Report text is at: www.rfc-editor.org/rfc/rfc6462.txt
The report from the event was released at the end of January 2012; the event was December 8–9, 2010: the IETF’s Internet Architecture Board (IAB) co-hosted an Internet privacy workshop with the World Wide Web Consortium (W3C), the Internet Society (ISOC), and MIT’s Computer Science and Artificial Intelligence Laboratory (CSAIL).
The objective was to discuss some of the fundamental challenges in designing, deploying, and analyzing privacy-protective Internet protocols and systems, and to find ways to address such challenges in a systematic way. One of the key assumptions was that the topic of privacy is not an issue that can be looked at from an isolated perspective, but rather one that touches on many other standards development efforts. This vision of treating privacy as an overarching principle has since then be partially realized, for example by the establishment of the W3C Privacy Interest Group (itself part of the W3C Privacy Activity), or the IETF Privacy Program.
Topics of the workshop included the increasing ease of user/device/application fingerprinting (try the Panopticlick tool), difficulties in distinguishing first parties from third parties when making web requests, unforeseen information leakage, and complications arising from system dependencies. Some of the concrete technologies that were discussed were the W3C’s early P3P standard, HTTP cookies, HTTP referrer headers, private browsing modes in web browsers, Do Not Track (DNT) technologies, the Tor onion router, the Geolocation API, and the OAuth protocol. Beyond the technological level, the workshop also addressed problems with transparency and user awareness, the difficulty of achieving balance between business, legal, and individual incentives, and the role of regulation in pushing for this balance. The tension between privacy protection and usability was also a major topic. For example, using Tor protects you from network surveillance, but it decreases browsing speed. Disabling cookies can protect you from being tracked by websites, but it impacts personalization.
The workshop concluded with a set of recommendations each single one of which is highly relevant for the PDE: The need to develop a privacy terminology and privacy threat models; The responsibility for protecting privacy to be split between protocols, APIs, applications, and services; The minimization of user data; The goal to give users granular control over their privacy; And the challenge to find the right balance between privacy and usability. A press release, meeting minutes, as well as the accepted position papers and slides are available for further information.