPP and then phase two in parallel possibly is to offer the olive branch of well if you let us now click on something on the customer comments interface to modify the cookie whether we sign it or whether you don't sign yours or you know the olive branch obviously includes that that's separate but they can't do anything about phase one as far as I can tell I mean I guess they could encrypt the cookie but that is a different kind of arms race because then what they're basically saying is you can't see the cookie and you know all hell would influence so just I know I'm trying to join you too so I can share screen join okay but I'm a different person other than this I think the same you might be the same but you're not on the stream and so we can't share that you know I'm a different person I'm sorry I don't know and here's a you can do my alright but I'm not gonna share the screen yet I want to be able to yeah so that's terrific I know you put that really well because we have to we have the side of this and the Joyce talks about this we have a lot of incentives and we have to do that out of the game so the incentive on I have a way of, I now have the universal privacy policy, now we could live because of our comments. In effect, what we do is put in our own personal privacy policy, kind of the letter in the spirit of the GDPR. The GDPR is kind of a small privacy policy right now. The GDPR is kind of like created a privacy policy for us as our proxy. And now we can come out with one and say, thank you GDPR for putting this out there. Here's our privacy policy. It's because of our comments. It says, or this privacy policy A says, go ahead, I mean don't track me, but go ahead and give me anything else and we'll do things like we did up until 2006. Privacy policy B could say this, if Don Martin was here he would be pointing this out. There are some people who do want to be tracked, but some people who do want to live in that world and collect coupons. Adrienne Yeah, I think you, that's not what I meant to say. What I meant to say is to separate what the privacy policy is, whether it's the sites or customer comments or GDPRs and how it's rendered. And I am a big fan of regardless what the policy is presenting it to the customer in a standardized way. And I always use the example of apartment rental agreements in most cities where the landlord is very much discouraged, maybe by law, but I don't know, from creating their own rental agreement. The renter expects to see a standardized form of the rental agreement with red lines initialized for the things that are different in that particular situation. So nobody is forced to go through the boilerplate that was created by, as I put it, the IAPP lawyer. And that is a very different thing from what the privacy policy actually is, whether it's we ascribe it to GDPR or to the site itself or anybody in between. So I just wanted to make that clarification. Okay, what would be the implications? So if today we build something or start to build more than one approach to implement the idea, what would be the implication of this distinction? Like would we change the scope of what we build or would we have to recognize that there's some drift between the policy and the cookie? Or what should we do? Well, for one thing, as I mentioned, is it defines the role of customer comments here. And it doesn't have to be customer comments. It can be patient privacy rights and health care, which is my organization. But it doesn't matter. It basically introduces an independent party. It could be EFF. It introduces an independent party that doesn't set policy. It is not a governance organization in a particular way, but it sort of acts on the side of the customer. Is there a way how you can possibly proxy it? You can say, hey, I'm going to set this as anything that EFF says is okay. I'm going to agree with. Is that too tricky? Or like EFF? What I'm doing is I'm separating. You inherit policies from the EFF. Yes, exactly. Or from customer comments. But separately from that, you render those policies in a standardized way, no matter where you inherit them. Yes, I like it. So we have this idea that I often talk about, I split you choose. The kids' game, how do you split a pie? Well, they do it with other stuff. Exactly. Okay. So I want to surface something in terms of describing what the idea is in a way that's engineerable. And that is implied, or you can, the observation is that there ought to be a syntax and a method for delegation of some kind to another party. And that is to say, my terms are whatever the then current terms are at some end point or something like that. So there's a bit of a legal instrument or some sort of vocabulary that is needed in order to express my terms aren't what are in this JSON file right here, like do not read them like a robot.txp file. But it's like one level slightly more sophisticated, which is incorporating by reference terms elsewhere. And some authorization I think doesn't want to. Am I getting you right? Well, you're mentioning you're now entering the domain of Uma, where that is if we're keeping a list, I would call this item number three. So item number one is what is the policy? Item number two is do we have a standardized way of rendering the policy separate from the people who create the policy? And item number three, which is what you just mentioned, is how is the policy encoded? And then item zero is what does the policy do, which in this case it expresses, do you not track I think? Well, the policy is whatever the cookie, whatever IAP thinks this cookie is good for is we're not necessarily changing that. So item number zero is what's the intent of IAB? And, you know, I would assume that they're smart and they'll eventually figure it out. So, you know, that's that's the hypothesis we're making here with the olive branch or whatever. So one zero is IAB's intent. So I just, I'm sorry. Yeah. And one is, what is the policy itself? Whether it's the, you know, whoever would have set the cookie based on this intent has a particular policy. You know, 27 out of the 40 bits, somebody decided to set that. So it's kind of a content. And then what's the second one? The second one is how is the policy rendered independently of whoever created it. So in other words, right now, everybody presents me with different boilerplate, a different rental contract, if you would, you know, it means the same thing. So as a way of obscuring this, and you know, Facebook is famous for this, you know, and has been written up by people that targeted Latinas lab for doing this over the years, she actually published on this. Is it one more, how is it actually used as opposed to content? Yeah, no, no, Bob, just asking you, right? So, so if you have, you have an intent, and then you look at this work. Well, just what three is before you respond to that? Three was how is the policy coded? Oh, okay. So that's technically mean. Yeah. In other words, what does big number three mean? It's not coded. So what's the number two rendered means? What is the rendered for the user like display? Yes. Okay, Bob, I'm sorry to interrupt. No, no, it's okay. So I think this is, I like the idea which fits the set. And so, so in the policy, the content will cover for a particular purpose a number of bits, right? I mean, so that, and then basically that is, then we would like for those bits, whatever they are, those purposes we rendered in a recently consistent way. So then it's easy for people to cover. Yeah, well, not just consistent, it's separate from the people who set them. Right. Right. Yeah, just sure. Now the question becomes actually, do I as the customer decide to choose whether the rendering is from EFF or from customer comments? And that gets into this substitutability that drives self sovereignty and it's another kind, it's another aspect of the standard stack that we deal with in, you know, rebooting web of trust context and all of this, because you want to have substitutability at the layers that impact the customer as much as possible. You don't want to bake in EFF or customer comments. No, exactly. Yeah. Right.  Yeah, just like to choose how to order. Right, exactly. If you want those to be swabbled, you can use one or the other. Two things. One is for those of you on the chat, I put it to the document that the IABE has and the page that we were talking about last time, page 27 and a statement there, I'm not going to go into it, but it's there, I put it in quotes. The other is if anybody has an Android with a charging port, with the old micro USB, I want to plug it in with a speaker to solve it. Where does this mind you to come to chat this week, right? Because zero, there's an impact. One, there's a policy. At that point, do you have like whether or not the world is now disorbitant in my browser, when I go to the university, one of them, I forget, the one that's TOVR, basically pops up and says, this website's policies are uneven or something. So it just flashes as a notification as soon as it's connected to the website. Sorry, I have a quick question. Is it an idea to have a shared, I don't know, Googlebot or something like that? But yeah, then we can have shared notes. Because nobody, I think this is too small to really make up this, and I'm putting it. Okay, I can email it to everybody. I'll put it on the game upside. Sure. I think that's the event site that's linked from the event rights on other websites. Okay. Take a look at that. Yeah, that's it. It's making the noise. It's a magical, magical half. Perfect. I have another question. I don't know where this fits in. So people are talking about grease monkey? Yes. They're doing a grease monkey script. Do we limit ourselves to a large degree? It's people that explicitly install that. Isn't it better if we can set it centrally from the site? Absolutely. Posted by EFF or whatever? Absolutely. Well, you can just go there and say, yeah, this is what I can say to go, rather than I need to now install an extension or a plug-in. There's a technical difference. Without the plug-in, we can't actually do the magic that we want without cooperation from these other parties. So if we're trying to do the independent of their agreement, we've got to have something like an extension. Unless it's baked into Firefox. That's a possibility here, is we could take whatever, an outcome of this could be something we take to Firefox and say, you guys can do this at a fairly short time. So it starts out as a grease monkey script and what lines have it written? It's one thing we can do is a grease monkey script and then take it to Firefox to see you can. This is what this does. You guys ought to have it inside the browser for that matter. Take it to anybody else. Yeah. Yeah. Okay. It's a question that I had to add. A Chrome has conflicting interests, obviously, but they also have things to say they care about this kind of stuff. So it's also something you can take to Chrome and say, hey, similarly to make a part of Chrome as well. I don't know, probably not. Start with Firefox. Start with Firefox. Yeah. Yeah, so Brave uses the open source code base in Chrome as a Chromium. And they might be able to do it, too, to do it with Brave. That's the case where we can talk right at the top of the company and they can have it if he's interested. You can't think he would do it, actually. Okay. Is anybody here use TOSDR.org in their browser? I have used it before, but a long time. There was TOSDR and I was in your TLD. Yeah, okay. It's a crowd-sourced version of what I suggested customer comments could be doing. By the way, I have friends saying that the link on Hangouts that's posted on the site doesn't work. That site listed on the site. Oh, we're going to change it on the site. Okay, which site? The Eventbrite site? Yeah, TOSDR says that one. I was in the midst of changing that, actually. So I'll do that right now. I'll continue to do that. Because people want to join the Hangout and you can let us know the Gmail address somehow. Okay. Oh, because you're limiting... Oh, you need to acknowledge Hangout is invitation-based. Yeah, thank you. So you have to invite the Gmail address to tell us. Oh, okay. So there's no public thing that they can knock on the door and then... It works for you? I don't think anyone can join. So it'd be a disinformation... Yeah, however, we're using the Media Lab service that I just go to YouTube Live and also directly to YouTube Archive. And it runs on the Media Lab service. Oh, are we also doing YouTube Live and are people seeing this? Yes. Yeah. So everybody can see it. Okay. And that one's from Johnathan Asken. Oh, so this is also going... Okay. So people can just join YouTube. They can watch it and they can join it. They can give us a Gmail to talk about. Okay. And they can relive the moments forever on the Archive. And that's exactly why we're able to open Hangouts, actually. There's a way to have open Hangout not go to YouTube. To have that go to YouTube Live. So you can get an archive of the events. I would see that instead. Right. I'm going to... Oh, and there's a video about Hangouts. Yeah. Okay. So here's a video about... What... So one quick thing is if you go to the event site, which is that github.io forward slash Media Lab site that's on the... That's right back