w3ctag / security-questionnaire

A security/privacy review questionnaire for W3C specs
https://w3ctag.github.io/security-questionnaire/
Creative Commons Zero v1.0 Universal
24 stars 34 forks source link

W3C antitrust policy prohibits this document in its current form #111

Closed jwrosewell closed 3 years ago

jwrosewell commented 3 years ago

This document advances a position to restrict the supply chain choices for website operators and as such has a direct and negative impact on competition. The W3C antitrust policy explicitly prohibits this.

The authors of this document are advancing a position whereby choice is reduced for small website operators and their supply chains are impaired. This is deeply troubling where in practice dominant platforms are increasingly under investigation for anti-competitive practices.

Security and privacy are very important. However, so too is the continued viability of small website operators without which the web would be worse off.

It is this imbalance in the document this related issue was raised to address. This issue was closed inappropriately. I support a security and privacy questionnaire, but only one that asks developers to also understand how their improvements will impact web authors, especially those who are not directly represented in this forum.

TAG has asked for evidence that smaller website operates must rely and trust supply chains more than larger rivals, who have staff and internally developed software making them less reliant on the open market. To address this ask, I’ve included a few quotes from this past year from both the US Congress and my own country’s regulator.

To cite evidence from the US House Antitrust Committee (and its quote from UK CMA):

As the United Kingdom’s Competition and Markets Authority observed, “the inability of smaller platforms and publishers to access user data creates a significant barrier to entry.” - p149

The UK CMA report explicitly notes that small publishers must rely on supply chains to fund their operations:

"a small publisher wishing to sell advertising inventory without having its own infrastructure for carrying out the physical delivery and financial sales functions will rely on intermediaries to perform these roles." - p 220 5.30

The UK CMA report also recognized that without access to supply chains, smaller organizations are at a disadvantage to larger rivals:

"Economies of scale create a cost advantage for larger rivals over smaller potential entrants, giving rise to barriers to entry." - p 253 5.159

Note the UK CMA is cognizant of privacy risks, but their aim is

"to encourage a modern view of data protection regulation, which empowers consumers and avoids favouring large integrated platforms over smaller publishers. In relation to consumer empowerment, we want to explore how consumers can be presented with choices that are unbiased, meaningful to them and easy to act upon, avoiding friction and confusion and facilitating genuine control. In relation to competition, we want to address the concern that some platforms are increasingly acting in a quasi-regulatory capacity, judging the appropriate application of data protection regulations not just for themselves but for others, with an incentive to interpret these regulations in a way that favours their own businesses." - p 433-434 10.18

The W3C has an obligation to avoid collusion that would raise barriers to entry or significantly impact competition. I’m happy to work with the TAG to amend the document so that it complies with the existing W3C antitrust policy, but more importantly so that we do not advance a document that reduces the ability for website operators to continue to operate their businesses.

wseltzer commented 3 years ago

You are welcome to raise the business challenges faced by any participant in the Web ecosystem, and to propose improvements that you believe would help them to meet those challenges. Others are likewise welcome to argue from their interests and principles.

W3C's antitrust and competition guidance does not take a side in these debates.

lknik commented 3 years ago

To be honest, as a former author of this document, I'm puzzled with facing an accusation/suggestion of "advancing a position whereby choice is reduced for small website operators and their supply chains are impaired". To say the least, this was not my intention. I am quite puzzled with being classified in such a way.

plinss commented 3 years ago

Closing as off topic. The TAG deals with technical and architectural issues.

If you feel there are legal or process concerns with the output of the TAG, take them up with the AB and/or W3C legal.