Change:
One note about this edit: My local build failed with this (from a fresh clone): In line 255 of the xml, it has the xref here: Thus the issue in my local build went away when I made the above change. I'm not sure why this passed build in the repo, it looks to me like it's expected to fail? But anyway, that's why I have that part, and I'm not sure we wanted a reference in the title anyway. Probably should be in a different PR, but I'm rushing out the door and wanted the reviews, but also wanted to make it build first...
NAME - My apologies for driving you a little bit nuttier. I tend to add cross-ref targets on pretty much everything, but (of course) that one should have been
I tried that, but it also failed since IABcovid was already a named reference in the reference section, and the one place it was used seemed to be referring to that. So I thought it better to remove the tag.
Maybe, but on my reading of 7258, making the collection overt instead of covert and requiring consent is one of the mitigations, but does not change the notion of the pervasive monitoring behavior matching the technical definition of the attack as they describe it. I landed on this text after looking for something softer but then considering a few quotes like these from 7258: I'm happy to take suggestions but it seemed to me that if there are broad segments of people who do not realize that agreeing to cookie use means agreeing to expose much of their browsing history to multiple parties, then the best description based on existing terms is to call it a PM attack. Yeah, good point. Maybe this? URL Yes, that's better. Thanks. That'll be in the rev...
A couple of things here: I agree with your reading of RFC 7258 (and, looking back at URL, I actually balloted on it - 2014 was a long time ago, so I'd forgotten). I think it's consistent with RFC 7258 to say "This provides a strong incentive for advertisers to gain access to the data necessary to perform behavioral targeting, leading some to engage in what is indistinguishable from a pervasive monitoring attack ({{RFC7258}}) based on user tracking in order to collect the relevant data," I understand you to say that since everyone accepts cookies, whether they should do so or not, so that doesn't count as informed consent, and the use of cookies to indicate consent doesn't change the characterization of what advertisers are doing - it's still indistinguishable from an attack, Is that right? If I'm tracking you correctly, perhaps that's a point worth making (not in those words, perhaps). But let's wait and see what NAME says - he is, after all, the Discuss holder . That's EXACTLY what I was hoping for!
NAME - thanks for pushing back and making me think about my suggestion on RFC 7258. I reviewed your changes and they look fine.
NAME - have you had a chance to look at this PR?
From NAME
We think the points to make are: media operators, your media is part of an arms race aiming to track users for more effective advertisers There are some efforts, such as , to get the ecosystem to reduce its reliance on individual tracking while still achieving targeted ads, which are worth a lot of money (pick out a reference or 2 from e.g. [1] https://www2012.universite-URL ) As an initial idea, we're thinking perhaps to add a paragraph after the first mention of targeting, and we're wondering if this is in the right direction, and whether you can suggest any specific improvements?: URL Traditionally, targeted ads have relied on user tracking, which involves a relatively large privacy exposure for end users. At the time of this writing some proposals such as have been made in an effort to reduce that exposure without losing the effects of targeting (ref from [1] that measures a high impact). We found a few references touching on the risks, like: URL URL But maybe someone knows a better reference?
Just wondering when we could expect some PR to address Roman's DISCUSS.
Hi, NAME Jake had asked NAME for guidance , the Wednesday before this document was on the telechat. I haven't seen a response yet. The authors are meeting later today to coordinate our continued comment resolution, so we may be smarter after that.
While this is true, as of last week I stopped waiting and am working on a PR to address this, basically trying to tighten up the rough proposed direction I outlined in the request for guidance in hopes that direction is close to right. That timing came with a number of other outside distractions, which is the reason I'm not done yet. Most of the time on this topic so far has gone toward looking for good references, and a bit toward angst on whether and how to add something about pervasive monitoring to the original sketch of the proposed text. So maybe within the next day or so, if I can land on something I'm happy with.
URL is my first attempt to address this, please let me know what you think NAME and NAME
NAME - this PR looks plausible to me, but we'll see what NAME says - he is, after all, the Discuss holder :stuckouttonguewinkingeye:. I do have a couple of nits. In this text, Is "what amounts to" the right phrase? It seems quite direct. Perhaps "can be considered"? it might be worth mentioning explicitly that collecting this information without user consent is the problem. So, insert "without user consent" at the appropriate place? In this text (which existed before the PR), is there a decent reference that could be added? In this text, I'd suggest Hi Roman, We discussed this in an author's chat, and we're trying to pin down some good text that would cover your DISCUSS. (We're separately considering your other excellent comments as well, but wanted to focus on this first.) We think the points to make are: media operators, your media is part of an arms race aiming to track users for more effective advertisers There are some efforts, such as Topics, to get the ecosystem to reduce its reliance on individual tracking while still achieving targeted ads, which are worth a lot of money (pick out a reference or 2 from e.g. [1] https://www2012.universite-URL ) As an initial idea, we're thinking perhaps to add a paragraph after the first mention of targeting, and we're wondering if this is in the right direction, and whether you can suggest any specific improvements?: URL : Traditionally, targeted ads have relied on user tracking, which involves a relatively large privacy exposure for end users. At the time of this writing some proposals such as Topics have been made in an effort to reduce that exposure without losing the effects of targeting (ref from [1] that measures a high impact). We found a few references touching on the risks, like: URL URL But maybe you know a better reference? Thanks and regards, Jake (and Spencer and Ali)

Discussion:
different base volume level than the main video, which can make for a jarring user experience. <del> Additionally, this market historically has had incidents of ad fraud (misreporting of ad delivery to end users for financial gain).  As a mitigation for concerns driven by those incidents, some SSPs have required the use of players with features like reporting of ad delivery, or providing information that can be used for user tracking.  Some of these and other measures have raised privacy concerns for end users. </del> <ins> Another major source of competing objectives comes from user privacy considerations vs. the advertiser's incentives to target ads to user segments based on behavioral data.  Multiple studies, for example BEHAVE and BEHAVE2, have reported large improvements in ad effectiveness when using behaviorally targeted ads, relative to untargeted ads.  This provides a strong incentive for advertisers to gain access to the data necessary to perform behavioral targeting, leading some to engage in what is indistinguishable from a pervasive monitoring attack (RFC7258) based on user tracking in order to collect the relevant data, A more complete review of issues in this space is available in BALANCING. On top of these competing objectives, this market historically has had incidents of ad fraud (misreporting of ad delivery to end users for financial gain) ADFRAUD.  As a mitigation for concerns driven by those incidents, some SSPs have required the use of specific media players that include features like reporting of ad delivery, or providing additional user information that can be used for tracking. </ins> In general, this is a rapidly developing space with many considerations, and media streaming operators engaged in advertising