Privacy Working Group - Activity in 2025
No matches.
TR publications
-
1 document published.
-
Global Privacy Control (GPC) published as a Working Draft. History of Global Privacy Control (GPC)
-
Past meetings
GitHub
w3cping/privacy-request
-
5 issues opened.
-
css-anchor-position-1 2025-12-23 > 2026-03-30 w3cping/privacy-request#190, by @fantasai.
-
[wg/i18n-core] i18n WG rechartering 2025 w3cping/privacy-request#189, by @w3cbot.
-
[[wg/vc] Verifiable Credentials Working Group w3cping/privacy-request#188, by @w3cbot.
-
SHACL 1.2 SPARQL 2025-12-01 > 2026-01-01 w3cping/privacy-request#187, by @nicholascar.
-
SHACL 1.2 Core 2025-12-01 > 2026-01-01 w3cping/privacy-request#186, by @nicholascar.
-
-
7 issues closed.
-
SHACL 1.2 SPARQL 2025-12-01 > 2026-01-01 w3cping/privacy-request#187.
-
SHACL 1.2 Core 2025-12-01 > 2026-01-01 w3cping/privacy-request#186.
-
rdf12-semantics 2025-11-21 > 2025-12-20 #286 w3cping/privacy-request#184.
-
rdf12-n-triples 2025-11-21 > 2025-12-20 w3cping/privacy-request#183.
-
rdf12-concepts 2025-11-21 > 2025-12-20 w3cping/privacy-request#182.
-
[wg/pointer-events] Pointer Events Working Group rechartering w3cping/privacy-request#181.
-
[wg/dx] Dataset Exchange Working Group Charter w3cping/privacy-request#185.
-
-
7 issues received 8 new comments.
-
[wg/pointer-events] Pointer Events Working Group rechartering w3cping/privacy-request#181 (1 comment by @pes10k)
w3c/gpc
-
1 issue opened.
-
4 issues received 11 new comments.
-
Change phrasing of legal interpretation for EU/GDPR w3c/gpc#93 (6 comments by @coolharsh55, @darobin, @michaelkleber, @npdoty, @SebastianZimmeck)
-
Does the GPC Support Resource apply to origins or sites? w3c/gpc#113 (1 comment by @y8qnxk82zs-cyber)
-
-
3 pull requests opened.
-
Make spec consistent about same contexts rather than same sites w3c/gpc#127, by @darobin.
-
Wording choice MAY --> can w3c/gpc#126, by @j-br0.
-
-
1 pull request merged.
-
1 pull request closed.
-
宝石Add GitHub Actions workflow for Jekyll site CI w3c/gpc#116.
-
-
2 pull requests received 9 new comments.
-
Make spec consistent about same contexts rather than same sites w3c/gpc#127 (3 comments by @darobin, @michaelkleber)
w3c/privacywg
-
1 issue closed.
-
[agenda] next meeting 2025-12-18 w3c/privacywg#18.
-
-
1 issue received 5 new comments.
w3c/credential-considerations
-
1 issue opened.
-
reference TAG finding: Preventing Abuse of Digital Credentials w3c/credential-considerations#20, by @npdoty.
-
TR publications
-
3 documents published.
-
Global Privacy Control (GPC) published 3 times as a Working Draft. History of Global Privacy Control (GPC)
-
Past meetings
GitHub
w3c/gpc
-
4 issues opened.
-
正常に接続できませんでした w3c/gpc#117, by @0tn3d636729100h-ctrl.
-
Define the header value parser w3c/gpc#114, by @annevk.
-
Does the GPC Support Resource apply to origins or sites? w3c/gpc#113, by @jyasskin.
-
Progress toward Candidate Recommendation w3c/gpc#111, by @j-br0.
-
-
6 issues closed.
-
正常に接続できませんでした w3c/gpc#117.
-
Give UAs more help in establishing user intent w3c/gpc#52.
-
Make the architecture support other privacy laws w3c/gpc#51.
-
Use HTTP structured field values w3c/gpc#6.
-
-
3 issues received 3 new comments.
-
Consistency in use of sell/share/track/target terminology w3c/gpc#94 (1 comment by @SebastianZimmeck)
-
w3c/gpc#51 (1 comment by @AramZS)
-
-
3 pull requests opened.
-
宝石Add GitHub Actions workflow for Jekyll site CI w3c/gpc#116, by @0tn3d636729100h-ctrl.
-
Typos w3c/gpc#115, by @thegreatfatzby.
-
-
3 pull requests merged.
-
Typos w3c/gpc#115.
-
Exclude same site w3c/gpc#109.
-
-
2 pull requests reopened.
-
宝石Add GitHub Actions workflow for Jekyll site CI w3c/gpc#116, by @0tn3d636729100h-ctrl.
-
宝石Add GitHub Actions workflow for Jekyll site CI w3c/gpc#116, by @0tn3d636729100h-ctrl.
-
-
3 pull requests received 6 new comments.
w3cping/tracking-issues
-
2 issues opened.
-
PING: Align exposing scalabilityMode with the WebRTC "hardware capabilities" check w3cping/tracking-issues#778, by @w3cbot.
-
PING: Align exposing scalabilityMode with the WebRTC "hardware capabilities" check w3cping/tracking-issues#777, by @w3cbot.
-
w3c/privacywg
-
1 issue opened.
-
[agenda] next meeting 2025-12-18 w3c/privacywg#18, by @npdoty.
-
-
2 issues closed.
-
[agenda] 2025-11-14 TPAC w3c/privacywg#17.
-
[agenda] next meeting: 2025-11-06 w3c/privacywg#16.
-
-
2 issues received 14 new comments.
w3cping/privacy-request
-
5 issues opened.
-
[wg/dx] Dataset Exchange Working Group Charter w3cping/privacy-request#185, by @w3cbot.
-
rdf12-semantics 2025-11-21 > 2025-12-20 #286 w3cping/privacy-request#184, by @ktk.
-
rdf12-n-triples 2025-11-21 > 2025-12-20 w3cping/privacy-request#183, by @ktk.
-
rdf12-concepts 2025-11-21 > 2025-12-20 w3cping/privacy-request#182, by @ktk.
-
[wg/pointer-events] Pointer Events Working Group rechartering w3cping/privacy-request#181, by @w3cbot.
-
-
4 issues closed.
-
[wg/webextensions] Web Extensions Working Group w3cping/privacy-request#169.
-
Screen Orientation 2025-09-04 > 2025-10-16 w3cping/privacy-request#173.
-
css-color-adjust-1 2025-09-17 > 2025-10-31 w3cping/privacy-request#176.
-
Geolocation 2025-09-01 > 2025-10-02 w3cping/privacy-request#172.
-
-
5 issues received 5 new comments.
w3c/security-questionnaire
-
1 issue opened.
-
Consider replacing "meaningful user consent" with wording about user intent w3c/security-questionnaire#197, by @jyasskin.
-
-
1 pull request opened.
-
Update the design-principles#consent reference to #user-intent. w3c/security-questionnaire#196, by @jyasskin.
-
-
3 pull requests merged.
-
Update the design-principles#consent reference to #user-intent. w3c/security-questionnaire#196.
-
Embed the markdown template into the main questionnaire. w3c/security-questionnaire#191.
-
Remove the TAG from the groups responsible for this document. w3c/security-questionnaire#185.
-
-
1 pull request received 1 new comment.
-
Update the design-principles#consent reference to #user-intent. w3c/security-questionnaire#196 (1 comment by @simoneonofri)
-
w3c/adding-permissions
-
1 issue opened.
-
How should user-agents handle permissions most-tied to an origin other than the top level origin w3c/adding-permissions#2, by @pes10k.
-
w3c/fingerprinting-guidance
-
1 issue received 1 new comment.
-
w3c/fingerprinting-guidance#59 (1 comment by @npdoty)
-
Participants
-
3 participants joined.
-
Motunrayo Adebayo (W3C Invited Experts) joined.
