Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Global opt-out discussion is long and not clear about what decision is reaffirmed on each interaction #449

Open
jyasskin opened this issue Oct 30, 2024 · 0 comments

Comments

@jyasskin
Copy link
Collaborator

https://w3ctag.github.io/privacy-principles/#dfn-global-opt-out says

Conceptually, a global opt-out mechanism is an automaton operating as part of the user agent. It is equivalent to a robot that would carry out a person's instructions by pressing an opt-out button (or a similar expression of the person's rights) with every interaction that the person has with a site. (For instance, the person may be objecting to processing based on legitimate interest, withdrawing consent to specific purposes, or requesting that their data not be sold or shared.) The user is effectively delegating the expression of their opt-out to their user agent, which helps rectify automation asymmetry. The Global Privacy Control [GPC] is a good example of a global opt-out mechanism.

Under this model, a global opt-out signal should not be understood as a decision that a person made a while ago when they flipped a setting or chose to use a specific user agent but rather as a preference that they have chosen to automatically reaffirm with every interaction with the site.

This is a fair amount of text containing fancy words, and it's still not clear how it should interact with users' specific interactions with particular sites. For example, if the "decision" is to opt out on every individual site regardless of direct interactions with that site, then UAs should allow the "global" opt-out to be customized per site, so that the "robot" can accurately convey the user's intent. If the decision is instead that the user wants to opt out in general, but might communicate specific preferences to particular sites, wording like w3c/gpc#80 would be clearer.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant