Re: [w3ctag/design-reviews] [Payments] shipping and contact info delegation (#425)

> What is the mechanism that the user consents to having an address that is known by the payment handler to the site where they're paying? (I'm a little concerned here because there are some types of payments for which no address is required and the user might not expect an address to be revealed.) Is the consent UI specific to each payment handler (which would be a little worrying from my perspective), or is there browser UI involved in that consent, or is it up to the browser which way to go?

What is in browser's control is to a)Exclude payment handlers that cannot provide merchant requested information from list of available payment instruments b)Tell the user selected payment handler whether or not merchant's website has asked for the shipping address and/or payer's contact information  c)Share payment handler provided shipping address and/or payer's contact information with merchant's website only if the merchant has asked for it (i.e. even if the payment handler decides to overshare the browser should block it). 
It's up to payment handlers to a) Share shipping address and/or payer's contact information with the browser only when the browser has asked for it (on behalf of merchant's website) b) Get users consent about the data that they are sharing with merchant's website.
Please note that this is not any different from the case where merchant's websites use ExamplePay's custom JS library to enable checkout with ExamplePay

> Do you think it's worth worrying about consent in the other direction -- the possibility that some payment handlers don't really need the address, but this would push them to ask for or require it? I think this is probably less concerning than the first point.

Whether or not shipping address is required, is specified in the payment request created by merchant's website and has nothing to do with payment handlers. The browser tells the payment handlers whether or not shipping address is requested by the merchant, so the payment handlers won't have any incentives to overshare the address when the merchant's website has not asked for it. 
If your concern is about more payment handlers providing shipping address so that they can process transactions which require it; The payment/wallet apps are doing this today via their own custom JS libraries, in fact supporting this feature in payment handlers API is something that they have asked for to be able to adopt the API.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3ctag/design-reviews/issues/425#issuecomment-559330717