Re: [w3ctag/design-reviews] WG New Spec: Global Privacy Control (GPC) (Issue #1265)

bkardell left a comment (w3ctag/design-reviews#1265)

Hello! Thank you for submitting this!

Generally, we are supportive of it, but we do have some comments and concerns.  As we've already mentioned the worker semantics issue, and you've been discussing that already we'll consider that covered.

A few notes about the explainer/the TAG issue itself: 
  * The template asks for links to the standards positions, but they are currently not linked.  We do note that there are some positions though (for example mozilla/standards-positions#867). Please link them up as others will find them useful.  
   * We also believe it would be helpful to simply answer the question immediately: Why is this not Do Not Track.  There are several good resources answering this question, just linking any of them would be helpful.
  * It would be helpful to future readers if the the explainer could have simple goals/non-goals gathered together. 

A few notes:
  * The Legal and Implementation Considerations Guide is genuinely interesting, thanks for providing that information.
  * It should be normatively called out that the user agent's generated header and JavaScript property must consistently reflect the applicable cached value.  It should be called out as a potential fingerprinting surface if it is not.  Inconsistencies necessarily enable cross-site identification.
  *  The TAG shares a feeling that way the design invokes specific US laws is on the one hand a blessing in driving adoption, but also a bit of a concern when combined with the decision to not offer extensibility routes: it might limit larger world-wide adoption.
  * While private-browsing behavior is not normatively specified, the specification could perhaps consider it a little more specifically, for example to address whether the presence or absence of a header becomes an indicator for private-browsing state or something. Or, at least acknowledging if and how it considered it. Or even whether it is affected by possible per-domain management UI. 
  * It is worth explicitly noting that this header is unsettable via Fetch.
 

Given all of this, we are marking this with the resolution satisfied, but with concerns.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/w3ctag/design-reviews/issues/1265#issuecomment-6219141469
You are receiving this because you are subscribed to this thread.

Message ID: <w3ctag/design-reviews/issues/1265/6219141469@github.com>