there. Yeah. Then you can... There's a link there to a hack.md page. There we go. And I'm just broadcasting it now. And this is an open shared notes site called hack.md. And so if anybody could log into this and kind of hack along with us. And so just to get us started, I put in the three points that... You know, the room kind of sort of starting with the most functional requirements or something or functional aspects. But it seems like there's more stuff, too. When you get to hack that on the event site itself, I put a link to the shared notes. So if you go to github.io forward slash github.io forward slash github.io that's hack.md, you'll see. I'll just demonstrate it, I guess. And let's see the cursor. Oh, there it is. And the mouse. So funny to do it backward. Whoa. So if you go to anybody that's trying to come in. So do you see the live notes there? If they don't get that right, the links are correct now. And here's the link to live notes. Kind of click that and ring, bang, boom. In you go. Yep, that's it. And then it will sign in with the github or Google or github or github. And you can hack along with us. Okay, so if I'm going to put this on the, if I were to tweet this, what would I tweet it? I would tweet the media lab github.io site that we said, okay, which has links to the YouTube live. And it also has links to our shared notes. We have a hashtag? We should have a hashtag. This should be cool. Good. Consent day. Consent app day. Consent app day is fine. Okay. Press go change. Consent, gdvr, hashtag gdvr, hashtag consent. So the remote people are seeing this, right? Now they are broadcasting it. All right. So do you want to, so on the agenda, it says that we'd be looking for food around now. And also just a suggestion. Just going to be good timing to look at the, what it is that you wanted to build and see if it's, if it's been stated in a way yet that some of it's buildable. And then there's so maybe like who is going to hack along. They could break into teams or something and to produce technical people. How was there some legal stuff to do? But like, so if you kind of look forward to five o'clock and imagine at that point as I look back on what the outputs would be, like we can start to define those and see how we do that together with the people online and in the room. What kind of users are we targeting? Is it more like anyone, whether or not they have any type of ability or people who know I could think about privacy at all times in the future? I see three or four different constituencies. I think we start with our friends. Okay. And that includes the Berkman friends list. Everybody, the 11,000 people who are attached to Linux Journal. EFF, everything that Corey Doctorow and others can tweet. Bearing in mind, as Mark and Griesen put it to me about why the browser took off, because after he wrote it, all technology tried to start with technologists. That was his almost tautological statement, but I think it's true. However, study after study, even though the advertising world will deny it, show that people do care about their privacy when they wear clothes. And most people do. And so I think we can get, we start with the wizards and let it spread to the mothers. But we can, like for example, Nellie, what's the other thing with the New York Times? Bowls. Okay. She wants to cover this. She started, she did a story on this a few weeks ago that started with my name and she wants another story. Then she sees the GDPR hitting as being my story. She did a story on this a few weeks ago that started with my name and she wants another story. Then she sees the GDPR hitting as being my story. Okay. Maybe I'm not on mute right here. Who was that that you spoke? That was me. Saying exactly what you just said. There's Mark. Oh, okay. But I'm on mute here. It's an apartment, a repetition apartment. Somebody on the phone turned off their mute and it was a delayed thing. Who knows? By the miracle of metastasis, there it was. Anyway, yeah, I think we could PR this thing really well and I think that if we have something simple that Nellie couldn't talk about, it'll be, it'll happen. Yeah. Can we ask is this a correct statement? I'm sure it's not, but the idea is that we did a thing with the cookies that the result would be that we provided individuals an easy to use method for expressing that they don't consent to add tracking as part of what they're providing consent to the service. I don't think you're providing consent to the service. You're basically like the website is giving the service anyway, right? But, you know, we're basically, I assume we're not consenting to third party anything. Is that, is that a broad enough statement? You still there, Sam? I am sorry. My wife distracted me briefly. Yeah, the question. Okay, was it? Oh, we're, the consent will basically turn off all third party things or just the ad tech part that has to do with these sub domains. Just be the cookies and we can craft the cookie to the handful of flags you can set and we can make a decision about which flags we actually want to set. That's independent of getting the cookie set is the what we want the cookie to actually say according to what they have designed into their standard. But we don't know what they're designing. They've got it in the spec. I'd have to look it up. It's deep in the document. But yeah, I think there's, I think they reserved 40 bits of information, but they're only currently using eight. So whatever that means, we'd have eight different options to set. So Sam, so one thing that would be very handy is if you could identify, if you could dig around a little bit while we're doing this today and find the reference and then put a link to it and maybe like a little copy and paste into our shared hack doc, that would be one very useful thing to do. Work backwards from that, you know, stable point. I will grab that. There's the links were shared in the original thing, but I'll steal them and put them in the hack thing and we'll make that happen. Okay, thanks. And then the other thing that I wanted to clarify is when you spin doc, that we foresee a world imminently, I think it's already emerging, where we'll have a new like balance of like consent walls that people have to go through because that's how donkeys are responding to GDPR. Mike, was the reason why the publishers are, yeah, but I think social networks too. So with this, is the idea that this would be like in total independent of that or were to occur somehow in the context of those consents that people are giving? I think it's both. I think we're posing something that's independent of what they're doing that I think could apply whether they're putting up a consent wall or not. However, a user experience effect we would like to see is that consent wall comes down because we have this cookie of our own that they'll take. That makes sense. I think so, to state it functionally, would that mean that like the use case would be the ad publishing network has consent wall and rule, there's a rule that triggers or something it says if user has a VRM kind of cookie with the right settings that that's an alternative to the consent wall, is that kind of what you're thinking? Yeah, yeah. Okay, it's less alternative than it takes the wall down because the wall, yeah. Sorry, it didn't mean to derail your... No, no, no, please. I like it derail. Two points. Two short points. The substitutability should be in two separate categories. Substitutability for where, in both cases, the choice of the user to substitute. Eat where you inherit policies from is one class of substitutability and where you get the rendering step number two. So in other words is another class of substitutability and to the extent that one and two are separate, they need to be ideally separately substitutable in the stack that we designed. The other thing, the other comment is I would put somewhere on here as a heading a way where we're going to track the relationship between what we're doing and GDPR because whatever else we do, we would want to document where we're touching GDPR explicitly again as a sales tool going forward. One thing that came up in a session at IAW with Dr. and Searls and Elizabeth from Arizona and another guy was that in a GDPR setting where you had a company that was going through a consent process, that this could be part of a consent protocol that basically achieved a record of a user consent to their terms and achieved a record of the vendor consent to the user terms all as part of the consent to use the service and somehow wrap those together and sort of like attach or logically associate them as one instrument. Right, so I would certainly put a link to that with a short one sentence, a one line explanation. I would also put a link to the session that Eve and I ran at IAW around outsourcing GDPR using UMA because it's in the same category and there's at least a white board and yeah we're probably going to come up with four or five or six of these sorts of things that are part of this heading. Yeah and I think it's important. No, I would have a separate high-level heading for the GDPR sales. I wouldn't put it as a yeah you know GDPR connection as a way of explaining or selling what we're doing. And I think we need to be clear that consents watch six things right and it's not so when you're talking about GDPR this is a subset. That's what I mean. So to make it to be clear the purpose that we're talking about is the consent purpose here not the public safety or whatever. Any of them. No, what I would say is as we do this or after we do this we would look at what we've done and fill in this GDPR sales section with whatever parts of GDPR we've touched. Sure, right but not only the ones we've touched. Right, right. Jeff, let's say a thing during the after-the-back as opposed to my time to do it before, I completely agree. Yeah, this is not going to be yet. Of course my train, my own train of thought that I completely do it. So what do we want to do on the pipeline? I want to organize.  So you were talking earlier about that there are more carrots than sticks. How are there more carrots than sticks? Because from my perspective, what are the carrots for the after-sizing industry? For the after-sizing industry. One of them is you can still be programmatic. You just don't have to base your programmatic on tracking people. Another is you're getting a clear signal of intent from the individual side that could be expanded to include what we call intent casting, which is where the individual actually says what they're looking for. In other words, the individual can also advertise. We start creating the much better signaling paths between real supply and real demand rather than the way that the advertising industry sees it. Better signal. Better signaling in both directions. You get actually a better programmatic framework because you have the endpoint involved in the programmatic system. And it cuts down fraud. It eliminates fraud. It picks malware out.  We can start bringing in forms of accountability. And maybe if Dave wants to jump on this, I'd like to do the hyper ledger angle on it. We talked at the last session about hyper ledger Indian and Sean has stepped out. He's involved in that where you basically record agreements when they're made on a blockchain or even the fact that something happened on a blockchain in the, which is an open source, the open source base of sovereign which Joyce is involved in and ever known which employs Sean and which already has one Canadian province and two US or three US states plus all the big operators in credit unions wanting to participate in. All of those things have an interest in having interactions with individuals recorded on a blockchain in a way that they could be audited under. They could be found later. And if we have legal agreements that are involved in this, if we have first to second party agreements, those can also be recorded on a distributed ledger. They don't tend to use it to our blockchain. Yeah. No, okay. And I think all of that's under sort of an umbrella of increasing operational efficiencies for people when they're operating in a world where it's at play, right? So right now, if you try to do this, it's awkward, right? It's cumbersome. And so we're not only increasing the effectiveness from a user perspective, but we're actually increasing the operational effectiveness from everybody who's involved in it. It's a political audit time. So I would imagine that with GDPR and with the fines and the new regulatory oversight apparatus, the ability to quickly respond to an audit and it would report. We're going to put together all the consents and all the logging and everything to be very economically efficient. Well, that is two things. That's a risk production as well as an operational efficiency. Yeah, both things, by the certain clients. The fact that you're doing this makes you less likely to be looked at closely by a regulator. And if you are looked at closely by the regulator, then your ability to have demonstrated operational privacy for logging better term is what is going to really sort of help reduce the risk of negative finding. So to be clear, my first priority is not the ad industry. First priority is not the ad industry, he said. No, it's not the ad