815635 - [Firefox Flicks] Vendor Review of Vimeo

Status: RESOLVED FIXED

(Privacy Graveyard :: Vendor Review, task)

Description

[Gregory Jost]

We are now looking at working with Vimeo as video platform for Firefox Flicks.

The plan is to have participants upload their videos to Vimeo directly from our website (firefoxflicks.mozilla.org) using an API. We may also have a branded presence on Vimeo promoting the contest and letting participants upload their content directly on Vimeo - this point is still to be determined but I' mentioning it as a possibility.

Vimeo Privacy policy:
http://vimeo.com/privacy

VImeo T&Cs
http://vimeo.com/terms


Timing: zwe need to make a final decision by end of the week, so it would be great if you could help us get more visibility rapidly.

Let me know if you have any question or need more details. Happy to jump on a call to discuss.

Thanks!

Comment 1

[Gregory Jost]

One more thing I'd like to put on your radar: if we work with Vimeo, we might have to require user they use their existing Vimeo account / or create one, to upload videos. Vimeo T&C's require users hqve the rights to the content they upload.

This also means they wouldn't have to create an account with us.

Comment 2

[Tom Lowenthal]

This looks more like a vendor review than a privacy review to me, passing to Stacy.

For what it's worth, I don't see any fundamental problem here. Users who have Vimeo accounts know the deal there, and users who create new accounts will find out during that process. The parties we really need to think about are folks who might accidentally stumble across the contest results on our pages, not knowing that there's going to be a request to Vimeo.

The context of Firefox Flicks (and the fact that there's a dedicated subdomain with that name) seems to me to establish the context of video. It very rare for sites to implement video malarkey themselves; most embed content from popular video providers like YouTube or Vimeo. A typical user would expect video content to be embedded all over the place: that's what they're there for!

So, sounds good to me. Stacy will probably be looking at things from a different angle, however.

Comment 3

[Gregory Jost]

Thanks Tom.
Changing the bug summary to Vendor Review.

Stacy: let me know if you have any question. Happy to jump on a call to discuss further.

Comment 4

[Stacy Martin [:stacy]]

Thanks Tom and Gregory.  Does this have a legal review bug too? Or would I turn it over to legal after reviewing for privacy?  +Jishnu because he and I have worked together on video vendors in the past.  One potential concern is whether viewers would be tracked and profiled and that data reused for commercial purposes.  I will take a look at their privacy policy and ToS to see if that's a concern here.

Last year, we used Vidly, didn't we?  Is there a reason that we're switching?

Comment 5

[Stacy Martin [:stacy]]

Hi Gregory - Can you also describe what the user experience would look like?

Comment 6

[Gregory Jost]

Attachment: Vimeo_User_Flow_1

Comment 7

[Gregory Jost]

Hey Stacy,
I'm not privvy to the pros and cons of using vidly last year but I believe the main reasons were a suboptimal user experience (espec. the upload step for participants) and very limited sharing capabilities (not ideal for promotion). Another aspect is that vidly doesn't have an organic community we tap into by using their product, unlike Vimeo.

In terms of the UX, I just uploaded a chart that Ben put together that will explain you the experience we're targeting (we're currently talking to Vimeo to confirm that everything is feasible).

On a high level:

> SUBMITTING A VIDEO
- participant clicks the upload button on the Flicks site
- a Vimeo uploader opens on Flicks (served through Vimeo's API) and participant selects the file they want to submit from their hard drive, and confirm
- the video gets uploaded onto Vimeo
- Vimeo processes/encodes the video
- Vimeo sends the video back wrapped in their player (we might add some moderation there before the video gets displayed on the submission page)

One of the key questions, as detailed in Ben's chart is the question of identification. Users need a Vimeo account to upload to Vimeo, which means they might need to create one and/or log in.

If we use Vimeo, we believe we won't need participants to create a Flicks account. We may request their email during the upload process so we can get in touch with them (e.g. if they're selected for the finals)



> VOTING
We may use the Vimeo Like or view count feature in order to award a Public Vote Prize. The Like feature requires visitors to log-in to Vimeo (and therefore possibly to create an account) if they wish to vote. The view count doesn't have the same constraint.


Hope this helps

Comment 8

[Stacy Martin [:stacy]]

Thank you Gregory and Ben -that was really helpful.  I read their privacy policy and it looks fine to me.

So it sounds like the Vimeo video would be imbedded in our site and would play once someone clicks the "Upload video" button, right?  Can we check on how the tracking works?  Would someone only be tracked by Vimeo when they click on a video?  Is there any option to remove the tracking or opt-out of it?  Will it be obvious to the person clicking that the video is provided by Vimeo?    

