Andrew, I think it is reasonable to assume that the "Do not track" header isn't referring to this. Do not track is explicitly for third party tracking. We are merely proposing to count those people who do access our sites. Note that, in this case, we are not interested in obtaining identifiers at all, so the word "track" seems to not apply. It seems like we're looking for something like a "Do Not Log Anything At All" header. I don't believe that such a thing exists -- but if it did I think it would be good if we supported it. -Aaron On Tue, Jan 13, 2015 at 2:03 PM, Andrew Gray <andrew.gray(a)dunelm.org.uk> wrote:

On Wed, Jan 14, 2015 at 9:22 AM, Andrew Gray <andrew.gray(a)dunelm.org.uk> wrote: I think you're right to be concerned about this. It is about expectations; people do not expect a NGO providing an encyclopedia to be silently capturing reading behaviour data. If the data is provided to other entities, even for noble research objectives, people expect "Do Not Track" to cover this. https://cyberlaw.stanford.edu/node/6573 -- John Vandenberg

On Wed, Jan 14, 2015 at 2:25 PM, Oliver Keyes &lt;ironholds(a)gmail.com&gt; wrote: The proposed element to be added is geolocation below country level. Default Nginx and Apache log formats do not include geolocation. Which is why this research proposal exists and is being discussed, and rightly so. fwiw, the Nginx geoip module is not even included, by default, when compiling the source code. As the paper explicitly describes, and is a common theme in research proposals, Wikimedia access log information is user reading behaviour being captured. The old privacy and data retention policies gave users the expectation that access log data was destroyed after a set period, assumed to be only three months as that was the limit of Checkuser visibility. The current policies are more like "yes we collect a lot of data about users, using tracking technology, and please trust us." And "sorry we dont honour 'Dont track us', as we presumed that you trust us and the researchers that we allow to access our analytics." We should be planning for what will be the effect when the WMF servers are hacked and _all_ of the analytics data is now in the hands of a repressive government or similar. Or, imagine the WMF sends the analytics data across an insecure link which is tapped and the data reconstructed, either due to not using secure links at all, or an accidental routing problem. https://lists.wikimedia.org/pipermail/wikimedia-l/2013-December/129357.html If/When that day comes, hopefully they don't have much data to make inferences from, and what data they obtain can be well justified. Having a quick peak, I thought it was odd that browser Wikimedia sites now causes impressions to be sent back to the WMF servers with the country of the user included. "This is a workaround to simplify analytics." https://git.wikimedia.org/blob/mediawiki%2Fextensions%2FCentralNotice/8ee87… The more you collect, especially using multiple systems to collect similar data, the more likely that if subpoenaed, WMF's various datasets could be used to infer a pretty reliable answer to "which days in 2013 was John Vandenberg in Indonesia?", or "when did John Vandenberg first read the Wikipedia article about <bomb making ingredient>?" The more you publish, even aggregated, the more likely these types of questions can be inferred without a subpoena, at least for users with large enough lists of public contributions, by scientists like yourself with lots of computation power and plenty of time on their hands rifling through the data to *infer* the identify of editors, and if it is a government body they also have lots of other datasets which can be used to assist in the task. Adding fine-grained geolocation information to published page views is an example of the latter and the paper wisely suggests not including logged in users as a possible solution to some of the privacy issues. There is also the problem that many IPs can be easily inferred to be a single cohort of people in some situations. e.g. in regions where the only large collection of computers is an single facility, e.g. a school. In a repressive regime especially, that could lead to official questions being asked like: why were so many students at this school reading about <blah> on <date>. And teachers being identified as responsible, etc. The paper considers IP users vs logged in users to be a binary set. However there are tools built which exploit the fact that logged in users make a logged out edit which identifies their IP. Add geolocation of pageviews and we can infer the probability that other IPs in their smallest geolocation block are also likely to be edits by the same person, as the algorithm in the paper leaks 'number of active editors in each region each day'. The purpose of this proposed change in analytics is summarised in the paper: 'In short, the current global aggregation of Wikipedia page view is unsuitable for an operational disease monitoring system. There will be no “Wikipedia Flu Trends” unless page view data are aggregated at a finer geographic scale.' If "Wikipedia Flu Trends" is the justification, we had better be certain that detecting Flu Trends using Wikipedia is going to be the most effective method, and isn't just an academically interesting exercise. A limited trial to determine utility would be helpful to establish if "Wikipedia Flu Trends" is a viable world health solution worthy of justifying additional data retention and publishing of aggregates. Is there a minimum threshold at which views of a page mean it becomes 'interesting' to analyse using finer grained geographic data. I suspect that pages with only hundreds of page views per day are not particularly useful for "Wikipedia Flu Trends". Also does "Wikipedia Flu Trends" need to have access to geographically tagged page view data of, say, me reading http://en.wiktionary.org/wiki/bota today? Is there a way to restrict which types of pages are tracked at finer geographic granularity without adversely affecting the "Wikipedia Flu Trends" graph. -- John Vandenberg