[Responder] Mike O'Neill
I object to Candidate A. This definition restricts the locus of this specification to the collection of data “regarding a particular user’s activity across multiple distinct contexts”, which makes this core definition ambiguous and weakens the meaning conveyed by the Do Not Track signal. A common understanding of tracking involves the collection of a database of any web activity without a user’s knowledge (and therefore without their consent) and to many it is irrelevant what “contexts” apply when this data is collected. This definition would allow the collection, use etc. of data within any single context, not only by “location bar” visited sites but also by third-party content servers. A third-party server receiving a DNT:1 signal could continue to place or retain a unique user identifier and collect other data such as time of visit or geo-location details. Although there may be restrictions on associating this data with details about the explicitly visited first-party this could be by “administrative and operational controls” which would be impossible to verify automatically, leaving the user to simply rely on trust. Restricting the definition of tracking in this way may also reduce the likelihood that this specification could fulfil the requirements for “browser settings” in Recital 66 of the European e-privacy directive or as an automated mechanism to impart a consent or “right to object” signal referred to by the forthcoming general data protection regulation. This could lessen the chance of getting legal backing for the standard in Europe. If a user’s agreement to be tracked, irrespective of their general preference not to be, can be implied by the action of clicking on a link then it would be better to document that as a possible exemption, subject to local law, in the compliance document.