industry. But if we want to, what did you say, extend it all off branch and not go head to head with them, then we should make that clear. So here's another thing. And this came up at one of the several sessions I listened to again this morning, which is that it can speed up the load time on a web page. Right now, the load time, if you go to, say, the LA Times and it's loading 50 or 60 different trackers, and then as you go down the page is loading 50 or 60 more, and your entire experience is slowed to nothing, that's an issue. So if you're cutting out all of those things, which are all vectors for fraud and malware as well, and with the user has no idea what all those things are as well, this is, it just makes the entire experience much more efficient, simply by bringing it back to what it was likely in the first place. So, so a question about, so for the indie, delicious people here, as are the hydrologists, is there any capability of, of indie that would be a good fit for this? So this week, so Sean comes back, he's going to be office call at 12. Okay, great. And Sean is our indie guy. And they too, but he seems to be quiet so he's probably just gonna, oh. He said he would try again. I guess he's not. Oh, I have to get to school. All right, so, um, so talk. Okay, so what I'm, what I'm thinking is, what I'd like us to do is actually go around and see where each of us is with this right now, what we might be able to do. Because what I want to see happen coming out of this is, you know, what is it that, that customer comments can do, sovereign might do, whims a goal, two cows, sales, business, whatever you do. Open consent, right? Open consent. The rest of us, and then see, see if we want to break out, even if it's just the opposite ends of the table here, or one of some of us go out there and that's actually a nice little spot. If we want to break out, because that makes this point that the center is easier to have a small conversation with a bunch of people. Like some of us may get together over legal. I don't know if Elizabeth is still on the line. She's coming back. She's coming back. But we might want to get, you know, forgetting her name, forget Robert, Robert, and Elizabeth on a computer and talking, you know, and then forget her name too.  I'm trying to remember your name now. That's a different person. Different yellow person. You said it. I mean, I'm looking at kids for a while, and they're all over my life. Give me a break. Wow. Wow. Kidding. I have so many awesome jokes that I'm shoving into my mind. And then, and then there's the great me too over in here. And then I'll be talking to Charlie Rose next week. So I'll just take for really bad jokes for that. Yeah. So yeah. Hi. I'm Stephanie Nguyen. I am a product designer researcher. Previously, you worked at the U.S. Central Service in the White House. Now I'm doing a lot of design work in privacy, and it's specific to healthcare and genomics and all that stuff. Yes. I know Kathy. Cheryl? Stephanie, yes. Close. Sorry. Oh, I'm currently a fellow at the Center for Public Leadership at Harvard Kennedy School, and I'm a particular master's in public policy. So I'm over there. You're over there. There is. There are many there. There's a lot of theirs. Yeah. Yeah. Good. So we're, well, maybe just go around into different people here to sort of say where they're at right now. And why don't we? Did you guys want to do this? Because I don't want to. No, no. We didn't do this part. We did intros. So this is where we want to go from the point of view. Right. So you have to like put your hand up and say what you're going to do. Yeah. We did that an hour and a half ago for the rest of this, but you could also put a brief intro and then talk about what we wanted you to do. Well, you're going to introduce yourself. So, yeah. Okay. We'll start with to your left to your right. Let's start with Robert. Since he's drinking coffee, yeah. I don't know. I feel like I'm the least experienced of the bunch. He's the least experienced. Yeah. As a matter of fact, I worked at a law firm in 2016 in the summer right after this came out. And they asked me to write a summary for like a 20 page summary, kind of like what you would need to take into account. And it was like, I didn't invest all that much time. But if I had any expertise, it would be like on the legal side of things. Okay, good. So and there are legal pieces here, Bill. Can I pass them back? Yeah, Adrian, because I know Adrian. I am going to work during the hacking phase and pay attention to how what is being done interacts with the self sovereign technology stack standards that you know that I deal with. In other words, I don't have a horse in the hack itself. Okay. So I'd like to drill down on the cookie itself. Okay, great. And I would like to try to get a little better understanding of what the IAG has in terms of their concept. And then see what we might come up with as a strategy to put forward one, which has both carrots and sticks and bricks. And the important point to bring up is that there are two IAVs at least that we're talking about here. And there's three if we include their lab. Okay. So and Sean needs to hear this because he'll appreciate it. First, there's the big IAV that's run by Randall Rothenberg that played Godzilla versus Dan B with Mozilla back in 2012. And Mozilla said they're going to make that track happen and effectively squashed and then caused the whole ad blocking thing to happen. They are not in the room for this. What is in the road is the IAV Europe, which I found out from Brendan Hyphenate. Okay, so we met with them earlier this week. Brendan Reardon Butterworth is employed by IAV Lab and he told us both IAV Lab and IAV Europe actually licensed the name IAV from the big IAV and are not yet and can operate independently. IAV Europe is taking the lead on this and that's the document that we're looking at. You're another one struggling. And I think that they're going to be friendly. I hope so anyway. And Brendan, when we first met him at a Mozilla thing that Sean was at, it was a dinner. And I said, and he asked who here or somebody said who's blocking ads, I said I am. And he said, you're stealing from children. And he's as a bellwether, I think that the IAV is there on, as we said at the last meeting, they're kind of there on their hind foot on this whole thing at this point. They're defensive rather than offensive. They're standing in what's going to be a crater after the EU does whatever it does after the 25th of May. But the IAV is the one that we're caring about. And that's all the documents we're looking at are theirs. And the drill down, I don't know where it is, but there's the 40 bits that you put right there. So which one? We've got the two links in the bottom. So for Sal especially, and I want to look at that too. Is that one of the links that there's both links that Sean was providing? So it's what we said. So we're going around talking about what we want to do. And just so I think, did you say you wanted to do a 20-page paper? No, I did a 20-page paper like right after GDPR came out for a law firm that tried to summarize the legal consequences for companies in the EU. And so I tried to kind of think about the legal side of things. So by that, I'm trying to add value. So you think you might be willing to maybe extract the stuff and then apply it to this path? I can try. I don't have ownership of this document. We could write something fresh like I could maybe help you. Absolutely, yeah. On this particular topic, the best thing I've ever seen written is the nightmare letter from Pricewaterhouse Hoopers. Because instead of it being legalese, it's done in the form of one of the 11 things that the data officer, the privacy officer of the company, is going to be presented as a denial of service attack when people send them a request for their rights under GDPR. And so rather than having to parse it from the point of view of interpreting the law in a 20-page thing, you can actually just look at a three-page letter that makes it clear, hey, you're going to have to be, you're, as a company, going to have to respond to these 11 or six requests in the nightmare letter. And there are 11 or 12 things in there. Six of them are generic and five of them are specific to the individual. The generic ones can just be posted on the website. The five specific ones require actual coding around the database or portals or whatever, exactly. And that is a much easier now. I'm not an expert, I'm not, you know, in GDPR. So I don't know how complete it is, but I think that's a much more workable thing to start with. Actually, the webcast we got last week, literally, this is, this is Privacy Denial Service. If you don't mind, Adri, because I was busy tweeting for us what you just said. What I said was that rather than working from a document... I have a link to the... Oh, it's up there? Oh, okay, the nightmare letter. Oh, there you go. Oh, you got that, great. So I'm not looking at the nightmare letter, but I'm not on the page either. It's got the best name. So how do I get to that page? What's the shortcut to that page? Well, go to any of the event pages, and then I'll show you a link. Okay, all right. That's our series. So, so far, so we'll do some kind of legal prose that rips off the nightmare letter. It turns into like an easy treat. The other side of it is we talked about tracking kind of what we're doing versus GDPR and seeing where the overlaps are. And we could try like the cell side kind of aspect. And we could think about that as well. I mean, we talked about kind of standardizing things. There's a ton about icons in GDPR. Maybe there's overlap there, kind of things like that. You know, easy things we could hit that would help us say, okay, we're really in the spirit of this new regulation. Okay, maybe we can start along with Elizabeth Burnera. And if Electra comes, Electra is an advertisement this year, and she is a UK lawyer with GDPX expertise. So she was, she signed up, so she write on this app. So it's called like legal, legal, legal tiger team. Okay, so that's legal tiger team. And then Bill took a pass. Was it? I can come back if you want. No, I just want double check. And then Adrian took kind of a pass, but believe like, oh, you didn't. I was going to learn on where people are hacking a while, because I don't have a horse in what the terms are, race. Right, okay. And then Sal is going to do a deep dive meeting with Sean, and I might split the time with that, too, into what's actually going on with the cookie, how do we hack it? All right.  Yeah, I mean, that's the best. I'm here for two things. I want to understand what the what the best way would be to do this, technically, to actually get it done. I have three development teams working on GDP. There are related stuff back in Toronto, some of them know JavaScript and Python, whatnot. So I could put them in a work stream and then we could get it done. Like Sean, Sal and you. Yeah, so I would like to see if that's interesting or suitable or like, I just want to try to first understand again what it is that there was a conversation with them. Make sure you guys have a whiteboard. Yeah, and I think through what kind of story. How about H8NNL? H8NNL. Okay, thanks. I think from both sides and the developers. Yeah. Nothing about the specific purpose that they've seen. Maybe, maybe in a related some Indian stuff. I don't know what's the plan. Well, I think my my fantasy is that Whimsical's Walt is where a bunch of stuff will live. So to put this one of the terms that was used by it was Andrew Hughes, who helped organize the last section, is that we should all have a privacy dashboard.  One of those could be here's, here's around keeping links to our actual sensitive data, which is what you've got. Because that may be phrased out a different way. Sure. Maybe what everybody needs is a privacy dashboard in the lack of, you know, pick the certificate or go daddy or whoever you want that provider to be in their control panel. Right. So what I think, I think what we want is to move control from where it's outside of the policy setting in the beginning of this workflow into the very beginning of the creation of those. So then it follows all the way through. Okay. So let me throw another thing in here that actually may have a Walt indication here at the end of today and tomorrow. By the way, we want to continue this tomorrow if anybody's hanging out. Okay. So we have a rule. So we can continue this tomorrow. It's different. Thank you. Thank you. Who's miracle worker on this thing. Is is Nitin Bajati and Nitin is also on the customer comments board. And he is, he worked for many years for Oracle. He actually worked for Oracle three times each time by acquisition. Or the never hired. We have a daughter who did the same thing with the gap. She did the gap. Anyway, he is back yet corporate. But anyway, so he is now working for a company called Service Now. Service Now is one of the largest companies you haven't heard of. But they are behind a lot of the call centers and all the service side of companies. So there is a sign to this that is also one of the standard ways once we start building out the consequences of what we're starting here, that are the persistent ways that we in a standard way can relate to many different service organizations. Right now, as one of our Vera and Cabal put it, if your sales force has one great big backend cloud and it has 100,000 corporate customers that are implementing that cloud in a way that give customers actual B2C customers 100,000 totally different income here and experiences of service. Or of doing anything. We could unify that. We could have the standard way that we call for support.  