-
Bhavani Shankar Garikapati (W3C Invited Experts) joined.
-
Serge Egelman (W3C Invited Experts) joined.
-
GitHub
w3cping/tracking-issues
-
7 issues opened.
-
Security and Privacy Self-review Questionnaire w3cping/tracking-issues#776, by @w3cbot.
-
Improved error codes w3cping/tracking-issues#775, by @w3cbot.
-
Must natural orientation be detectable? w3cping/tracking-issues#774, by @w3cbot.
-
Fingerprinting risk: users that configure their device to not permit screen locking w3cping/tracking-issues#773, by @w3cbot.
-
Editorial: pre-lock conditions definition placement w3cping/tracking-issues#772, by @w3cbot.
-
Are ScreenOrientation change events scoped as tightly as possible w3cping/tracking-issues#771, by @w3cbot.
-
Fill out the Security and Privacy self review questionnaire w3cping/tracking-issues#770, by @w3cbot.
-
w3cping/privacy-request
-
1 issue opened.
-
Web Sustainability Guidelines 2025-10-06 w3cping/privacy-request#180, by @TzviyaSiegman.
-
-
5 issues received 7 new comments.
-
Screen Orientation 2025-09-04 > 2025-10-16 w3cping/privacy-request#173 (3 comments by @bvandersloot-mozilla, @pes10k)
-
w3c/privacywg
-
1 issue opened.
-
[agenda] 2025-11-14 TPAC w3c/privacywg#17, by @npdoty.
-
TR publications
-
4 documents published.
-
Global Privacy Control (GPC) published twice as a Working Draft. History of Global Privacy Control (GPC)
-
Past meetings
Participants
-
2 participants joined.
-
Ted Hardie (W3C Invited Experts) joined.
-
Don Marti (W3C Invited Experts) joined.
-
-
2 participants left.
-
Andrew Pascoe (NextRoll) left.
-
Steven Valdez (Google LLC) left.
-
GitHub
w3cping/privacy-request
-
7 issues opened.
-
DID Resolution 2025-09-29 w3cping/privacy-request#178, by @wip-abramson.
-
[ig/me] Media & Entertainment Interest Group Charter w3cping/privacy-request#177, by @w3cbot.
-
css-color-adjust-1 2025-09-17 > 2025-10-31 w3cping/privacy-request#176, by @alisonmaher.
-
[wg/json-ld] JSON-LD Working Group Charter w3cping/privacy-request#175, by @w3cbot.
-
[ig/webai] Web&AI Interest Group w3cping/privacy-request#174, by @w3cbot.
-
Screen Orientation 2025-09-04 > 2025-10-16 w3cping/privacy-request#173, by @siusin.
-
Geolocation 2025-09-01 > 2025-10-02 w3cping/privacy-request#172, by @siusin.
-
-
8 issues closed.
-
[ig/me] Media & Entertainment Interest Group Charter w3cping/privacy-request#177.
-
DAPT 2025-08-18 > 2025-10-18 w3cping/privacy-request#170.
-
Horizontal Review Request for DID v1.1 2025-05-17 w3cping/privacy-request#163.
-
[wg/json-ld] JSON-LD Working Group Charter w3cping/privacy-request#175.
-
[wg/png] PNG Working Group Charter w3cping/privacy-request#171.
-
IMSC Text Profile 1.3 (22 July 2025) w3cping/privacy-request#167.
-
[ig/webai] Web&AI Interest Group w3cping/privacy-request#174.
-
[wg/didmethods] DID Methods Working Group w3cping/privacy-request#168.
-
-
10 issues received 23 new comments.
-
Horizontal Review Request for DID v1.1 2025-05-17 w3cping/privacy-request#163 (11 comments by @kdenhartog, @msporny, @pes10k)
-
[wg/png] PNG Working Group Charter w3cping/privacy-request#171 (3 comments by @pes10k, @sandandsnow, @svgeesus)
-
[ig/me] Media & Entertainment Interest Group Charter w3cping/privacy-request#177 (1 comment by @pes10k)
-
w3cping/tracking-issues
-
4 issues opened.
-
Add support for <meta name="rating" ...> w3cping/tracking-issues#769, by @w3cbot.
-
Revise privacy considerations w3cping/tracking-issues#768, by @w3cbot.
-
`[__](`/ w3cping/tracking-issues#767, by @joselinosky.
-
Billetera Aeugenio w3cping/tracking-issues#766, by @joselinosky.
-
-
2 issues closed.
-
Billetera Aeugenio w3cping/tracking-issues#766.
-
`[__](`/ w3cping/tracking-issues#767.
-
w3c/privacywg
-
2 issues opened.
-
[agenda] next meeting: 2025-11-06 w3c/privacywg#16, by @npdoty.
-
[agenda] next meeting (2025-09-18?) w3c/privacywg#15, by @npdoty.
-
-
3 issues closed.
-
[agenda] next meeting (2025-09-18?) w3c/privacywg#15.
-
[agenda] next meeting 2025-09-04 w3c/privacywg#14.
-
[agenda] next 2025-08-07 w3c/privacywg#13.
-
-
1 issue received 3 new comments.
w3c/fingerprinting-guidance
-
2 pull requests merged.
-
Editorial: add Oxford comma to fingerprinting definition w3c/fingerprinting-guidance#83.
-
Reorganize the Best Practices as described in #70 w3c/fingerprinting-guidance#81.
-
-
1 pull request received 1 new comment.
-
Reorganize the Best Practices as described in #70 w3c/fingerprinting-guidance#81 (1 comment by @npdoty)
-
w3c/gpc
-
2 issues received 2 new comments.
-
3 pull requests opened.
-
Update index.html to simplify meaning of user request w3c/gpc#110, by @j-br0.
-
Exclude same site w3c/gpc#109, by @j-br0.
-
Clarifications and anchoring w3c/gpc#108, by @darobin.
-
-
2 pull requests merged.
-
Clarify scope of GPC w3c/gpc#99.
-
Add user agent automation definition w3c/gpc#105.
-
-
1 pull request closed.
-
Consolidate US legal info w3c/gpc#98.
-
-
5 pull requests received 13 new comments.
TR publications
-
2 documents published.
-
Global Privacy Control (GPC) published as a Working Draft. History of Global Privacy Control (GPC)
-
Past meetings
Participants
-
1 participant joined.
-
Lei Mu (W3C Invited Experts) joined.
-
GitHub
w3cping/privacy-request
-
4 issues opened.
-
[wg/png] PNG Working Group Charter w3cping/privacy-request#171, by @w3cbot.
-
DAPT 2025-08-18 > 2025-10-18 w3cping/privacy-request#170, by @himorin.
-
[wg/webextensions] Web Extensions Working Group w3cping/privacy-request#169, by @w3cbot.
-
[wg/didmethods] DID Methods Working Group w3cping/privacy-request#168, by @w3cbot.
-
-
1 issue closed.
-
Web Authentication 2025-04-24 > 2025-05-25 w3cping/privacy-request#162.
-
-
2 issues received 6 new comments.
-
Web Authentication 2025-04-24 > 2025-05-25 w3cping/privacy-request#162 (5 comments by @npdoty, @timcappalli)
-
w3c/privacywg
-
1 issue opened.
-
[agenda] next meeting 2025-09-04 w3c/privacywg#14, by @npdoty.
-
-
2 issues received 4 new comments.
w3c/security-questionnaire
-
1 issue opened.
-
Pullrequest please w3c/security-questionnaire#195, by @lynn1980gooze-cpu.
-
-
1 issue closed.
-
Pullrequest please w3c/security-questionnaire#195.
-
w3cping/tracking-issues
-
6 issues opened.
-
user verification discouraged should consider privacy impact or UA advice w3cping/tracking-issues#765, by @w3cbot.
-
are user handles in the wild including user data? w3cping/tracking-issues#764, by @w3cbot.
-
related origins enables sharing across relying parties w3cping/tracking-issues#763, by @w3cbot.
