First-Party Sets Policy Proposal

W3C Privacy Community Group

August 12, 2021

Anti-tracking policies for the web

• DNT specification (W3C)
• “A party is a natural person, a legal entity, or a set of legal entities that share common owner(s), common controller(s), and a group identity that is easily discoverable by a user.”
• Chrome Privacy Model
• The central privacy threat is joining these per-site identities across distinct first parties. Browsers impose limits (on cookies, fingerprinting, and other state) with the goal of preventing the joinability of these per-1p identities.
• Mozilla Anti-Tracking Policy
• "A first party is a resource or a set of resources on the web operated by the same organization, which is both easily discoverable by the user and with which the user intends to interact."
• WebKit Tracking Prevention Policy
• "A first party is a website that a user is intentionally and knowingly visiting, as displayed by the URL field of the browser, and the set of resources on the web operated by the same organization."
• Edge Tracking Protection Preview
• "Not all organizations do business on the internet using just one domain name. In order to help keep sites working smoothly, we group domains owned and operated by the same organization together."

How browsers currently define “third-party”

Why “site” or “registrable domain” isn’t sufficient

Website functionality is often deployed across multiple domains, including:

• Single sign-on
• bbc.com and bbc.co.uk; sony.com and playstation.com
• Embedded content such as documents, and videos
• sharepoint.com and live.com
• Improved security via isolation/separation of content
• Untrusted uploaded content on googleusercontent.com
• gov.uk subdomains treated as separate sites due to addition of gov.uk to the Public Suffix List
• Analytics/measurement of user journeys to improve quality of services

⇨ User journeys/workflows exist across domains that users perceive as the same website or “first-party”

Why First-Party Sets?

• Draw a “box” or “boundary” around the collection of domains declared in a first-party set; and restrict information flow across that boundary to prevent cross-website tracking.

​

​

Blue and Green sites are in the same First-Party Set

​

Blue site is third-party to Purple site

How could browsers use First-Party Sets?

• SameParty cookies
• Partitioned/double-keyed third-party cookies
• Bounce/Redirect Tracking Interventions
• WebID Directed Identifiers are keyed by First-Party Set
• Privacy Budget applied across an entire First-Party Set
• Others?

​

​

Why are we talking about a policy?

• Compliance with privacy model for the web
• Consistency across browsers
• Prevent abuse

FPS Policy Proposal

We propose a three-pronged policy:

• Domains must have a common owner, and common controller
• Domains must share a common group identity that is easily discoverable by users
• Domains must share a common privacy policy that is surfaced to the user via UI treatment (e.g. on the website footer).

​

Why we need a policy enforcement component for FPS

An independent enforcement entity (aka verification entity) would serve multiple functions:

1. Maintains publicly-viewable declaration system for First Party Sets
2. Verifies that the requester of the set formation has control over the domains
3. Performs random "spot checks" for conformance based on publicly available information
4. Performs technical check to ensure Privacy Policy is the same across all sites in the same set
5. Performs technical check to ensure all First Party Sets are mutually exclusive
6. Conducts manual reviews/investigations of First Party Sets that have been flagged by civil society/research community