But rather, this is what a service call looks like. This is what a request for updates looks like. This is what, I mean, with this thing last night, if I had that, I could have told Apple, I have this new computer, which has this serial number. I'm trying to get it, you know, everything pulled over from this computer, which has this serial number. And I wouldn't have to go through the several hours of shit that I went through last night because they don't have it, which is, I have to put an update this operating system to that one, right? That's the kind of thing that is doable if I can send the right signals. So, there's a bunch of records that we can have in a vault. Which means not just a cookie, but watch that cookie. Oh, God, no. Oh, no, no, no. This is the long term vision. We're not, we're not. Yeah, I mean, in some ways, this cookie is the camel's, it's the customer's camel's nose. Under the tent of all of business. That's actually friendly, right? It's not like we're coming in here to mess everything up. We're going to get, we're here to tell you, you know what, your guesswork system where you're trying to know us so well with your, with AI and ML and all that. Are you drawing a camel? Put that over there. We're going to actually give you our intentions. Hi, I actually am a direct TV customer. Here's what my thing looks like. I also have a Samsung TV and I have this DVR and I have relationships with these other companies. We can fill in a whole lot of blanks this way. I just changed my email address. I'm letting you and everybody else know in one move. That's the kind of stuff that a vault can make happen, right? So, this cookie thing is just what we're trying to do out the door that in the long run can change all of business positively. For Bill, who's, by the way, is going to end up running all of real estate, okay? He's been working on this for a long time, but basically he's the guy who wants to put the world, the world's most expensive marketplace.  You know, but if the buyer is at least a peer in that thing, where I'm looking for a condo that has a big kitchen because I'm a foodie and I want one that's got a gin air, you know, or I'm just making this up, but I mean this is the kind of thing that's possible if you're looking at markets from the customer side, right? And that's kind of that hack that we're working, that's the larger hack that we're working on. That would be content casting, right, from the buyer? Right. Yeah, and that's, that's more than a take-casting, it's probably, it's not a word for it, but it's actually, I guess they're several, what is VRM? It's vendor relationship management. That's when we started this thing 12 years ago at the Berkman Center. So... That's just to remind you, but that's a cookie. The facts of the cookie. Yeah. Or... You know, but we can also inform policy, right? I mean it's... It all needs to go together. Yeah, so an interesting thing that's happened is that, and I like it that you brought this up, is that in a way what the GDPR did was it gave every individual a privacy policy and told the world of suppliers you have to comply with this, but what happened is as often happens the policy got ahead of the code. We're going to bring the code up and start meeting policy with code. The thing that's compelling about GDPR from a policy perspective is that it has real consequences. Right. There are all these guys who are at the table and never live in it. And yes, some of those consequences, the most painful ones are the financial ones. And now we're seeing possibility in Geneva there might be some change in that country about how those consequences are dealt with. You might not be charged on the first offense. It might only, this is something that Marcus was telling me yesterday. You might only be charged a financial penalty on the second offense, etc. So you're starting to see some variation. Well, this goes to the whole point about people who aren't being proactive about that and taking these kinds of approaches. Probably we might even get a second pass, right? Or whatever it is, you're the light. And the policy assurance policy, exactly.  So anything that we can create on the user side so that the good companies that want to do something can say, oh, look, what we're doing. We're listening to these user signals that are coming from these NGOs and these sort of civil service organizations, civil society organizations. We're good guys. We're trying, you know. I mean, I'd like to just following up on that. If the dashboard can generate the cookie. That's possible, yeah. That would be a really cool thing, right? So I don't know how we go about accomplishing that, but making it easy for the user to generate this cookie or somehow maybe- I'm thinking a little bit for those. Trying to get it to work that. And it could even just be some basics of it, right? And then just craft a minimum cookie, right? Maybe that's what we try to do today, right? So there was a difference between GDPR and do not track. The biggest one for me is the consequences. GDPR has hard financial consequences for violating. Do not track. It was just technically a polite request. It was a polite request, but it was also technically correct that said I do not want something and an industry looked at it and gave it the middle finger. So now we're not going to pay attention to that. Even though Bill put it into his browser, we don't care. There is an outlaw to that. W3C had a flag in the browser, I think for COPA, maybe five years ago, 60 years ago, Child Allowed Protection Act, where you could have a browser, not necessarily a cookie in the sense of an advertising cookie, but your browser would constantly broadcast as persons under the age of 13. It was deprecated because some people felt like, wait a minute, I don't want to be broadcasting that we have children. But at the same time, good actors would go, well, 13-year-old, we'll let them in. It had good intentions behind it, but this is the kind of web we might be able to co-opt to use for this person is not accepting your policy or this person has a competing policy, some kind of challenge response in there they could possibly be. I can't say this strongly enough, but I am speaking as a privacy professional by almost any measure, and I completely disagree with the idea that people, that we should expect people to set particular aspects of the policy for themselves. That is the third or the last choice that we want to do. We want people to inherit the policy from somewhere that they trust, the way I inherit whatever I inherit when I install a privacy pageant, and over the years, I've installed four, I mean six, I don't know, I probably want four or five of these things. I have never been tempted to change any of them, and I'm not exaggerating. And the one or two times early on that I try to change them, because for instance, self-destructing cookies I had in there for a while, and I tried to fill with it. The next thing I did was I threw it out, because it was even when you have something that you inherited by self-destructing cookies, and then you try it as a professional to modify it, it does not work. And so in no way should we be designing for people to change the sliders. I agree with that, and I think we should not be putting the onus on the user. The user wants to get news. They want to search for X. The last thing they want to do is read 48 pages of text. But they do want to be able to see, you put a privacy badger just to read yellow. Sure, I agree. It's really, really useful. So somehow in this dashboard, while it may not be something that someone actually sets anything, it would be useful for them to be able to understand it. But my great criticism of Do Not Track was my browser should tell me what I'm being before. But not anything other than red middle finger in the top corner of my browser saying, they're not respecting your signal. Just so I know that CNN doesn't care. Well, I want to modify what I'm sorry about. No, go ahead. I want to modify what I said a softly, a tiny bit because I've never seen this done successfully. But I think it might be done in the GDPR, might drive this to where it is done successfully. I attribute this to Kent Quincy and his work five years ago where because GDPR encourages people to selectively change the sliders, the thing that I said I don't want anybody to ever have to do, what he introduced into the conversation was the idea that as you change the slider, the page tells you what functionality you're about to lose. Yeah, yeah. And so that when, if IAB or whoever decides to interpret GDPR in this way and force people to play with the sliders, then it's important for us to be able to explain in our terms, like I attribute to say customer comments, what this change ought to mean in the policy. But I never, again, maybe GDPR will drive us in that direction, but Kent's done this not really out of the lab. So Andrew Hughes is here. I just invited him to join. So I just want to put out a project that just starts patching customer comments that might provide some clarification and like another way to go with this. So customer comments is all about balancing the power between customers and the institutions that serve them, whether they're commercial institutions, government institutions, not profits, whatever. So what we've talked about a lot is, well I want instead of a loyalty card from every single place and you've got to accept a loyalty card, I want to put out my life's loyalty card. So customer comments are an issue of loyalty card. And behind that loyalty card is I'll be loyal to you and this is my trust framework of rules about how you should treat me. And I like what you're doing, so I'm going to give you my loyalty card, you piece copy or smart final or whoever you want to do that. So if we're talking about larger ways of doing this, part of that would be like, I'll have a dashboard of what that gives me if I care to drill down, if I want to look at what it looks like, or I can just say, I know that customer comments is stands for these things and I'm perfectly happy to be a member, have their card, and then the other thing that it gives me if we work this through Indian software and all that is that it's your way to log on to anything, say single sign-on, you never have to log in again because it relates to your real identity that's hashed off. Blockchain. So. So Joyce, to this point that you just made, I separate what you just said into two pieces. I want, and you know this very well, I want to be able to tell the merchant here is where my authorization server lives and then I want to inherit policies for that authorization server from customer comments. I do not want to have, in other words, agency, which is what the role I'm playing here does means that I do not share my policies with the site, with the service provider. Agency means that I only share my agent with the site and then I inherit the policies from customer comments. And so that's why I said that I was going to stand back while we do the simple thing. And then try to introduce the standards for agency that I'd source as an option or as a component, depending again on what we're trying to do. So all the reasons I put it out there is just to kind of have a vision of one thing that could do this in sort of a mass way. And I just don't think, I agree with you, like some people really will want to have the agency, other people will want to just sign up and say, that's what my policy is. My policy is the same policy as everybody's policy. I, but we want to encourage, in the sense of GDPR, we want to encourage different, we want to encourage those vendors those service providers that want to compete on privacy to offer agency because they want an A and some patient privacy or whatever you want to call it. And then the service providers that don't want to offer agency, well they still get a B, they don't get a F. Hi, it's Andrew Heager. I wanted to reward you for being one of the good guys. Not necessarily always punish the bad guys, but reward the good guys. So they work economically for me to be a good guy as opposed to the status quo. Yeah, so that's sort of to your point. So identifying policies which are ready for inheritance is a pretty useful thing here, right? So among the people who do, so those products, I don't know, some factory use different products in the U.S. you know, where everyone calls, right? No, it's definitely acceptable. Right. Hi, it's Andrew Heager. So then we don't need to design policy of the cookie with literally, you could say good, it's sort of good policy here, which is sort of acceptable policy. So what, so I'm not sure what you mean by that. Sorry. So I'm trying to understand, when you say inherit policies, that doesn't mean that at what point does the user, that's an opt-in kind of thing. I