-
document and mitigate fingerprinting and disclosure risk of capabilities and extensions w3cping/tracking-issues#762, by @w3cbot.
-
privacy implications of cross-origin iframe w3cping/tracking-issues#761, by @w3cbot.
-
Future-proofing privacy considerations of New API feature to identify feature support per operator w3cping/tracking-issues#759, by @w3cbot.
-
-
1 issue received 1 new comment.
-
Future-proofing privacy considerations of New API feature to identify feature support per operator w3cping/tracking-issues#759 (1 comment by @dbanjo111)
-
-
1 pull request opened.
-
SECURITY.md w3cping/tracking-issues#760, by @dbanjo111.
-
w3c/gpc
-
1 issue received 2 new comments.
-
Consistency in use of sell/share/track/target terminology w3c/gpc#94 (2 comments by @coolharsh55, @j-br0)
-
-
1 pull request merged.
-
Edit to spec to clarify scope w3c/gpc#107.
-
-
2 pull requests closed.
-
2 pull requests received 2 new comments.
-
Align all descriptions of GPC to say it's meant to restrict sale and sharing of data. w3c/gpc#102 (1 comment by @j-br0)
-
Align all descriptions of GPC to say it restricts sharing and targeting between different organizations. w3c/gpc#104 (1 comment by @j-br0)
-
w3c/fingerprinting-guidance
-
1 pull request merged.
-
Add references for Ephemeral Fingerprinting w3c/fingerprinting-guidance#74.
-
TR publications
-
1 document published.
-
Global Privacy Control (GPC) published as a Working Draft. History of Global Privacy Control (GPC)
-
Past meetings
-
1 meeting.
Participants
-
1 participant joined.
-
Joshua Hood (Google LLC) joined.
-
-
1 participant left.
-
Don Marti (W3C Invited Experts) left.
-
-
1 organization left.
-
Raptive left.
-
GitHub
w3c/gpc
-
1 issue closed.
-
Meaning of `lastUpdate` for "strange" dates w3c/gpc#103.
-
-
1 issue received 1 new comment.
-
2 pull requests opened.
-
Edit to spec to clarify scope w3c/gpc#107, by @j-br0.
-
Changes lastUpdate to a more rational date w3c/gpc#106, by @AramZS.
-
-
1 pull request merged.
-
Changes lastUpdate to a more rational date w3c/gpc#106.
-
-
1 pull request received 1 new comment.
w3cping/privacy-request
-
2 issues opened.
-
IMSC Text Profile 1.3 (22 July 2025) w3cping/privacy-request#167, by @palemieux.
-
[wg/webapps] Web Applications Working Group Charter w3cping/privacy-request#166, by @w3cbot.
-
-
4 issues closed.
-
[wg/webapps] Web Applications Working Group Charter w3cping/privacy-request#166.
-
Web Neural Network API 2025-03-20 > 2025-06-20 w3cping/privacy-request#156.
-
[wg/social] Social Web Working Group new charter w3cping/privacy-request#165.
-
[wg/apa] Accessible Platform Architectures Group Charter w3cping/privacy-request#164.
-
-
4 issues received 4 new comments.
-
Horizontal Review Request for DID v1.1 2025-05-17 w3cping/privacy-request#163 (1 comment by @kdenhartog)
-
[wg/webapps] Web Applications Working Group Charter w3cping/privacy-request#166 (1 comment by @pes10k)
-
Web Neural Network API 2025-03-20 > 2025-06-20 w3cping/privacy-request#156 (1 comment by @sandandsnow)
-
[wg/apa] Accessible Platform Architectures Group Charter w3cping/privacy-request#164 (1 comment by @pes10k)
-
w3cping/tracking-issues
-
1 issue opened.
-
Feature can be abused to create cross-site covert channels w3cping/tracking-issues#758, by @w3cbot.
-
-
2 issues closed.
-
Feature can be abused to create cross-site covert channels w3cping/tracking-issues#722.
-
Feature can be abused to create cross-site covert channels w3cping/tracking-issues#758.
-
-
1 issue received 1 new comment.
-
Feature can be abused to create cross-site covert channels w3cping/tracking-issues#758 (1 comment by @plehegar)
-
w3c/privacywg
-
1 issue received 2 new comments.
w3c/fingerprinting-guidance
-
1 issue opened.
-
Identifying characteristics of a user w3c/fingerprinting-guidance#84, by @annevk.
-
-
1 pull request opened.
-
Editorial: add Oxford comma to fingerprinting definition w3c/fingerprinting-guidance#83, by @annevk.
-
Past meetings
-
1 meeting.
Participants
-
1 participant joined.
-
Emma Zuehlcke (Mozilla Foundation) joined.
-
GitHub
w3cping/tracking-issues
-
33 issues opened.
-
mitigations for tracking and fingerprinting using presented or issued credential characteristics w3cping/tracking-issues#757, by @w3cbot.
-
Choice of issuers and consequent exclusion risk w3cping/tracking-issues#756, by @w3cbot.
-
Prevent increased centralization of trust via strict Verifier requirements when presenting a credential w3cping/tracking-issues#755, by @w3cbot.
-
Exchanges user agency for greater compliance and convenience w3cping/tracking-issues#753, by @w3cbot.
-
API requests should provide the site with what they need to explain why and how requested credential information will be used w3cping/tracking-issues#751, by @w3cbot.
-
require in-context in-content explanation and an element for user-initiated presentation w3cping/tracking-issues#750, by @w3cbot.
-
enumerated values for purpose, sharing and retention in API method w3cping/tracking-issues#749, by @w3cbot.
-
Privacy Considerations: "Spectrum of Privacy" w3cping/tracking-issues#748, by @w3cbot.
-
registry of credential types w3cping/tracking-issues#747, by @w3cbot.
-
Privacy: ensuring RPs blinded to credential existence w3cping/tracking-issues#746, by @w3cbot.
-
Should we have a common and interoperable definition of request types and their privacy properties? w3cping/tracking-issues#745, by @w3cbot.
-
user agents should limit to protocols listed in the registry that meet the group's requirements w3cping/tracking-issues#744, by @w3cbot.
-
note designed-for-purpose alternatives and the risk of crowding out those options w3cping/tracking-issues#743, by @w3cbot.
-
define consent and permission; explain split roles regarding consent w3cping/tracking-issues#742, by @w3cbot.
-
Access to an Open Global Web Reduced w3cping/tracking-issues#741, by @w3cbot.
-
Consider requiring a strong signal of user intent. w3cping/tracking-issues#740, by @w3cbot.
-
Describe trust signals in protocol registry w3cping/tracking-issues#739, by @w3cbot.
-
Issuer identity in selective disclosure cases w3cping/tracking-issues#738, by @w3cbot.
-
What is the defined trust boundary between the user, wallet, and browser? w3cping/tracking-issues#737, by @w3cbot.
-
Privacy Considerations: Types of Wallets and trust in different Wallets w3cping/tracking-issues#736, by @w3cbot.
-
Protocol registry: Reviewing is not sufficient w3cping/tracking-issues#735, by @w3cbot.
-
Privacy Considerations for multiple presentation requests (and responses) w3cping/tracking-issues#734, by @w3cbot.
-
Should response encryption be required w3cping/tracking-issues#733, by @w3cbot.
-
Should requests be assumed to be linkable by the browser? w3cping/tracking-issues#732, by @w3cbot.
-
Linkability and issuer involvement as a protocol requirement w3cping/tracking-issues#731, by @w3cbot.
-
Can we require protocols to support unlinkable revocation? w3cping/tracking-issues#730, by @w3cbot.
-
User agents that only support authorized verifiers (for government credentials) w3cping/tracking-issues#729, by @w3cbot.
-
voluntary usage and protections against coercion w3cping/tracking-issues#728, by @w3cbot.
-
registration of and commitment to a particular use case and purpose w3cping/tracking-issues#727, by @w3cbot.
-
reporting abuse of credential requests w3cping/tracking-issues#726, by @w3cbot.
-
friction and frequency minimization w3cping/tracking-issues#725, by @w3cbot.
