30 October 2012 - 9:36User Privacy Contracts and the Open Web
I’ve been blogging on the Labs blog about locally analyzing Firefox data [blog.mozilla.org] and helping users share that data while keeping users in control of their privacy. One area of ideas has involved users setting terms on how the shared data can be used, such as requiring temporary use of the data and increased transparency to let the user know what parts of the data was used.
So far what I’ve described seems compatible with the Open Web because Firefox can expose access to the user’s data through a web API such as geolocation where the user confirms or denies the request. One main difference is that the site agrees to the user’s data privacy contract — perhaps through an electronic signature. But even then, this difference isn’t too foreign because this digital agreement pattern seems common on the web — except most of the time, it’s the user agreeing to the site’s terms.
One followup idea, regarding who is creating contracts, suggested a non-profit who cares about the Open Web and users’ privacy could be well suited to negotiate with web sites. Instead of having each user provide a user data privacy contract to each web site, Firefox could refer to a list of allowed domains that have already agreed to the non-profits requirements on how user data from the browser can be used. Of course Firefox would still give users control of what data is analyzed and to what detail is the data shared.
With these site-by-site contracts of agreeing to treat users’ data at a privacy level acceptable/required by the non-profit, it seems like a potential slow-but-steady way to improve the web for all parties: the site gets high quality user data, the user gets better personalized content, and Firefox protects privacy for users.
The tricky part here is that there would be a split between which web site have access to the web API: those who are contractually bound to treat users’ data correctly and those who are not. If Firefox only allowed access to web sites that have signed the contract, would this still be part of the Open Web? Is it necessary to have this as part of the Open Web? How about if general web access could be enabled through a user preference while also requiring user confirmation on a per-site basis from a scary looking dialog?
I’m sure there are plenty of other questions in this area of protecting users’ data while improving the Open Web experience. So please comment and provide your thoughts or questions!