opt-in to inherit this policy or by default, when I install my browser, I automatically inherit the default. So both what we implement and what sovereign foundation promotes is a four-layer stack. We're using the same standard for more likes. I mean, the debate is going on in some place called the Decentralized Identity Foundation, but we're all general one. But yeah, we're all part of the same, okay, a family of developers and in this four-layer stack, there's a person, the person has a mobile device as their agent, with Patrick's name and your element. Then, but it is not addressable because it is a mobile device. Right. Then there is an agent, which is controlled by the mobile device, which is also self-solving. Yeah, it's addressable. Running on the mobile device. The mobile device has a secure element. The agent has its own secure element that is a subset, if you were it, or a delegate of the biometric. But it has the benefit of being addressable. I serve, it's an UMA authorization server, literally speaking, the thing that's alumni. Right. And then you have the identity. Which is the public player that lives on the blockchain or lives in an open ID space or both. That's my audio working. And so, when I talk about agency, Yeah, I can hear you, Andrew. When I look at the software, it's entirely, I mean, we have a call setting on the same platform. Like Waller has been once assisted by us and it's totally used by software. Those are trivial differences. Yeah, yeah, yeah. So, we just so you know, we have Andrew Hughes and Mark Lazar, both ready to speak. But I don't know, is that thing still on? Is it on? Can you, can you hear me? Can you hear me? Now it's on, okay. Now can you hear me? Yeah, now we can hear you. You were trying to talk. You were trying to talk, but we had you muted. Did anyone write it down? Because it was really good. You looked really good with your head clamp on, so. Thanks. Oh, my microphone. Yeah. So, I just wanted to ask a quick question for today. So, are we trying to demonstrate to the IAB Europe that they're missing an important set of inputs into their design of consent management? So, they've done this cookie white paper. They know very clearly, it stayed right in the white paper itself that it's a bad solution and they're working towards a better one. We have the opinion that they're missing the voice of the customer, the real voice of the customer in their design thinking. Is one of our objectives to inform them that there is actually a better way that we would like better? Because all this talk about all this future stuff is great, but that's going to take longer than three hours. You're looking great, by the way. I love the infinite room in the screen. So, one thing to look at, I think when your property gets off or something, is there's a link to a shared notes file in hackmd.io. You can find it in the running notes. And it's also on the GitHub page of the event. And so, in there, we've kind of got three kind of like tentative smaller, like, tiger team groups that work on things. And one of them is a group to do a deeper dive into the cookies and that spec, and something that would be achievable this afternoon. And we added your Sean, right? Oh, that's Andrew. Oh, hey, Andrew, that's fine. So, like, we can add your name to that. Tiger team, if you want, Andrew. And I think we're going to be breaking into smaller groups that are more action-oriented, so I'm quick to share, you know, in a few hours, imminently, after ordering pizza. So that actually is the next item of the schedule. Because Mark's got a comment out there in the manual. Well, Mark has one of these things that we can work with. Yes, so it just seems that a really obvious pattern is I'd get a publisher to put a consent button that creates a consent receipt that can be used, that goes into the browser, and the consent receipt informs the creation of the cookie. Or a reference to the receipt that's placed in a cookie that exists already. And then the ontology that works with sort of standards and international lexicons can be used by, you know, people who want to develop solutions there. But I think the pattern is the publisher provides a consent. The user can then negotiate, provide more consent or by, for the use of privacy rights, or the removal of privacy rights. So for instance, I don't give you permission to track me around the internet. So I block, if you wish to track me, I block the use of my data using a GDPR privacy right. So it's sort of a way to use, to get user terms and negotiation going by using the publisher's consent and not really going, you know, I don't really prescribe to the IB framework. I don't think that we should fix it. And I sort of don't think that we should pay at home age as well. I might be a bit more hardcore, but I definitely think the consent, the policy of the user and the publisher, that relationship and the control of that relationship should be used in the thinking of how you create the cookie. And to that point, one of the golden opportunities we have with the IB creating such a accessible to hackers feature is that even if we don't subscribe to how they're using the cookie and how what this represents, because they've published the data format and we can intercept and rewrite that cookie. There's an opportunity to make it do more of what we wanted to do and less of what they wanted to do. But I think we need to look carefully at the cookie format because clearly it doesn't do the things we need it to do because, for example, the purposes list is written by the IAB Europe for advertising purposes. But maybe we could ask them to include additional purposes that are more suitable for intent casting and VRM and therefore co-opt their mechanism. Which if we get them to do that as a nod to the commons, they might do, doesn't cost them anything to increase the breadth of the purposes. We're not asking them to spend any money. We're not giving the middle finger to the ad tech industry which is paying all their bills. So there's a bunch of benefits in there unlike if this is an ad blocking solution which is an instant middle finger, they might go along with that. This is a diplomacy aspect to that.  Could you just put a sign on your lawn pointing to our house too? There's a big difference between the middle finger and that. Well, there's also just going directly to the publisher and getting consent and then placing the cookie that this is the consent to look at for ads. And you probably didn't direct from the user instead of through. That's a great point Mark. When we think of IED, they are for the most part funded by the ad tech industry, not even the publishers. That's really, the United States DCM is a different organization in Europe. The publishers are getting their tails kicked and this could be something that helps the publishers. Exactly. The publishers are not going to do it individually while we talk to them. One off, they're just scared to death. So this is a way to help the publishers, I would think. And particularly when you talk to them one at a time, they don't want to do anything. But if you say, okay, this is an outsourced organization that's going to just say, we're happy to get ads from you but just stump crack ads or whatever. Let's go to the outsourced stuff that Adrian was talking about, I guess from last night on W. So providing an outsourced service effectively. So IED could be providing an outsourced service for publishers if we pursue this. And maybe they have to consider that. As an ethical alternative to what their current status quo looks like maybe. Well, sorry. You have to read the framework document that they've produced because they actually do have a Consent Management Provider role. And that Consent Management Provider role collects the user's consent and writes cookie. So if we can be that role as a software, so it's not that they're evil. It's not that the publishers are not involved. It's just that if they take the basic cookie cutter that is the patched together solution IEDs come up with, then it doesn't serve anyone well. So maybe we can do a better UI and a better front end to help the user and help the publishers interface with AdTech. Is that a viable goal for us? Because I haven't read it closely, but the document conceives of this idea of a Consent Manager. But it doesn't say who it should be. It sort of says the publisher might be a Consent Manager sort of. But why don't we build Consent Management Software? I know some of you might be already. I know others that already are. And make it plug in. And then as other IAB-like AdTech consortia come along, you can say this is an IAB-compatible Consent Manager. And what's your framework? So the document you're mentioning, is that the FAQ that we looked at that was printed out that we had at the lab session, or is it a different one? That's the cookie format. Okay, right. So the transparency and Consent Framework cookie and vendor list format, Andrew? Because in there they talk about the different roles and who writes what and how do you register and all that stuff. But, you know, the publishers are on the hook for it. Because they're the ones usually interacting with the user interface.  It looks a bit of a chef's omelet. To your point, I think we could probably help them structure it to be a little bit more usable. Particularly from a user perspective and publisher perspective. Right, I think that's, they're missing those two ends. You're looking at the document? Okay, could you check the link to it in the chat? Yeah, absolutely. So Joyce, by the way, is going to talk us through some way to get from here to pizza. It's in the technical way. The first technical way is the IAB. It should say IABD. So on lunch, because we can order it, it'll still take an hour, so we should order it. Is everybody okay with pizza?  These are just the front of the packing. Yeah. Where am I taking this? Got to have pizza. Okay, would this be here without pizza? Okay, so I'll get like four large pizzas for that A&M. For five large pizzas. Four's a lot. Four's a lot. Four should be fine. Okay, so should I get like one meat, one cheese, or I mean, what is the nodes I'm going to have? Are there any like vegetarians or cheese there? Everybody here is a carnivore? We're going to have four side dishes. Maybe one that's kosher-ish. With live lamb and one kosher. So we can ask them to send hot peppers. Oh, good. Okay, all right, Emil. All right. I won't bring up the anchovies. I would throw you on that channel. We can get an anchovy. What anchovy? Yeah, one with anchovies. One with anchovies. All right, so then that's all. To be honest, we can share things. Are you a pro-anchovy or not? It's a whole, it's all kept. It's anchovies, capers, and olives. I feel like those are the three that might separate from that. Yeah, I did a 23-inch thing. And one of the things it said, in addition to, this finger will be larger than this finger, and it won't have a function, and I wouldn't have to be able to gather all those, is that the first time I taste cilantro, it tastes like so. And that was true. You know, and I wouldn't do it as an anchovy thing. But I love cilantro now. The first time I tasted it, when I moved to California from North Carolina, where there's nothing like so. Cilantro tastes like so for the first time. I don't understand that. I also prefer caffeine to spice to sweet, and I like caffeine. One of my hosts in the party had to ask value traders for shifted, but then I always have a line about cilantro. Because it relics it completely. But people who have that dish, that's all. Yeah, but here's the thing. It's when you first taste it, and then if you get used to it, it's an older, different thing. So if cilantro is in here at the event, like all the Mexicans would want it, right? So, but it's an interesting thing. First of all, we said that, is there, did you wash, did you wash the dishes or not? Or, you know, and no, that's just cilantro. Okay, on the wall, you guys online can't see it, but I just put down a list of allies and participants, some here, some not, and I put the ones I knew up the top of my head. Any of you who wants to add some? Mary, is this CISWG? I want to list all of the pieces of cantera. And I know UMA's cantera, and Adrian's UMA, and there's also, while set receipt, and there's concept management is a cantera thing, which angers. And it's not blind, right? Can you tell us all of the cantera pieces and why I went up with them in the shared note stock? Yeah, I put it in the shared note stock, I just put it up on the wall. Okay, Dazza, if you could maybe put a header in where I should type, but just for, just for a belief. Well, yeah, so I'm saying these are, what are these called for? What is the title of the header? What is the list? Oh, actual or potential participants, or organizational participants. Yeah, so what I'm going to type in is basically cantera work groups. Current and future. That's great, and it's down in line with E2. Okay, I'll type in, but I'll just give a quick verbal here. So there's the consent receipt specification, and that comes out of the Consent and Information Sharing Working Group, Work Group. Basically, it's a data format for expressing what a user is consented to, purposes, controllers, processors, that