-
-
1 issue received 1 new comment.
-
w3cping/tracking-issues#165 (1 comment by @daniel-montalvo)
-
w3cping/privacy-request
-
1 issue opened.
-
[wg/social] Social Web Working Group new charter w3cping/privacy-request#165, by @w3cbot.
-
-
2 issues closed.
-
[ig/chinese-web] Chinese Web Interest Group re-charter w3cping/privacy-request#157.
-
[wg/payments] Web Payments Working Group Charter w3cping/privacy-request#160.
-
-
1 issue received 2 new comments.
-
Horizontal Review Request for DID v1.1 2025-05-17 w3cping/privacy-request#163 (2 comments by @kdenhartog, @npdoty)
-
w3c/security-questionnaire
-
3 issues opened.
-
add question about testability w3c/security-questionnaire#194, by @npdoty.
-
possibly add question on whether different s&p decisions are testable w3c/security-questionnaire#193, by @pes10k.
-
question / guidance on background requests w3c/security-questionnaire#192, by @npdoty.
-
-
1 issue closed.
-
There are three active versions of this questionnaire w3c/security-questionnaire#175.
-
-
1 issue received 1 new comment.
-
There are three active versions of this questionnaire w3c/security-questionnaire#175 (1 comment by @ylafon)
-
w3c/fingerprinting-guidance
-
1 issue opened.
-
what guidance can we give on making fingerprinting mitigations testable w3c/fingerprinting-guidance#82, by @npdoty.
-
w3c/privacywg
-
1 issue opened.
-
[agenda] next 2025-08-07 w3c/privacywg#13, by @npdoty.
-
-
1 issue closed.
-
[agenda] 2025-06-05 w3c/privacywg#12.
-
-
2 issues received 6 new comments.
w3c/gpc
-
1 pull request opened.
-
Add user agent automation definition w3c/gpc#105, by @bvandersloot-mozilla.
-
Past meetings
-
1 meeting.
Participants
-
3 participants joined.
-
Mia Therese Jamili (PayPal) joined.
-
Julien Bataille (Rakuten Group, Inc.) joined.
-
ㅤ Pascoe (Apple Inc.) joined.
-
-
2 organizations joined.
-
PayPal joined.
-
Rakuten Group, Inc. joined.
-
GitHub
w3c/privacywg
-
1 issue opened.
-
[agenda] 2025-06-05 w3c/privacywg#12, by @npdoty.
-
-
1 issue closed.
-
[agenda] 2025-05-15 w3c/privacywg#11.
-
-
2 issues received 4 new comments.
w3cping/privacy-request
-
2 issues opened.
-
[wg/apa] Accessible Platform Architectures Group Charter w3cping/privacy-request#164, by @w3cbot.
-
Horizontal Review Request for DID v1.1 2025-05-17 w3cping/privacy-request#163, by @msporny.
-
-
2 issues closed.
-
[wg/media] Media Working Group Charter w3cping/privacy-request#161.
-
Playout Statistics API for WebAudio 2025-01-31 > 2025-03-01 w3cping/privacy-request#154.
-
-
3 issues received 8 new comments.
-
[wg/media] Media Working Group Charter w3cping/privacy-request#161 (6 comments by @pes10k, @tidoust, @tjwhalen)
-
Playout Statistics API for WebAudio 2025-01-31 > 2025-03-01 w3cping/privacy-request#154 (1 comment by @pes10k)
-
[ig/chinese-web] Chinese Web Interest Group re-charter w3cping/privacy-request#157 (1 comment by @xueyuanjia)
-
w3cping/tracking-issues
-
225 issues opened.
-
Remove UI requirement for `<a ping>` w3cping/tracking-issues#724, by @w3cbot.
-
Privacy and Security Self-Review for DIDs w3cping/tracking-issues#723, by @w3cbot.
-
Feature can be abused to create cross-site covert channels w3cping/tracking-issues#722, by @w3cbot.
-
privacy review for registry inclusion w3cping/tracking-issues#721, by @w3cbot.
-
Disable prompting in third parties w3cping/tracking-issues#720, by @w3cbot.
-
Add a timezonechange event to Window/WorkerGlobalScope w3cping/tracking-issues#719, by @w3cbot.
-
Mitigate canvas fingerprinting risk w3cping/tracking-issues#718, by @w3cbot.
-
Should lazy loading be bound to scripting being enabled? w3cping/tracking-issues#717, by @w3cbot.
-
Consider Spec warning re: Detectability of Assistive Technology w3cping/tracking-issues#716, by @w3cbot.
-
Spec should not specify behavior of other specs in Editors Draft status (i.e., Reporting API) w3cping/tracking-issues#715, by @w3cbot.
-
Add privacy recommendation to autofill/autocomplete attribute w3cping/tracking-issues#714, by @w3cbot.
-
Privacy/Security considerations section w3cping/tracking-issues#713, by @w3cbot.
-
Add responses to the Self-Review Questionnaire: Security and Privacy w3cping/tracking-issues#712, by @w3cbot.
-
Make WebNN API a policy-controlled feature with default allowlist 'self' w3cping/tracking-issues#711, by @w3cbot.
-
Device selection with MLDevicePreference and MLPowerPreference w3cping/tracking-issues#710, by @w3cbot.
-
Add initial Security and Privacy Considerations sections w3cping/tracking-issues#709, by @w3cbot.
-
Related WebGPU Security and Privacy Considerations w3cping/tracking-issues#708, by @w3cbot.
-
Privacy considerations for cached/persisted data w3cping/tracking-issues#707, by @w3cbot.
-
Add privacy considerations for cached/persisted data w3cping/tracking-issues#706, by @w3cbot.
-
Limitations on TDs Utilising nosec w3cping/tracking-issues#705, by @w3cbot.
-
Identifiers don't seem to rotate enough w3cping/tracking-issues#704, by @w3cbot.
-
Personal devices and public/private TDDs w3cping/tracking-issues#703, by @w3cbot.
-
Remove or rephrase sentence around Trusted Networks w3cping/tracking-issues#702, by @w3cbot.
-
isExtended is additional fingerprinting surface w3cping/tracking-issues#701, by @w3cbot.
-
Screen labels seem especially privacy risking and identifying w3cping/tracking-issues#700, by @w3cbot.
-
Security considerations section links to non-versioned GH doc w3cping/tracking-issues#699, by @w3cbot.
-
Move existing methods of inferring multi-montior support behind permission w3cping/tracking-issues#698, by @w3cbot.
-
Add origin clean check on objects that support it. w3cping/tracking-issues#697, by @w3cbot.
-
Output of decoding and encoding bytes are fingerprintable w3cping/tracking-issues#696, by @w3cbot.
-
Suggestions on improvements for the privacy considerations section w3cping/tracking-issues#695, by @w3cbot.
-
Timing attack privacy consideration w3cping/tracking-issues#694, by @w3cbot.
-
Should the spec require site isolation? w3cping/tracking-issues#693, by @w3cbot.
-
remove excess 2119 language, e.g. in section 13 w3cping/tracking-issues#692, by @w3cbot.
-
Cite hardware accel privacy mitigation in section 13 w3cping/tracking-issues#691, by @w3cbot.
-
VideoDecoder API may expose the underlying buffer pool size w3cping/tracking-issues#690, by @w3cbot.
-
Split security & privacy considerations w3cping/tracking-issues#689, by @w3cbot.
-
Privacy considerations re: redundant entry w3cping/tracking-issues#688, by @w3cbot.
-
Security and privacy risks of insecure transport / mixed content. w3cping/tracking-issues#687, by @w3cbot.
-
Add further fingerprinting considerations w3cping/tracking-issues#686, by @w3cbot.
-
Clarify version negotiation or lack thereof w3cping/tracking-issues#685, by @w3cbot.
-
Browser Testing and Tools Working Group Charter 2021 w3cping/tracking-issues#684, by @w3cbot.
-
Editing WG w3cping/tracking-issues#683, by @w3cbot.