Ideally, I'd like to add some text along the lines of:

"This video is displayed on Vimeo. You can adjust your Vimeo privacy settings <here>."

As a side note, I've been working with Tobi on the text for the email request.

Comment 9

[Ben (:bensternthal)]

Some clarifications....

Vimeo video is uploaded when a user clicks the upload video button.

Once processed (could be an hour later or so). The video is then embedded on the flicks site. Video only plays after user clicks play on the embedded vimeo player.

I suspect that just loading the embedded player without clicking play triggers some tracking on vimeo's side. At a minimum its an http request to there servers for the player. 

We should get clarification on what data vimeo collects from users who just view/play the video and do not have an account (our concern).

It will be obvious that the embedded player is from vimeo. It has vimeo branding.

Comment 10

[Stacy Martin [:stacy]]

Thank you, Ben.  That's helpful.  If we can resolve the tracking questions, I'm pretty comfortable from a privacy perspective.  Will the contract be going through a legal review?

Comment 11

[Ben (:bensternthal)]

Stacy -> Gregory can speak to the contract once a decision is made.

Timing wise we should know early next week if we are moving forward with them.

Comment 12

[Gregory Jost]

We should hear back from them tonight, I'll ask them about tracking then.

Comment 13

[Gregory Jost]

As per Ben's comment 9. We asked Vimeo what data they collect from users who just view/play the video and do not have an account.

Here's their response: "We currently collect no data on our users, so all good there!"

I like the sound of that!

Stacy, is there anything in particular you need from them to back this?

Comment 14

[Stacy Martin [:stacy]]

OK, that's good news. We'll need to include our Data Addendum in the contract.  I'll re-assign this to Liz to attach the most recent version.  I'm comfortable with the privacy review, provided we have data protection language in the contract.

Comment 15

[Liz Compton [:liz]]

Greg - If you've decided to use Vimeo, please open a legal bug for this. Since you've been talking to Vimeo about using it for Firefox Flicks, I guess there isn't any question that using their service in the way planned complies with their terms and conditions. Please include a link to the TOS in the legal bug and include a link to this bug as well.

Stacy - Once the legal bug has been opened, you can close this one.

Comment 16

[Kristin Baird]

Legal bug has been submitted: 819594

Comment 17

[Stacy Martin [:stacy]]

Closing per opening of legal bug.

Comment 18

[Gregory Jost]

As per Liz's comment on bug 819594, I'm flagging this as potentially needing sec review. Curtis, we are working with Vimeo as video hosting platform for Firefox Flicks 2013. Can you take a look at the proposed workflow described above involving Vimeo and let us know if this requires one?

Sorry to pull you in last minute, but this is pretty urgent. The dev team needs to get started and can't access Vimeo's API unless the contract is signed, and since this is connected, this is a major blocker for us. Thanks for your help!

Comment 19

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

As far as I can tell were not:
* hosting anything internally from this stie
* were not bringing any code in from this site
* there is no connection to Mozilla resources other than linking to it from our Firefox Flicks site
*They are not "hosting" anything for us, just the videos as they do today

As such this would not fit our normal vendor review as I don't see any exchange of goods other than promotional either way. We use YouTube to for some videos on HTML5 in other places and it would have much the same issues. But for users that is an issue for YouTube or Vimeo in my mind. I think it would be more acceptable to allow participants to host their videos on whatever they are comfortable with in terms of rights to the content. That would take away the voting thing you all are talking about but couldn't we host a page for that (would give us some control over how much/often people vote?). 

I don't see the need for our formal vendor review, but I am going to pass this along to others in my team just to make sure I'm not missing something.

Comment 20

[Stacy Martin [:stacy]]

Content copied from legal bug:

Comment 16 Gregory Jost 2013-01-04 10:29:53 PST 
Just to clarify the nature of our collaboration with Vimeo and as per Liz's suggestion: beyond the use of their API for hosting Flick's videos, we are also going promote the campaign through ads on Vimeo.com. This is part of our agreement. I am not sure if you guys were aware of that or if that may impact our thinking here.

Stacy, Vimeo follows the standard IAB/AAAA terms. Is this ok with us? Does this raise new questions with regards to the privacy review?

Curtis: not sure if that impacts your current exploration.

[reply] [-] Comment 17 Stacy Martin [:stacy] 2013-01-04 10:39:52 PST

Hi Greg - It does raise some new questions, so we should probably schedule a quick call with them, either by phone or Vidyo.  We have an online advertising guidelines wiki at https://wiki.mozilla.org/Privacy/HowTo/OnlineAdvertising.  We've been working closely with Kristin Baird on developing online advertising practices that are consistent with Mozilla's values and we created a guide that I will attach to this bug.  One of the biggest challenges is making sure that the viewer is aware of tracking and can opt-out of it - for example by implementing Mozilla's Do Not Track.  There is a case study in the Do Not Track Field Guide for online advertising.