sort of stuff. We've also got a Work Group developing or collecting Consent Management Practices from basically any company that claims to manage consent, and we hope to turn that into a document showing common practice and then to a certification program around it. But basically with cantera, if there's work to be done to create recommendations, reports, or technical specifications in the area of personal data management or IDSE information management, then we just start them up and start to work. Okay, so we've got the shared notes docked up now. Do you want to just read down the... Yeah, I'll get that. Okay, so people watching, want me to read this down, right? Yeah, and I'll type in, these are the ACT teams that we'll break out into, versus legal views on this Elizabeth, Daza, and Robert. And it's a moving picture, as people like to say. Hack the cookie teams, Sal, Sean, and Hano, and describe GoToMarket in an engineerable way. Dodd, Joyce, and Daza. Daza's doubling up. I may want to jump between them, too. So, are we missed, should we reframe any of these teams, and who would like to... Where are you going to work? I'm not sure where this would fit in, but one idea I had, maybe it kind of spanned the view piece, is how to empower normal users, and I define normal as people who don't have privacy blockers, and the stickers on top of your camera on your laptop. How do you empower them to actually understand what informed consent is? So, can we go beyond the block of text? Let's not just try to simplify text, like can it look like something else, and then kind of try to explore that. We talked about this before you came. I think of it in terms of standardizing privacy policy, so that the way we standardize real estate agreements for the source licenses, so that people don't have to don't have to actually read the right agreement for the open source license because they trust the source. But that kind of privacy literacy is like a word streamer for itself, but it needs to happen. People need to understand why they want this. In other words, I try to avoid informed consent at all costs. If we can get through all of this without ever introducing the phrase informed consent, I will be delirious to that. Right, because that's the loophole that... Yeah, no use in consent is what the lawyer's thought. Right, right. Yeah, we want to avoid that. In other words, the hack we're looking for here is full agency starts on the individual side and then things flow from there. But in respect to another point that Andrew was making, we don't want complexity in too many choices. We want to inherit some things that are simple but already straightforward.  I think it is Jennifer, right? Stephanie, close. Close, three syllables. No, it's just Stephanie, right there. Well done, okay. So can we read on this one? Because I think it's more like that one. What are you going to read on this one? Okay. Who are we missing? And I'll learn to read this one. This one? Yeah, I saw it in the title. And your name again? Kathy. Kathy, right. Is she or Kate? Kate. Kate. Taking business. And that's this one? Okay, so Bill. Technical. Technical. Charity. Yeah, I should. Sure, sure. S-H-E-Double-R. S-H-E-Double-R-I? Why? S-H-E-Double-R-M-Y. Late to drink. Yes, okay. So is this not explaining these basic ways that engineers can build it? Or it might? Yeah. I saw that, I saw this as a technical thing, but what happened? Well, I would consider... Well, I mean when you break out, you should see what you really want to do. But the idea was from a prep conversation we had last night, where we were thinking it would be very useful as an output, not just for the other teams, but also just for the day, to be able to describe an, I would call it a business language that's agnostic to the technical implementation. You know, what functionally we're trying to do. And then part of that too, I think, would be people, like, the smallest one would be, like, the user sets this result is that kind of stuff. But then I think a good part of that would also be, okay, so let's say you have that technical capability, so a widget, a wrench or whatever, now what's the propagation strategy going to, how do people adopt it, how does it scale, and how does it work out? Kind of in the scope, I think. Because how can I pull this down further? Is it manual or is there a button on the wall? I'll just start clicking. I already did, but one brings, that brings all that up and down. This is the blackout shade. And that is, yeah, I don't know. I'm sorry. Can I just pull on it and break it? Yeah, yeah. Let's do that. Just a little. No, no, no. That is that, it's a new link, man. Maybe that's, oh, here's down. Oh, very good. Oh, good stuff. Excellent. There you go. Switch on. I think that's as far as we want to go. That's it. Oh, yeah. So we have another tool, which is just scroll the button. You can add me to the business. Okay. Business is waiting. Okay. We are on a FNB. No, just do it, right? Okay. Okay, is this quote, we're not gonna, to some of us, I mean, like these teams, you just go sit out there. Yeah, I suppose. Okay. But if we want to bring people in on it, we have to sort of decide which computers we want to bring along with us. So I would suggest going through the people on line now and see who's interested and why. Okay. I know that, yeah, I know Mark has already gone out for an Shovey Pizza. But, so I start by your person then. People on line. Yeah. So the people are snapping. People, people of the. People of the answer. People of the word. People of the effect. It occurred to me this morning that the Internet is in fact, you know, how do you say, you can say to find the universe and give three examples because there's only one. The Internet's like that. There's only, there's only one of those. There's no example. So it really is another universe. It really is a universe. So it's not just the world. It's the freaking universe. Okay. Is Andrew a wife? Yeah. Who's asked? Hey Andrew, can you, can you see the shirt doc? And do you, is there a team that you want to go with? Um, I'm just going to float in and out today. That's okay. Got a pretty full schedule. So. Yep. Definitely. And who's next? There's Sam. If Sam is still scratching his head there. Is there anyone? I'm still scratching my head. I put myself on the cookie team. I also have to float in and out just a bit, but I will, I'll coordinate with the people on team for what I can help. I'd like to go to the cookie team. Great. So there's Sam. And there's Mary. Then you're going to be on the team here. She has to go find the music. She's got a few other cats. And I'm going to see, I know that. Okay. So I think there's more. I think there's more. So my suggestion is that the business needs to probably stay in here. You have the most people. And then when we set up the cookie team, you're right, right out here. And we have a very huge process. There that we can use. So that we can get Sam in on the actions. So the whole team, why don't we get these two big teams set up and then we'll see what's going on with the list. And then we'll get Sam in the box. Okay. So that happens. I'm going to go stand up with the aspect. Room outside. And then when the seats come, we can put them right in this room. So that's going to come. Does it?  I mean, if we just came in here, we go, Hey. Hey. Hey. Hey. Hey. Hey. Hey. Hey. Hey. Hey. Hey. Hey. I'm sorry. Hey. I respectfully disagree. So we can. I'm sorry. I'm sorry. I'm sorry. I'm sorry. I'm sorry. Do you know what you see that with? Sorry. There's a visitor, over in the sinks to announce the bathrooms are fine. Downloaded for people. Hello. Background Tonight now set up. Yes. Very happy. So pleasure. Thank you. The language. Okay, if we look at the cookie itself, right, so shall we move to the, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, I think that's really important to do that. It's Andrew. Is the cookie team setting up a hangout? I think they are trying to see the dust in the oven. Yeah, if they could post back to the chat or the document, I can click over. They moved out there, so I'm just going to see who's going to hook you up on that. So we need an axe. We're going to bury it. Yeah, exactly. And so, of course, there is this gap. So I'd love that we can have some kind of people that have some good ideas. And if we can get more and more help with other ideas and come across. Are you using the Indie SDK rule? Indie SDK rule, are you a developer? No, I'm a product and I work in community. But you don't write code? No. Okay, so Andrew's Gaza and Sal are going to try and bring you in on their own hangout? No, no. I think they're still there. Sounds good. Yeah, I think so. It looks like it's doing well. Look for communication from Gaza and lifestyle. Yeah, so what do I do? We should wait for alternative solutions. We want to explore the data in the way that we want. We want to tag the document we're going to want. The default version. Right now, we're thinking about what is the staff that we're going to write the code that can be reviewed so we can not just throw away the work. No, you don't want to throw it away at all. Let me think about that.  I was, I don't know. So I thought it was a solution for change. Especially with information. Right now, there's one thing about it. If you just touch it, it goes back to zero. It disappears, you get listenability or something else. It hasn't changed. For a relationship, it's not a relationship. I think it's like a future. I like it too. Nathan said, his vision is each device should have a different, probably key. Probably key. Instead of just one person. Yeah, so it's one unique identifier. And I just don't know how you can put something in one device. It doesn't get better. There's something, like a key. Well, those are not. And you're going to make changes. I didn't know that this is a walkthrough. I just, you know, so I try to think what is what is what started. I know. It's terrifying. I don't know if the Office 365 is better. He's back. He's on vacation this morning. He's back on Monday. Instead of a call. We're in a call. We could go. We're going to know the status. No, I'm saying it's a call of views. Not the weekly call. You know what I'm saying. I know there's a guy at the end. He can't even pass on the phone. Yeah, so he's working on the wallet. You see that right now. We've got. We're building out the. Yes. Yeah. I think I think it's pretty. I'm studying. I guess. I don't know. I'm not going to be. Well, then what? Let me ask you. I might be. I might be. Yeah. So, they can sovereign Daniel's. And then. I don't. Okay. At least wait. Where were you? I don't. Yeah. Yeah.  Whatever. I'll take a look. I'll take a look. Yeah. Okay. Right. Yeah. Second, drive. And then. Just arrested this. Yeah. That. I just. And it's going to be true. Yeah. Yeah, I think the legacy has to be reduced to the narrative. Yeah, and that's why not. This point I'm going to hear is going to just be a draft of model. Not many people basically agree with this. But Larry, let's say you were discussing the draft, it was pretty good. He lost. Right. That was a great decision. And there were other things like that. But now we're not writing. The topic had a case. And it was like, no longer. High originalists. It says in the constitution, why is that what I got? And he lost some of his data. So he said, this is a change in practice. We've been changing a lot. So he events how we need to create a cover that's going to later. And here we have something. Right. Right.  Flickr. Flickr. We have, you know, some 8,000 passes. They're all crazy conversations. As a result of that. Right. So you guys shouldn't go on. They're going to do more covers. Yeah, so that's what I meant. Sorry. I was that. I look at night. I don't know. There are more. 860 to 30 stuff. I've taken. I'm. Yeah. I'll never be looking at it. But. So. But there's no thinking. Yeah. Oh, I do a search, you know, I did this single film, and it's better than the first one. And I remember, I'll leave it here. So when she was just at the end of the law school, it was kind of given that the honor of being present is within her. I decided there's too many pictures of her look like this, that she needed a good one. So at the Birkin Center, it was 10,000 percent. And when she was nominated to the Senate for 90 percent, she used this. Very few of them. And that's a big part of it. That's a big part of it. And I just don't think I was anything this. So there was one other fellow at the time, from Finland, and did his right speech. He passed on creative products. And he insisted that, because he didn't say this, and so I put it here. And you haven't started a weekly talk, so the 2010 Olympics, NBC contacted me in the morning. And they said, we really like your pictures of icicles. We want to use them on your icicles. They said, well, we don't have our attributions. We don't want it on your icicles. It was pretty cool. And you used the product. Yeah, so it wasn't an image. It was covered. I have to just check. They were going to take it. So I didn't do it. I didn't care about it. They found stuff. If you're on that list, you can obviously hear about it.  