-
HTML WG 2021 w3cping/tracking-issues#682, by @w3cbot.
-
Second Screen WG rechartering w3cping/tracking-issues#681, by @w3cbot.
-
Service Workers WG charter 2022 w3cping/tracking-issues#680, by @w3cbot.
-
Framebust out of webviews w3cping/tracking-issues#679, by @w3cbot.
-
Expose sensors to workers w3cping/tracking-issues#678, by @w3cbot.
-
Javascript 120Hz devicemotion events for high end inertial applications w3cping/tracking-issues#677, by @w3cbot.
-
Privacy - identifying parameters w3cping/tracking-issues#676, by @w3cbot.
-
Relation to Permissions API w3cping/tracking-issues#675, by @w3cbot.
-
Access to magnetometer and potential security & privacy issues w3cping/tracking-issues#674, by @w3cbot.
-
Spec should include mandatory mitigations for privacy harms / risks w3cping/tracking-issues#673, by @w3cbot.
-
device fingerprinting may also refer to the factory (or other) calibration of the device w3cping/tracking-issues#672, by @w3cbot.
-
add privacy considerations section w3cping/tracking-issues#671, by @w3cbot.
-
Encrypt SPC Credential Identifiers in authentication flows to increase privacy w3cping/tracking-issues#670, by @w3cbot.
-
Clarification on requiring user activation for credential creation in cross-origin iframes to mitigation cross-site tracking w3cping/tracking-issues#669, by @w3cbot.
-
11.2 define the mitigation w3cping/tracking-issues#668, by @w3cbot.
-
11.3 & 11.4: define the mitigation w3cping/tracking-issues#667, by @w3cbot.
-
Is it possible for a user to downgrade a credential creation request? w3cping/tracking-issues#666, by @w3cbot.
-
Consider separating the SPC powers of Third Party invocation and Payment display w3cping/tracking-issues#665, by @w3cbot.
-
Richer negotiation re: address redaction? w3cping/tracking-issues#664, by @w3cbot.
-
Spec is silent on its role in facilitating arbitrary communication between top level contexts w3cping/tracking-issues#663, by @w3cbot.
-
PING Review w3cping/tracking-issues#662, by @w3cbot.
-
Section 1.1 requires loading the entire app at once? w3cping/tracking-issues#661, by @w3cbot.
-
Redundant definition about allowed filenames? w3cping/tracking-issues#660, by @w3cbot.
-
Privacy considerations section requires users to manage storage w3cping/tracking-issues#659, by @w3cbot.
-
Clarify relationship to Web Application Manifest w3cping/tracking-issues#658, by @w3cbot.
-
How to validate / verifying app_id? w3cping/tracking-issues#657, by @w3cbot.
-
What are sessions? w3cping/tracking-issues#656, by @w3cbot.
-
use of of callbacks instead of events w3cping/tracking-issues#655, by @w3cbot.
-
Under definition of some properties and elements w3cping/tracking-issues#654, by @w3cbot.
-
Accessibility Considerations text is confusing or incorrect w3cping/tracking-issues#653, by @w3cbot.
-
Beef up privacy and security section with regards to the various risks related to the different surfaces w3cping/tracking-issues#652, by @w3cbot.
-
Add 'privacy and security' section w3cping/tracking-issues#651, by @w3cbot.
-
Fingerprint surface coming from MediaRecorder-able types - needs consideration? w3cping/tracking-issues#650, by @w3cbot.
-
Improvements to Privacy & Security Considerations w3cping/tracking-issues#649, by @w3cbot.
-
PING review w3cping/tracking-issues#648, by @w3cbot.
-
Provide guidance on potential device label sanitization w3cping/tracking-issues#647, by @w3cbot.
-
Spec should document anticipated differences from v2.0 w3cping/tracking-issues#646, by @w3cbot.
-
Make mandatory link between image metadata and page permissions w3cping/tracking-issues#645, by @w3cbot.
-
getPhotoCapabilities should be marked as adding additional fingerprinting surface w3cping/tracking-issues#644, by @w3cbot.
-
Using getPhotoSettings and takePhoto allows for cross site communication w3cping/tracking-issues#643, by @w3cbot.
-
Spec entrenches current privacy harming getUserMedia / enumerateDevices systems w3cping/tracking-issues#642, by @w3cbot.
-
Text suggestion and clarification request w3cping/tracking-issues#641, by @w3cbot.
-
Investigate and document the fingerprintability of user media rendering w3cping/tracking-issues#640, by @w3cbot.
-
Deprecate inputDeviceInfo.getCapabilities() for better privacy w3cping/tracking-issues#639, by @w3cbot.
-
The review of privacy w3cping/tracking-issues#638, by @w3cbot.
-
Exposure of CPU/GPU usage w3cping/tracking-issues#637, by @w3cbot.
-
Exposing battery status w3cping/tracking-issues#636, by @w3cbot.
-
Intentional manipulation of battery status w3cping/tracking-issues#635, by @w3cbot.
-
Split security and privacy considerations w3cping/tracking-issues#634, by @w3cbot.
-
General approach to capability negotiation w3cping/tracking-issues#633, by @w3cbot.
-
Consider context by reference with metadata w3cping/tracking-issues#632, by @w3cbot.
-
Define the error model w3cping/tracking-issues#631, by @w3cbot.
-
Privacy and Security section over claims (I think origins can use this functionality to learn about the system) w3cping/tracking-issues#630, by @w3cbot.
-
Spec needs to define interaction with the web platform w3cping/tracking-issues#629, by @w3cbot.
-
Define error and add Error and Exception appendix w3cping/tracking-issues#628, by @w3cbot.
-
Privacy review of ARIA in HTML (15th March 2021) w3cping/tracking-issues#627, by @w3cbot.
-
Security and privacy considerations for DOMHighResTimeStamp resolution w3cping/tracking-issues#626, by @w3cbot.
-
How do connection/disconnection events interact with 'device has been interacted with by the user'? w3cping/tracking-issues#625, by @w3cbot.
-
Clarifications for getGamepads / user activations w3cping/tracking-issues#624, by @w3cbot.
-
id field in gamepad might have a persistent identifier? w3cping/tracking-issues#623, by @w3cbot.
-
are timestamps a potential tracking/fingerprinting vector? w3cping/tracking-issues#622, by @w3cbot.
-
Security / Privacy Questionnaire w3cping/tracking-issues#621, by @w3cbot.
-
Make note of the fact that the standard gamepad layout is privacy-relevant w3cping/tracking-issues#620, by @w3cbot.
-
vocabulary fields to enable privacy-respecting use of datasets w3cping/tracking-issues#619, by @w3cbot.
-
metadata for private queries of a data service w3cping/tracking-issues#618, by @w3cbot.
-
authenticity and integrity of dcat files and associated datasets w3cping/tracking-issues#617, by @w3cbot.
-
Device motion sampling frequency w3cping/tracking-issues#616, by @w3cbot.
-
Links from sec/priv sections back to normative mitigations? w3cping/tracking-issues#615, by @w3cbot.
-
[css-fonts] incorporate mitigations for font based fingerprinting w3cping/tracking-issues#614, by @w3cbot.
-
[css-fonts-4] Privacy and I18n issues around user-installed fonts, and user selection of them w3cping/tracking-issues#613, by @w3cbot.
-
[css-color-5] Question regarding on deman download of ICC file w3cping/tracking-issues#612, by @w3cbot.
-
[css-contain-2][inert]: inert and hidden containments should share common logic w3cping/tracking-issues#611, by @w3cbot.
-
[mediaqueries] Suggestion: "prefers-pointer-location" w3cping/tracking-issues#610, by @w3cbot.
-
security considerations regarding use of platform accessibility apis for accessing user data w3cping/tracking-issues#609, by @w3cbot.
-
describing the privacy threat of disclosure of use of assistive technology w3cping/tracking-issues#608, by @w3cbot.
-
"User notifications" section should be more specific w3cping/tracking-issues#607, by @w3cbot.
