"data" is poorly defined

[privacycg]

"data" is poorly defined

[asoltani]

The legal effects of the signal is dependent on the regulatory regimes in a user's jurisdiction. Please see: https://globalprivacycontrol.github.io/gpc-spec/#legal-effects

[robrwo]

I'm not talking about the legal effects. I'm taking about this being vague in terms of what the user expects the site to do.

Does a website saying "we honor GPC" mean that "we do not share data with anyone else at all" or "we share data in limited circumstances that are outlined in our privacy policy and are allowed according to our lawyer's interpretation of the regulatory regime".

If someone connects to that website with Sec-GPC set to "1", how are the the website's operators support to handle this w.r.t. to sharing data in limited circumstances?

• Should the site show a popup suggesting the user review the privacy policy?
• Should the site not use 3rd-party analytics tools?
• Should the site not use 3rd party CDNs for scripts/styles/fonts/etc?
• Should the site refuse to let the user perform actions like making purchases that might lead to third-parties being notified?

[asoltani]

Again, those will depend on the legal requirements in the jurisdiction that GPC is honored/invoked.

In California, where GPC is required under the CCPA, the definition of who is a third party and the manner/frequency with which a business can show a popup is outlined in the AG's rule making which you can find here: https://www.oag.ca.gov/sites/all/files/agweb/pdfs/privacy/oal-sub-final-text-of-regs.pdf?

In other jurisdictions where GPC may be adopted, those definitions and regulations may vary. Please refer to the privacy framework in the jurisdiction in which you're concerned about.