Permissioning, user consent, and the Imperative API

[wicg]

Permissioning, user consent, and the Imperative API

[samuelgoto]

The Imperative API, as I read it, operates by pulling SMS content from the operating system, without the user knowing that that's what's happening.

From a privacy perspective and user consent perspective, we believe there are no differences between the declarative API and the imperative API. Both of them are behind explicit consent from the user with an explicit gesture. Specifically, you can see all the many UX explorations we went through here:

https://github.com/WICG/WebOTP/blob/master/explainer.md#alternatives-considered

And which the current implementation landed somewhere around here:

https://github.com/WICG/WebOTP/blob/master/explainer.md#opt-in-ux

Although it looks more like an infobar:

https://github.com/WICG/WebOTP/blob/master/explainer.md#proposal

So, to be clear, there is user consent that is gathered before any information is handed back to the origin, which we believe to be consistent either the declarative API or the imperative API.

I'm going to close and resolve this, since I think it was just a clarification that needed to be provided, rather than disagreement or something that we could act on. If that's not the case, feel free to reopen and I'd be happy to continue this on.