-
"power-supply" is a fingerprinting vector w3cping/tracking-issues#606, by @w3cbot.
-
Text and clarity issues in the security and privacy considerations section w3cping/tracking-issues#605, by @w3cbot.
-
Feature can be abused to create cross-site covert channels w3cping/tracking-issues#604, by @w3cbot.
-
"no side channels" subsection issues w3cping/tracking-issues#603, by @w3cbot.
-
"first party context" section concerns w3cping/tracking-issues#602, by @w3cbot.
-
add more discussion of sec and priv analysis; split sections w3cping/tracking-issues#601, by @w3cbot.
-
private browsing mode: upgrade recommendation w3cping/tracking-issues#600, by @w3cbot.
-
Clarify in text the relationship to Trace Context w3cping/tracking-issues#599, by @w3cbot.
-
Relationship to other HTTP Header encoding proposals w3cping/tracking-issues#598, by @w3cbot.
-
Make trust/privacy boundary explicit (at least in browsers) w3cping/tracking-issues#597, by @w3cbot.
-
More architectural description w3cping/tracking-issues#596, by @w3cbot.
-
Add in-line privacy and security considerations to VISS transport w3cping/tracking-issues#595, by @w3cbot.
-
VISS core: what is a pseudo-VIN w3cping/tracking-issues#594, by @w3cbot.
-
VISS Core: why is access control non-normative? w3cping/tracking-issues#593, by @w3cbot.
-
Privacy and Security Considerations section review for Personalization Semantics Content w3cping/tracking-issues#592, by @w3cbot.
-
Privacy and security analysis w3cping/tracking-issues#591, by @w3cbot.
-
security and privacy check list w3cping/tracking-issues#590, by @w3cbot.
-
security and privacy self review check list w3cping/tracking-issues#589, by @w3cbot.
-
Add details about generic XRSpace and XRInputSource threats w3cping/tracking-issues#588, by @w3cbot.
-
Add appendix to privacy & security explainer showing table of threat vectors & mitigations w3cping/tracking-issues#587, by @w3cbot.
-
Correct / real URLs should be enforced, to avoid breaking adblockers w3cping/tracking-issues#586, by @w3cbot.
-
Isn't this API a privacy issue? w3cping/tracking-issues#585, by @w3cbot.
-
privacy concerns with proposal through inducing network requests w3cping/tracking-issues#584, by @w3cbot.
-
Should Be Opt-In: Introduces privacy harm with no direct browser-user benefit w3cping/tracking-issues#583, by @w3cbot.
-
Should be Opt-In: Creates privacy harm with little to no upside for Web users w3cping/tracking-issues#582, by @w3cbot.
-
Should be Opt-In: Creates privacy harm with little to no upside for Web users w3cping/tracking-issues#581, by @w3cbot.
-
Cosine similarity between two facial features and cross origin tracking w3cping/tracking-issues#580, by @w3cbot.
-
Add AudioRenderCapacity interface and related classes w3cping/tracking-issues#579, by @w3cbot.
-
Suggested file name and location for the File System Access API. w3cping/tracking-issues#578, by @w3cbot.
-
Early design review for the FLoC API w3cping/tracking-issues#577, by @w3cbot.
-
Managed Device Web API w3cping/tracking-issues#576, by @w3cbot.
-
Media Session: video conferencing actions w3cping/tracking-issues#575, by @w3cbot.
-
Early design review: opaque-blocklisted-never-sniffed MIME types w3cping/tracking-issues#574, by @w3cbot.
-
Pickling for Async Clipboard API w3cping/tracking-issues#572, by @w3cbot.
-
Distributed Tracing WG: Baggage specification w3cping/tracking-issues#571, by @w3cbot.
-
WebXR Raw Camera Access API w3cping/tracking-issues#570, by @w3cbot.
-
Auto-expanding details elements w3cping/tracking-issues#569, by @w3cbot.
-
HIDDevice forget() w3cping/tracking-issues#568, by @w3cbot.
-
Navigation API (formerly app history API) w3cping/tracking-issues#567, by @w3cbot.
-
Review request for Protected Audience w3cping/tracking-issues#566, by @w3cbot.
-
Review Request for Attribution Reporting API w3cping/tracking-issues#565, by @w3cbot.
-
Early design review for the Topics API w3cping/tracking-issues#564, by @w3cbot.
-
Cookie Expires/Max-Age attribute upper limit w3cping/tracking-issues#563, by @w3cbot.
-
Review request for Fenced Frames w3cping/tracking-issues#562, by @w3cbot.
-
Shared Storage API w3cping/tracking-issues#561, by @w3cbot.
-
Two changes to Secure Payment Confirmation prior to CR w3cping/tracking-issues#560, by @w3cbot.
-
Moving local files with the File System Access API w3cping/tracking-issues#559, by @w3cbot.
-
Storage Access API w3cping/tracking-issues#558, by @w3cbot.
-
requestStorageAccessFor w3cping/tracking-issues#557, by @w3cbot.
-
powerEfficientEncoder/powerEfficientDecoder w3cping/tracking-issues#556, by @w3cbot.
-
Codec stats reveal hardware information which could be used for fingerprinting w3cping/tracking-issues#555, by @w3cbot.
-
The stats API allow hardware fingerprinting (encoder, powerEfficient) w3cping/tracking-issues#554, by @w3cbot.
-
Privacy concern: Leaking communication / plain text using patterns in packet size, frequency, etc. w3cping/tracking-issues#553, by @w3cbot.
-
Add CPU metrics w3cping/tracking-issues#552, by @w3cbot.
-
Fullscreen shouldn't be enough to reveal fingerprinting-surface w3cping/tracking-issues#551, by @w3cbot.
-
The HW exposure check does not solve Cloud Gaming use cases w3cping/tracking-issues#550, by @w3cbot.
-
Seek privacy-protecting solutions w3cping/tracking-issues#549, by @w3cbot.
-
add section in privacy considerations about issuer w3cping/tracking-issues#548, by @w3cbot.
-
[tt-live-guide-1] Add privacy consideration for identifiers w3cping/tracking-issues#547, by @w3cbot.
-
[tt-live-websocket-carriage] Channel routing example exposes sequence IDs to DNS w3cping/tracking-issues#546, by @w3cbot.
-
Define the intended implementer w3cping/tracking-issues#545, by @w3cbot.
-
Privacy: What information may be revealed? w3cping/tracking-issues#544, by @w3cbot.
-
Be consistent with normative / non-normative sections w3cping/tracking-issues#543, by @w3cbot.
-
Incorrect randomness claim in 50-privacy.md w3cping/tracking-issues#542, by @w3cbot.
-
Adopt either span-id or parent-id for section headings w3cping/tracking-issues#541, by @w3cbot.
-
When headers should be propagated in browsers should be made more clear w3cping/tracking-issues#540, by @w3cbot.
-
Privacy consideration about tracking location w3cping/tracking-issues#539, by @w3cbot.
-
ephemeral fingerprinting w3cping/tracking-issues#538, by @w3cbot.
-
Split security and privacy considerations sections w3cping/tracking-issues#537, by @w3cbot.
-
fingerprinting mitigations for multi-screen window placement w3cping/tracking-issues#536, by @w3cbot.
-
Consider removing nextHopProtocol as it may expose whether visitor is using VPN / proxy w3cping/tracking-issues#535, by @w3cbot.
-
Consider removing wildcard option of the `Timing-Allow-Origin` header to prevent browser history leakage w3cping/tracking-issues#534, by @w3cbot.
-
Consider removing wildcard option of the `Timing-Allow-Origin` header to prevent accidental application state leakage w3cping/tracking-issues#533, by @w3cbot.
-
Tie retries to user browsing behavior for better privacy? w3cping/tracking-issues#532, by @w3cbot.
-
Conflicting advice about switching networks w3cping/tracking-issues#531, by @w3cbot.
-
Reporting API should be opt-in w3cping/tracking-issues#530, by @w3cbot.
