Accessible Rich Internet Applications 1.3 2024-02-01

[daniel-montalvo]

The Privacy IG prefers groups to complete a self-review around the time of FPWD. See https://w3ctag.github.io/security-questionnaire/.

If you still want us to review your spec, please provide the information below.

In the issue title above add the document name followed by the date of this request.

• name of spec to be reviewed: Accessible Rich Internet Applications 1.3
• URL of spec: https://www.w3.org/TR/2024/WD-wai-aria-1.3-20240123/
• Does your document have an in-line Privacy Considerations section, ideally one separate from Security Considerations? If not, correct that before proceeding further. https://www.w3.org/TR/wai-aria-1.3/#privacy-considerations
• Do you need a reply by a particular date? Ideally by 1st March 2024. This is a minor spec update with Changes since WAI-ARIA 1.2
• Please point to the results of your own self-review (see https://w3ctag.github.io/security-questionnaire/ , https://w3c.github.io/fingerprinting-guidance/, https://tools.ietf.org/html/rfc6973)
• Where and how to file issues arising? https://github.com/w3c/aria/issues/new/choose/
• Pointer to any explainer for the spec? https://www.w3.org/WAI/standards-guidelines-aria

Other comments:

[plehegar]

• previous review of ARIA 1.2, which lead to Detectability of assistive technology.
• Diff between ARIA 1.2 and FPWD of ARIA 1.3

[daniel-montalvo]

Hi!

Do you plan to submit review comments?

Can we consider that resolution in Detectability of assistive technology still stands?

Best.

[npdoty]

Apologies for the delay, this request came between a gap in our meetings. I'm looking at the spec (and catching up on the discussion from 1.2 and aria/#1371) now.

[npdoty]

My only question is about the new State change notification section, which requires that events be sent. In some previous discussion, it was noted that events may be one way to programmatically determine the use of assistive technologies. And I'm not sure I understand the requirement -- is it just that DOM events be used to communicate changes? Or that user agents should send a different accessibility-related set of events?

[plehegar]

(I'm told that the ARIA WG will follow up)

[npdoty]

PING discussed. We suspect my open question is unlikely to be a privacy issue, although of course happy to hear feedback from the WG experts.

[daniel-montalvo]

Hi @npdoty

Sorry for the late reply on this issue.

We concur, this is not a privacy issue from our perspective. These updates are based on the ARIA states and properties used by the authors, and are irrespective of whether ATs are running.

Maybe @jnurthen or @spectranaut have something more to add.

[npdoty]

We believe this review is completed now. On the larger ongoing question of what features potentially reveal use of assistive technology, we also think that's worth adding to the priv/security questionnaire generally:
w3ctag/security-questionnaire#157