They were violating it. And he took the license. And the license said, no, it's a way the license works. You can dispute it later if you want. Is that a contract? Yeah. You work it out. You know, Doc and NBC worked it out. The individual is kind of that ability to work. Yeah, and so they're slacking it. That's working out here. Is Andrew there? They're inviting him in, I think. So for this group though, you can just work together on the same doc. Okay. You could just type right on that computer. Okay. And then have people go into the same file. Basically, I would create like a header for each of the things that you want to work on together. Okay. Like the... Alright, this is the business go to market? Yeah. Okay. Oh, this is a bad screen. That's why we're doing this. This is a screen so bad. Switch. Yeah, let's go. Put this one back. Okay. There was a really great one. If you want to go back and watch it, with two Lawson questions from Leo, who talks about music, it was quite nice. So I just suggested to Doc, that you all get into the same file. And then maybe start with making like header size ones for the two or three things that you want to do together. Okay, so business oriented. So I have this note here. If you scroll to the top, there should be... So the way I have it, there's this... There's... If you zoom like that... Oh, there you go. So pencil. Oh, wow. No, no, come on. Okay, maybe we should have this...  Let's all circle up now. And we're going to get into the same file. There you go. We know what you're going to do. We know what you're going to do. I was going for the duty-free in Zurich, and I figured I should bring something from Switzerland. Yeah, that was good. The first Swiss guy was great. I could tell you the... I could tell you the... I could tell you the... I could tell you the... I could tell you the... ...school should just clean. ...the whole thing. I'll hold it in my hand and make sure... ...that you could do nothing. And then have you as... ...you know everything, and I'm working on fee-funded. I'm working. So, I'm living and working. So, we'll just have the chocolate. Can you hear me in there? Yeah, I was born. So, I was born in French. Can you hear me in the room? Andrew, do you want to be on the technical team? Uh, yes. Same with me, man. Do you want to be on the technical team and have Sal set up a hangout, send you a link to that hangout? And they're just getting started now, okay? Okay, also Sal wants to be on there too. Okay, so I'll make sure he says it to you. I think Sam's already on it. Who's on it? Sam is on the other team. Is Sam on that one? No, I'm not there yet. I'm here waiting. Okay, so the other team has to bring in both Sam and...  I would think the best thing would be to go on to HackMD where you are, scroll to the bottom, or scroll to the teams. Your team is further down. Yeah. I'm down to the bottom.   And then I'll make... Okay, so I'm just a spark up, right? I'm not going to do that at all. Where it's legal, it's middle understanding. And I'm just going to show you real understanding. Okay, and then this wraps here. Okay, that's good. And basically, the header size is smaller. Okay. The headers are one hashtag, and the header size is a part of the team's weight. And if you want to make it smaller, you can make it smaller. So this is okay. And then there's the same bullet. Basically, you're looking at this block. So this goes live. What does this look like? How do you solve that issue, right? What's starting up? Okay, I'm going to go to the bottom. So it's going to be everywhere. Any website. And so like, essentially, unless you have some sort of like opt-out, there we go. This is like, you don't think anyone's got that line. Okay. I think I'm going to go to interesting. Yeah, how do you choose like this? Of course. Okay, so do it in... Oh, you don't log into the screen. They talk about playing. All over the place. Yeah. It's interesting, like, where you can see this. Yeah, okay. Then pull that again. Yeah, I have many more to see. So on my channel... In Zurich. Okay. So I was breaking it back. I was just trying to be right here. Random internships. And then I ended up on... Yeah, I graduated. Okay. You're doing it out here. And then you're coming back. Okay. So I just cancelled my complex of place. But it's been cool. Yeah, but I worked at a law firm. Right after this came out. And then it was all together. So it was a little bit legal background. But it's kind of like... Oh, that was me at the end. Yeah, okay. That's me. I just wanted to make sure the doc was okay. So when I was down here... What would you do like this? One, would you like... Use cases to go to a market? Go to a market? I can also have you. Okay. Okay. Can we please start? So you're in here. You're in here. I see you. I feel a lot of market. Yeah. Go to market and stuff. And what are we going to talk about? Oh, this is the link, yeah. As of today, there's a whole bunch of features. I might give you a review. Finally, it's like... This is my old one. The screen is down here. So I have a lot of help. Six years. Six years. Mine's 24. Yeah, and things are failing all over. But it's still working for our purposes. I'm going to see... What kinds of features are there? I might give you a review. Okay. Your figures do things.  It's hard to recommend it. I'm not in love with this. You're not in love, but you're okay with it. Yeah. It's like a functional marriage. Okay. All right. Okay. I'm going to do this in the first place. We're supposed to put out, like, use cases and go-to-art strategies. Okay. And he's got that in there as categories. Okay. You see it on one 10 and one... Okay. I'm going to do this in the first place. Okay. I'm going to... Oops. You have to go down. Okay. Okay. And here. And now make this another thing. Maybe we're done. And what's... What's the category? I don't know what you... What's the category? I don't know. We already have the categories. We already have the categories. Oh, I see. Yeah. Okay. Oh, I see. I see. Okay. All right. So, I go like this. And then we decide... Okay. You're taking up so, like, what are some go-to-art ideas. Okay. Around... getting... getting... Okay, let's... I mean... ... right? Okay. What is that? This... Okay. Andrew, it's Dazza. They're inviting you right now and they're just getting set up. So, you haven't missed anything. Great. I see it. Okay. Okay. So, let's see. Yeah. We're just starting to brainstorm the ideas about how to get a... ... Let's see if those people for a while can only serve this book. We'll see if we can do a deeper dive. Sounds good. Okay. Okay. We're all just typing in our own ideas this way. We can do this. I'm typing in things we talked about. Already. So, I'd like to make a... I want to just repeat this important suggestion which is I think it would make a lot of sense to make a header to talk to people about like, what do you want to do together and then make a header for each thing. So, I made a header for use cases because it's necessarily not possible to get you started and go to a market. But like, what do you want to work on together today? Yeah. Those are the right categories. Great. What do you want to do today? One thing we talked about was making like an engineerable technology neutral description of like what this functional component is supposed to do. What does that go under? Could be use case. Okay. Let me just... I'm going to take dictation here. In other words, you're saying basically a spec, like this is what we want to have somebody you build. Yeah, exactly. And then that way when things are built, you can evaluate them against what your attention was and more importantly, you can communicate your attention in a way that's engineerable from the start. And then you sort of see what hot part you get today. Oh, no, we did aspect A and B, but not C and B. Okay. So, that isn't really in the use case Let me just describe that as use case. I mean, you could or would make use cases and say when it comes to this description or operation. So, we say might belong in what... Why not just erase cases and replace that with in the same header size, like what the real name is. Real category. Buildable description. Yeah. That's good. So, you arrived at exactly the right time to meet your A. Hey, hi. Good to see you again. Yes, you too. So, I generate IW. Right, that's right. Oh my God. So, are you in that session? Are you in that session? No, the one that this is continuing actually. Oh, this is a little bit IW session. I see. I was in the one that was discussing the cookie more specifically. Yeah. I was looking at the pictures trying to figure out who was in it. Are you in the W3C? No, the other guy from W3C who also had a point of view. That's right. So, I used to work for Tim and so had participated with W3C but I'm not with him currently. Okay. W3CRI? Yes. Okay. So, we have some general socialization of the idea. Sorry. And now we're broken into two groups. We're a technical one out there and this one's more like you could say business or um I don't know what to call it. But basically writing down the idea of what is this function is supposed to do in a way that's available. So, it should be technology probably and then describe who does what and what is expected results kind of thing. And this is sort of a new exercise. It's a new like language and new approach for God and souls. So, part of what we do today is just to kind of get good at writing that in a way where it's built or more engineerable. W3CRI is good at that skill set. Thank you. Well, this is exciting. So, one thing I can invite you to W3CRI is we have a shared hack empty. Did you see the GitHub website? I don't know. Can you text me the name? So, can I email it to you? Yes. There's a whole list of partners that someone made. Yeah, it's not worth it. Sorry. Okay. Can we just do it? Yes. So, who made this? Tony made this? Right. Okay. Is that the same thing that you're... Yeah. Okay. Okay. Okay. Is there anything else you want to achieve? Yeah, I'm going to build a whole description. Okay, so I've seen this sort of as how the camel's nose gets under the tent. Okay. So, there's a side of this and actually the way Adrian put it, and I misinterpreted it first is what I... What do we say to people first technical and then the models? And what do we say to the industry? So, what are we saying to Jason Kidd and DCM, which is the publishing industry? What do we say to our potential partners? In other words, we go to three parties, I think. One is potential partners which we're just listing there. So, I go to Cory Doctorow at the EFF and say, okay, or maybe Dave Huseby goes to whoever replaced Cooper Clinton on the Privacy Manager case and say, we got this thing, you can put it in Privacy Manager and help us out. Okay. It seems to me like we better decide what it is, what we got built before we do that. Well, I think the first thing we're going to build is like this cookie, right? No, but this is what we're saying is the description of what we want to do and not call out that it's a cookie or anything else. Well, maybe we're ready with that now. Are we? Okay, let's try it. So, before I go into the meantime, just up here on the on the big board, so someone put ideas there which is good, but in terms of, you know, like headers that we could work on together and fill out, there's a buildable description which remains to be written or copy and pasted, and then I just wrote this place although there's like what would the narrative be to the technical people and the narrative would be to the models so that you have it as evidence and it's actually, that's probably not a bad order of operations. Are you also thinking about narrative to engineering teams of people who aren't building or that's more... No, that's narrative to technical people. Or do you use it in wizards? No, I mean, not the users but the people who would read the hands-on. That's a really good distinction because there is a VIM with, say, the EFF plus all these other standards, bodies, everybody can tear and so forth and the wizards who are going to be early adopters, they won't look at it and say, I want to do this, I don't want to jump on board. I tend to I tend to do this by the way you know for like a product in the FDA which is the FDA which is you start out with the indications for use which is one or two sentences that basically say I can use this for that and this is standards groups we call that a scope which tends to be a lot broader but if because then we can keep referring back to the scope or to the indications for use as we then start to deal with the different messages for example so in other words it's at a higher level than what message do we have or what documentation are we creating so so would this be an example what the indication would be like provide individuals to use method for expressing some consent to add tracking yeah I can use this for that so you specify who can use it is it by prescription only is it over the counter and then what do they use it for you know to track me in 14 years and that's all you put in there every month so right now if you look down to line 116 you don't see the line numbers there under buildable descriptions the person needs what we're able to do but the draft which I just caught and pasted from earlier notes today is that and then it kind of trails off there