-
Report Delivery w3cping/tracking-issues#529, by @w3cbot.
-
Security/privacy considerations w3cping/tracking-issues#528, by @w3cbot.
-
Open Window Algorithm and tracking through 1ps w3cping/tracking-issues#527, by @w3cbot.
-
font enumeration in -core w3cping/tracking-issues#526, by @w3cbot.
-
Privacy section is entirely missing w3cping/tracking-issues#525, by @w3cbot.
-
Repeat fingerprinting analysis assuming a malicious font server w3cping/tracking-issues#524, by @w3cbot.
-
Proposal would allow pages to learn how the user is interacting with the site w3cping/tracking-issues#523, by @w3cbot.
-
define normative privacy mitigation(s) w3cping/tracking-issues#522, by @w3cbot.
-
Background geolocation and user privacy issues w3cping/tracking-issues#521, by @w3cbot.
-
[css-masking-1] The privacy review and suggestion w3cping/tracking-issues#520, by @w3cbot.
-
EPUB and the Browseable Web w3cping/tracking-issues#519, by @w3cbot.
-
Information Exposure and Fingerprintability w3cping/tracking-issues#518, by @w3cbot.
-
Obfuscation w3cping/tracking-issues#517, by @w3cbot.
-
Privacy and DRM w3cping/tracking-issues#516, by @w3cbot.
-
Interactivity w3cping/tracking-issues#515, by @w3cbot.
-
Self-contained Packages w3cping/tracking-issues#514, by @w3cbot.
-
Updated privacy and security sections w3cping/tracking-issues#513, by @w3cbot.
-
privacy concerns need not be tied to privacy laws w3cping/tracking-issues#512, by @w3cbot.
-
Privacy and security changes w3cping/tracking-issues#511, by @w3cbot.
-
"sideloading" and "untrustworthy" references are unclear given lack of authentication and integrity w3cping/tracking-issues#510, by @w3cbot.
-
Exploring cultural expectations re: privacy and security w3cping/tracking-issues#509, by @w3cbot.
-
clarify fingerprinting text; perhaps bring sec/priv text into alignment with template w3cping/tracking-issues#508, by @w3cbot.
-
How to gatekeep the EME "API to find existing sessions"? w3cping/tracking-issues#507, by @w3cbot.
-
capability negotiation, big picture w3cping/tracking-issues#506, by @w3cbot.
-
Spec should document fingerprinting and XSLeak risk w3cping/tracking-issues#505, by @w3cbot.
-
notifying the site of a browser intervention can be user harming w3cping/tracking-issues#504, by @w3cbot.
-
Add sections on User Agent State for Privacy w3cping/tracking-issues#503, by @w3cbot.
-
Fingerprinting Surface w3cping/tracking-issues#502, by @w3cbot.
-
Q: will implementations provide additional builtin functions/structures? w3cping/tracking-issues#501, by @w3cbot.
-
media-playback-while-not-visible Permission Policy w3cping/tracking-issues#500, by @w3cbot.
-
-
220 issues closed.
-
Incorrect randomness claim in 50-privacy.md w3cping/tracking-issues#542.
-
Be consistent with normative / non-normative sections w3cping/tracking-issues#543.
-
Privacy: What information may be revealed? w3cping/tracking-issues#544.
-
Define the intended implementer w3cping/tracking-issues#545.
-
Privacy consideration about tracking location w3cping/tracking-issues#539.
-
When headers should be propagated in browsers should be made more clear w3cping/tracking-issues#540.
-
Adopt either span-id or parent-id for section headings w3cping/tracking-issues#541.
-
fingerprinting mitigations for multi-screen window placement w3cping/tracking-issues#536.
-
Split security and privacy considerations sections w3cping/tracking-issues#537.
-
ephemeral fingerprinting w3cping/tracking-issues#538.
-
Tie retries to user browsing behavior for better privacy? w3cping/tracking-issues#532.
-
Consider removing wildcard option of the `Timing-Allow-Origin` header to prevent browser history leakage w3cping/tracking-issues#534.
-
Consider removing nextHopProtocol as it may expose whether visitor is using VPN / proxy w3cping/tracking-issues#535.
-
Report Delivery w3cping/tracking-issues#529.
-
Reporting API should be opt-in w3cping/tracking-issues#530.
-
Conflicting advice about switching networks w3cping/tracking-issues#531.
-
font enumeration in -core w3cping/tracking-issues#526.
-
Open Window Algorithm and tracking through 1ps w3cping/tracking-issues#527.
-
Security/privacy considerations w3cping/tracking-issues#528.
-
define normative privacy mitigation(s) w3cping/tracking-issues#522.
-
Proposal would allow pages to learn how the user is interacting with the site w3cping/tracking-issues#523.
-
Repeat fingerprinting analysis assuming a malicious font server w3cping/tracking-issues#524.
-
Privacy section is entirely missing w3cping/tracking-issues#525.
-
Background geolocation and user privacy issues w3cping/tracking-issues#521.
-
Add in-line privacy and security considerations to VISS transport w3cping/tracking-issues#595.
-
VISS Core: why is access control non-normative? w3cping/tracking-issues#593.
-
VISS core: what is a pseudo-VIN w3cping/tracking-issues#594.
-
security and privacy check list w3cping/tracking-issues#590.
-
Privacy and security analysis w3cping/tracking-issues#591.
-
Privacy and Security Considerations section review for Personalization Semantics Content w3cping/tracking-issues#592.
-
Add appendix to privacy & security explainer showing table of threat vectors & mitigations w3cping/tracking-issues#587.
-
Add details about generic XRSpace and XRInputSource threats w3cping/tracking-issues#588.
-
security and privacy self review check list w3cping/tracking-issues#589.
-
Correct / real URLs should be enforced, to avoid breaking adblockers w3cping/tracking-issues#586.
-
Should Be Opt-In: Introduces privacy harm with no direct browser-user benefit w3cping/tracking-issues#583.
-
privacy concerns with proposal through inducing network requests w3cping/tracking-issues#584.
-
Isn't this API a privacy issue? w3cping/tracking-issues#585.
-
Cosine similarity between two facial features and cross origin tracking w3cping/tracking-issues#580.
-
Should be Opt-In: Creates privacy harm with little to no upside for Web users w3cping/tracking-issues#581.
-
Should be Opt-In: Creates privacy harm with little to no upside for Web users w3cping/tracking-issues#582.
-
Add AudioRenderCapacity interface and related classes w3cping/tracking-issues#579.
-
Suggested file name and location for the File System Access API. w3cping/tracking-issues#578.
-
Media Session: video conferencing actions w3cping/tracking-issues#575.
-
Managed Device Web API w3cping/tracking-issues#576.
-
Early design review for the FLoC API w3cping/tracking-issues#577.
-
WebID w3cping/tracking-issues#573.
-
Early design review: opaque-blocklisted-never-sniffed MIME types w3cping/tracking-issues#574.
-
Distributed Tracing WG: Baggage specification w3cping/tracking-issues#571.
-
Pickling for Async Clipboard API w3cping/tracking-issues#572.
-
Information Exposure and Fingerprintability w3cping/tracking-issues#518.
-
EPUB and the Browseable Web w3cping/tracking-issues#519.
-
[css-masking-1] The privacy review and suggestion w3cping/tracking-issues#520.
-
Interactivity w3cping/tracking-issues#515.
-
Privacy and DRM w3cping/tracking-issues#516.
-
Obfuscation w3cping/tracking-issues#517.
-
privacy concerns need not be tied to privacy laws w3cping/tracking-issues#512.
-
Updated privacy and security sections w3cping/tracking-issues#513.
-
Self-contained Packages w3cping/tracking-issues#514.
-
"sideloading" and "untrustworthy" references are unclear given lack of authentication and integrity w3cping/tracking-issues#510.
-
Privacy and security changes w3cping/tracking-issues#511.
-
Exploring cultural expectations re: privacy and security w3cping/tracking-issues#509.
