Re: [w3c/payment-request] Spec is silent on its role in facilitating arbitrary communication between top level contexts (#936)

Hi @samuelweiler,

The first sentence of 18.7 is: "The user agent MUST NOT share information about the user with a  developer (e.g., the shipping address) without user consent."

Here's a proposed paragraph to follow that one:

"In particular, the PaymentMethodData.data and PaymentResponse.details fields allow for the arbitrary exchange of
  data. In light of the wide range of data models used by existing payment methods, prescribing data specifics in this API   
  would limit its usefulness. PaymentResponse.details carries data from the payment handler, whether Web-based (as defined 
  by Payment Handler API) or proprietary. User agents MUST NOT support payment handlers unless they include adequate 
  consent mechanisms."

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/payment-request/issues/936#issuecomment-766839834