Comment 21

[Stacy Martin [:stacy]]

Attachment: Mozilla Global Advertising Standards

Adding Mozilla's Global Advertising Standards

Comment 22

[Liz Compton [:liz]]

Stacy - Greg told me that Vimeo's advertising practices are acceptable and that they've agreed to all the advertising standards. Could you please confirm that?

Thanks,
Liz

Comment 23

[Stacy Martin [:stacy]]

Hi Liz - That's what they indicated in the call.  I talked to Jishnu about it and he suggested that we include the items from the advertising checklist in the contract and ask them to sign that they and their vendors (the 3rd party ad server) will comply.

Comment 24

[Liz Compton [:liz]]

Thanks Stacy. That's what I already did, except I didn't add "and their vendors." I'll add that.

Comment 25

[Liz Compton [:liz]]

Tom and Stacy - Please see the following email from Vimeo, and advise:

From: "Courtney Nasshorn" <[e-mail]>
To: "Gregory Jost" <[e-mail]>
Cc: "Elizabeth Compton" <[e-mail]>, "Abby Morgan" <[e-mail]>, "Kristin Baird" <[e-mail]>
Sent: Tuesday, January 15, 2013 10:56:10 AM
Subject: Re: agreement review

Hi Greg - 

Hope you a great weekend too!

Thanks for your patience while we confirmed everything from legal. The
hold up was investigating the DoubleClick comment and it looks like we
can't disable DoubleClick cookies.  What do you normally do in this
circumstance as I imagine you have run into this problem in past?

Best,
Courtney

Comment 26

[Stacy Martin [:stacy]]

Hi Liz - I had a feeling that would be the case.  We'll probably want to find out whether DoubleClick has implemented an opt-out and whether they'd be willing to implement Do Not Track, but let me see if Tom and I can meet today on this.

Comment 27

[Gregory Jost]

Hi Stacy. We need to move this forward urgently. Can you let us know what our options are asap?

Fwiw, I am not an expert, but I would be very surprised if DoubleClick was willing to implement DNT at all, and even more so in the time frame we are looking at (we need a resolution today or tomorrow).

Thanks

Comment 28

[Tom Lowenthal]

I think that we've cleared up any confusion via email and the call this morning. Let me know if you need more from me!

Comment 29

[Tom Lowenthal]

Stacy, could you document the details that we discussed, then close out this bug?

Comment 30

[Stacy Martin [:stacy]]

Summary:

Tom and Stacy initially reviewed Vimeo as a potential video platform for Firefox Flicks and found their privacy practices to be very good.  When we later learned that the Vimeo agreement would also include placing ads for Flicks on the Vimeo site, using a third party to serve the ads, we provided Vimeo with a copy of our Advertising Standards.  Vimeo identified DoubleClick as their 3rd party ad serving vendor.

In comparing the cookie practices of DoubleClick to Mozilla's advertising standards, we advised that:

DoubleClick cookies are unique, user-specific, 3rd party cookies that profile users.  Their cookies are not distinctive to our campaign, but are already linked to previous browsing.

Mozilla's advertising standards call for 1st party cookies, collecting only aggregate, non-user specific data.  They are campaign specific, do not profile users across sites, and expire within 3 days after the end of the campaign.

Additional Considerations:

*Ads on Vimeo are not unexpected.  Users understand that their service is supported by ad revenue and agree to Vimeo's terms and conditions.  This ads a level of transparency that doesn't exist on an ad exchange.
*Ads will be shown on Firefox Flicks videos, as part of Vimeo's operating model, regardless of whether Mozilla places ads.
*There is no alternative to DoubleClick for placing ads on Vimeo. 
*If Mozilla does not place ads, users will see ads anyway.
*Vimeo's user population is particularly well suited for ads about Flicks and likely to be interested in the content, based on their interest in viewing videos.
*The ads are part of a one-off, short duration (2-4 weeks) campaign.
*Work is ongoing to minimize impact through ideas such as shortening the cookie window to 30 min, requesting that cookies are only dropped when someone clicks, and requesting that the data be destroyed afterwards.
*Vimeo has expressed interest in working with Mozilla in the future to better address our advertising standards.

Conclusion:

Tom and Stacy have worked with Kristin and Greg to make sure they're able to make a fully informed business decision, from a privacy perspective, based on the information summarized above.

Comment 31

[Stacy Martin [:stacy]]

Closing this one.