but I would suggest if you guys stay focused and keep coming back forget these take out any adjectives why don't you write me your fingers and hack them yeah that would be great because I mean you know what you're talking about but again I'm not here to define what but you have some ideas so I'm just saying I know but we're in the cell phone yeah I'm providing structure I don't have a voice in the no I understand but we're trying to have some words that are meaningful and your words are meaningful it's a good approach and also like literally I'm just typing just saying I'm a guy from Texas which is like I'm a guy from Dallas you're not here to do this it's a great teacher teach a man a fish guy yes we're the fishing rod fishing rod by us more or less so is that the US Digital Service that's right I'm a fisherman that's right we do crab calls for agreement just internally and we've now adopted the crab for everything so yeah so you know I'm meaning sometimes to say we just express agreement different pages actually different things simple snap and simple wage, finance, there was an organization just like we came with crab calls pretty early in the days and the stock crab has become this internally yeah that has kind of like your culture yeah that is something right that allows you to not destroy but also say I do agree yeah snap snap is more inclusive even here it's audio visual so how do you when you're doing kind of a project agreement for all the stakeholders and what you're fixing to do is this the kind of language that you think would work or is it correct and complete on line 116 to provide individuals a method for constructing and tracking that line for requirements yeah exactly it's maybe a little it may be incomplete for everything that they're looking for it's well the main thing is third party tracking we're having to see your ads but third party tracking is the no no I think that's one goal are people just not consenting to add tracking period or just the collection of their data add tracking versus are you only targeting add tracking well we're not consenting to third party cookies basically that's it because first party that's two you're there you're at that site so but the third party is they go off to other sites and the only problem with that of course is that they can be considered like this IAV Europe thing the first party can be shared with their partners or just like a bunch of other companies that are declared not to be third parties but they have some kind of relationship so now they have your information well I mean for the sake of simplicity and whatever the simple thing we're trying to do is we just say no to third party anything you know and they'll I mean oh we don't get our analytics well that's too bad you know give us analytics that work that was my question that is a tough one that is a tough one for the site owners because everybody uses Google analytics Google analytics is a giant data leak but Google can probably give you a version make available version of Google analytics that is actually you know in that sense so so from the perspective of the services then it's the idea that they're being provided a mechanism to identify like where do they get it because like they're getting something from users on a site or an app that's expressing their like from their perspective what is this underlying they're getting a form of GDPR compliance because their users are telling them to do the right thing by the GDPR basically definitely there's some power in that right now just this little momentum I mean because politically what they're doing right now is across the board thinking how can we violate the GDPR anyway we can be coming along saying hi we don't want you to violate the GDPR we're going to make it here's an easy way that actually gets you in alignment and also you know is the first step toward actually having a decent relationship with your users I met a few engineers like two weeks ago who at the top of GDPR came up and this guy was just yeah our team is just going to span all the loopholes and you can get around GDPR right and we want to kill them I mean that's basically that's all I care about right now that's all I can think of it's so I mean I'm not sure how to draw it up here up until 2007 advertising was advertising and then in 2007 that's the IAB advertising became oh you you would need to collect infinite data and you need the best ads so the ones that are directed great and correctly at people you need to spy on them and then all of advertising fell into that black hole so in the box nobody could think outside of right now including everybody in the industry everybody who used to be an advertiser used to be fired everybody who wanted to do old-fashioned creative brand manager and all that stuff they've been all the time so all they have now are like 25 year old people who've only known the tracking and can't imagine anything else who say things like how can we possibly ever make any money well the whole point of order here I disagree with trying to put into the indications for use different audiences we're building one thing here we're selling it to different audiences in different ways so we incorporated the second bullet into the first and whoever typed in the second bullet should take it away I didn't see it which is it read off how it reads right now and see how close it is please provide customers I changed individuals because that's too vague provide customers a method for expressing they do not consent to ad tracking in a way that's acceptable to service providers do you consider anyone every user is a website a customer well that's not for me to say that's customer comments problem customer this is an issue because we don't just use we don't just consume but we generally set users because that's the term of our so I would stick with users because people know what we're talking about I don't disagree with users everybody's a user when you are when we're drafting this we're focused on a particular on a particular utility to to a subclass of users I have the answer it's a GDPR answer data subjects provide data subjects yes a method for expressing they do not consent to ad tracking in a way that's acceptable to service providers we could use we could use data controllers and processors well they're controllers the processors don't send policies well it's not ad tracking they do not consent to be tracked by third parties that's it provided a subject for expressing that they do not consent to tracking by third parties that's it is tracking something we need to define because it's not something that comes out of GDPR no profiling so they do not consent to profiling by third parties that's fine so we're using in a way that's acceptable to data controllers so it's an interesting so in the GDPR there are these three entities data controllers, data processors and and data subjects a data controller can also be a natural person and and that is something that is a little bit of the cattle's nose because they were thinking of that as there could be a one person data controller that's not the data subject but in fact it could also be the data subject so it's a windmill made to ancient sea that allows a reading of the GDPR that's to the advantage of the individual so this part of the scope to do this in a way that's easy to use for data that's of operator's right for the people that actually run the systems that may not be the data controllers the processors that's easy to implement for data processors and acceptable to data controllers because I understand some thoughts will be the same right sometimes it will be different so as I understand it from Elizabeth who may or may not be on this call I wonder how back yet the the sites are controllers but not necessarily processors the third party was the processing right now so google analytics would be a processor right for whatever site that is right there right the site hires google analytics to be a processor for what they control and yeah so as a term operator I'm not even sure it shows up but it's a processor yeah a processor so is the part of the idea that this should be what you're going for something that's easy for whoever's processor to implement and use yes now the truth is we are going to fire most of the processors by the world right now but we'll also open up the world to processors that we might consent with subsequent methods that may not be cookies so that's I mean again the whole idea with the cookie years may have something in the short term to do in the longer term like J-Link which isn't in this conversation but is involved in a there's a protocol that allows an individual as a first party a data subject to have a contractual relationship with a that involves not a consent with a term the first term is this do not fight it comes from a vampire we don't want you sucking our blood and it says go ahead and show me I just make sure that I face them tracking me but it gets reported essentially a blockchain so let me ask you this because there may not be like a direct pairing with a like method for describing indications for use like if there was something that came out of the technical team that would make it easy for a data subject to signal their intent to not want to be tracked but it was very difficult to implement for data processors this isn't what I'm going for I know it's so essential that they track that you have to describe whether it's an engineer or not this is part of the messaging so there's a side to this where we're telling Nellie at the New York Times this is an expression of intent on the part of individuals that is going to have a a profound effect on everybody out there that's been busy following us to help them find better ways does it matter from your perspective if it's easy or hard for the processor to implement depends on the processor why I didn't say it why does it depend on the processor because if the processor is one of the fired outfits let's say it's OTH and OTH just wants to track and OTH can't even think of a way to not track so the answer is no then the answer is no the answer is no that it doesn't matter good so the answer is no then it really shouldn't be there so to ask us a practical question how would this be adopted if it was hard to implement for people that are providing services because the publisher the controller will adopt it in other words the publisher will tell them to do it in fact it makes it easier for them to do it we're going to make it easy for the good guys I'm just trying to test if it's complete and correct can I ask the last part where it's they do not consent to tracking in the manner acceptable to data controllers what does that mean the last part now that says provide data subjects a method for expressing we do not consent to tracking in the manner acceptable to data controllers yeah what does that mean is there a problem excuse me what does this answer there but that sentence is still completely what does that mean so without retyping it here's what I think we're talking to controllers we're not talking to processors we're talking to processors so the data subject is speaking goes to a website that's the data controller and says it gives them a cookie and the cookie says don't bring any third parties into tracking I can set to not be tracking third parties the part off of it in the manner acceptable does that mean the manners of the cookie in this instance there are many other ways that are being discussed but the acceptability or if I understand it correctly we want it to be relatively easy for the controllers to accept this that's the dimension of acceptability that's the forward acceptance so if in some crazy world the data controller has some manner that is quite good for whatever then that last sentence because it seems like we're saying we're saying we don't do tracking regardless of whatever the controller is doing you're not allowed to track it all no you're not allowed to track it to put it in their terms as profiler so if what we want to have happen is that the Washington Post Washington Post the Washington Post we go to the Washington you as a user as a data subject goes to the Washington Post the Washington Post has already heard about this hopefully and the cookie says what we wanted to say and when they hear the cookie they turn off the third parties third parties go on they still have the first party the first party we remember knows you're a customer knows you're a subscriber or just a visitor knows that you've been there 10 times but here's what I think is getting at but let me if I'm wrong tracking is a negative emotion what the OAuth and that ILP is doing is saying providing you a valuable service of sending you the ads that you want to see and so rather than using tracking I would use personalize for example because that's a positive I do not want personalize content so let me tell you what the problem with that is this is the Facebook answer that I got from the Facebook guy let's say I I want to target everybody with the Russian first name and at MIT on the fifth floor of of of this building or anybody with an MD on this floor you can do that and you're not going to personalize there's no possible personalization Facebook says we're not personalizing we're all