Comments (3)
GPC is designed to be a binary signal --- either it's on or it's not. There is no third state. If the user has activated GPC, it seems like the header should always be transmitted (unless some edge case or technical challenge I'm not thinking of). The user agent generally won't know the extent to which the recipient has seen, logged, or responded to previous GPC signals, so the header should be always sent so long as the consumer hasn't changed their preference. On the other hand, if the user hasn't activated GPC, or subsequently turns it off, the signal should never be sent (what constitutes user intent to turn on the signal is a different question raised by Issue #52).
I can imagine a mechanism where a user agent could be configured by the user to whitelist certain domains to not receive the signal (e.g., a particular website asks to be exempted from the general preference to not have data shared and the user agrees). I would be fine clarifying that in the spec, though again the signal would still be binary: either the header would be persistently sent because the user wants to send it to that domain, or the header wouldn't be sent. I don't know if we need to get into that level of granularity but I don't feel strongly either way.
FWIW, the California regulations on Opt-out Preference Signals state that if a business had previously received an opt-out signal from a known user but then stops receiving the signal, the business should still treat the user as opted out unless they receive explicit permission to undo the opt-out:
Where the consumer is known to the business, the business shall not interpret the
absence of an opt-out preference signal after the consumer previously sent an opt-out
preference signal as consent to opt-in to the sale or sharing of personal information.
ยง 7025(c)(5). Other jurisdictions may treat opt-out/re-opt-in differently, so I don't think the spec should get into detail about what sort of consent or interface is legally required.
from gpc-spec.
Standards and discussion in the January 11 Privacy CG group have indicated that not transmitting the header when the user has not set or unset the control is the preferred process. With a note that we want to make the above clear (reverting the setting does not indicate an opt in when there was previously an opt out) we should update the documentation accordingly.
from gpc-spec.
#61 now merged covers this question well.
from gpc-spec.
Related Issues (20)
- Update gpc-spec links
- Ensure consistency between HTTP and JavaScript HOT 6
- Make the architecture support other privacy laws HOT 10
- Give UAs more help in establishing user intent HOT 7
- Legal Effects section may fall out of date HOT 5
- Set up explainer document in this repo with more detail for implementers HOT 6
- Should the navigator property always have the property active or not? HOT 5
- Create consumer-facing GPC instructions HOT 1
- Mixed documentation on navigator.globalPrivacyControl returning 1 or true HOT 5
- Clarify when a Global Privacy Control preference needs to be conveyed
- Add direct identification for each jurisdiction HOT 1
- GPC spec status HOT 4
- Move laws to Explainer HOT 2
- ยง5 should end after the sentence "For additional details on legal effects, consult the explainer." HOT 2
- Respec
- I'll merge this. If any devs think we should change the glob pattern instead we can change the behavior in a secondary PR. HOT 1
- F
- Evaluation
- Notion
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. ๐๐๐
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google โค๏ธ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from gpc-spec.