-
capability negotiation, big picture w3cping/tracking-issues#506.
-
How to gatekeep the EME "API to find existing sessions"? w3cping/tracking-issues#507.
-
clarify fingerprinting text; perhaps bring sec/priv text into alignment with template w3cping/tracking-issues#508.
-
Add sections on User Agent State for Privacy w3cping/tracking-issues#503.
-
notifying the site of a browser intervention can be user harming w3cping/tracking-issues#504.
-
Spec should document fingerprinting and XSLeak risk w3cping/tracking-issues#505.
-
Q: will implementations provide additional builtin functions/structures? w3cping/tracking-issues#501.
-
Fingerprinting Surface w3cping/tracking-issues#502.
-
WebXR Raw Camera Access API w3cping/tracking-issues#570.
-
Navigation API (formerly app history API) w3cping/tracking-issues#567.
-
HIDDevice forget() w3cping/tracking-issues#568.
-
Auto-expanding details elements w3cping/tracking-issues#569.
-
Review Request for Attribution Reporting API w3cping/tracking-issues#565.
-
Review request for Protected Audience w3cping/tracking-issues#566.
-
Review request for Fenced Frames w3cping/tracking-issues#562.
-
Cookie Expires/Max-Age attribute upper limit w3cping/tracking-issues#563.
-
Early design review for the Topics API w3cping/tracking-issues#564.
-
Moving local files with the File System Access API w3cping/tracking-issues#559.
-
Two changes to Secure Payment Confirmation prior to CR w3cping/tracking-issues#560.
-
Shared Storage API w3cping/tracking-issues#561.
-
powerEfficientEncoder/powerEfficientDecoder w3cping/tracking-issues#556.
-
requestStorageAccessFor w3cping/tracking-issues#557.
-
Storage Access API w3cping/tracking-issues#558.
-
Privacy concern: Leaking communication / plain text using patterns in packet size, frequency, etc. w3cping/tracking-issues#553.
-
The stats API allow hardware fingerprinting (encoder, powerEfficient) w3cping/tracking-issues#554.
-
Codec stats reveal hardware information which could be used for fingerprinting w3cping/tracking-issues#555.
-
The HW exposure check does not solve Cloud Gaming use cases w3cping/tracking-issues#550.
-
Fullscreen shouldn't be enough to reveal fingerprinting-surface w3cping/tracking-issues#551.
-
Add CPU metrics w3cping/tracking-issues#552.
-
add section in privacy considerations about issuer w3cping/tracking-issues#548.
-
Seek privacy-protecting solutions w3cping/tracking-issues#549.
-
[tt-live-websocket-carriage] Channel routing example exposes sequence IDs to DNS w3cping/tracking-issues#546.
-
[tt-live-guide-1] Add privacy consideration for identifiers w3cping/tracking-issues#547.
-
Using getPhotoSettings and takePhoto allows for cross site communication w3cping/tracking-issues#643.
-
getPhotoCapabilities should be marked as adding additional fingerprinting surface w3cping/tracking-issues#644.
-
Make mandatory link between image metadata and page permissions w3cping/tracking-issues#645.
-
Investigate and document the fingerprintability of user media rendering w3cping/tracking-issues#640.
-
Text suggestion and clarification request w3cping/tracking-issues#641.
-
Spec entrenches current privacy harming getUserMedia / enumerateDevices systems w3cping/tracking-issues#642.
-
Exposure of CPU/GPU usage w3cping/tracking-issues#637.
-
The review of privacy w3cping/tracking-issues#638.
-
Deprecate inputDeviceInfo.getCapabilities() for better privacy w3cping/tracking-issues#639.
-
Split security and privacy considerations w3cping/tracking-issues#634.
-
Intentional manipulation of battery status w3cping/tracking-issues#635.
-
Exposing battery status w3cping/tracking-issues#636.
-
Define the error model w3cping/tracking-issues#631.
-
Consider context by reference with metadata w3cping/tracking-issues#632.
-
General approach to capability negotiation w3cping/tracking-issues#633.
-
Define error and add Error and Exception appendix w3cping/tracking-issues#628.
-
Spec needs to define interaction with the web platform w3cping/tracking-issues#629.
-
Privacy and Security section over claims (I think origins can use this functionality to learn about the system) w3cping/tracking-issues#630.
-
How do connection/disconnection events interact with 'device has been interacted with by the user'? w3cping/tracking-issues#625.
-
Security and privacy considerations for DOMHighResTimeStamp resolution w3cping/tracking-issues#626.
-
Privacy review of ARIA in HTML (15th March 2021) w3cping/tracking-issues#627.
-
are timestamps a potential tracking/fingerprinting vector? w3cping/tracking-issues#622.
-
id field in gamepad might have a persistent identifier? w3cping/tracking-issues#623.
-
Clarifications for getGamepads / user activations w3cping/tracking-issues#624.
-
Security / Privacy Questionnaire w3cping/tracking-issues#621.
-
Should the spec require site isolation? w3cping/tracking-issues#693.
-
Timing attack privacy consideration w3cping/tracking-issues#694.
-
Suggestions on improvements for the privacy considerations section w3cping/tracking-issues#695.
-
Split security & privacy considerations w3cping/tracking-issues#689.
-
VideoDecoder API may expose the underlying buffer pool size w3cping/tracking-issues#690.
-
Cite hardware accel privacy mitigation in section 13 w3cping/tracking-issues#691.
-
remove excess 2119 language, e.g. in section 13 w3cping/tracking-issues#692.
-
Privacy considerations re: redundant entry w3cping/tracking-issues#688.
-
Add further fingerprinting considerations w3cping/tracking-issues#686.
-
Security and privacy risks of insecure transport / mixed content. w3cping/tracking-issues#687.
-
Clarify version negotiation or lack thereof w3cping/tracking-issues#685.
-
Editing WG w3cping/tracking-issues#683.
-
Browser Testing and Tools Working Group Charter 2021 w3cping/tracking-issues#684.
-
HTML WG 2021 w3cping/tracking-issues#682.
-
Framebust out of webviews w3cping/tracking-issues#679.
-
Service Workers WG charter 2022 w3cping/tracking-issues#680.
-
Second Screen WG rechartering w3cping/tracking-issues#681.
-
Privacy - identifying parameters w3cping/tracking-issues#676.
-
Javascript 120Hz devicemotion events for high end inertial applications w3cping/tracking-issues#677.
-
Expose sensors to workers w3cping/tracking-issues#678.
-
Spec should include mandatory mitigations for privacy harms / risks w3cping/tracking-issues#673.
-
Access to magnetometer and potential security & privacy issues w3cping/tracking-issues#674.
-
Relation to Permissions API w3cping/tracking-issues#675.
-
add privacy considerations section w3cping/tracking-issues#671.
-
device fingerprinting may also refer to the factory (or other) calibration of the device w3cping/tracking-issues#672.
-
vocabulary fields to enable privacy-respecting use of datasets w3cping/tracking-issues#619.
-
Make note of the fact that the standard gamepad layout is privacy-relevant w3cping/tracking-issues#620.
-
authenticity and integrity of dcat files and associated datasets w3cping/tracking-issues#617.
-
metadata for private queries of a data service w3cping/tracking-issues#618.
-
Device motion sampling frequency w3cping/tracking-issues#616.
-
[css-color-5] Question regarding on deman download of ICC file w3cping/tracking-issues#612.
-
[css-fonts-4] Privacy and I18n issues around user-installed fonts, and user selection of them w3cping/tracking-issues#613.
-
[css-fonts] incorporate mitigations for font based fingerprinting w3cping/tracking-issues#614.
-
Links from sec/priv sections back to normative mitigations? w3cping/tracking-issues#615.
-
security considerations regarding use of platform accessibility apis for accessing user data w3cping/tracking-issues#609.
-
[mediaqueries] Suggestion: "prefers-pointer-location" w3cping/tracking-issues#610.
-
[css-contain-2][inert]: inert and hidden containments should share common logic w3cping/tracking-issues#611.
-
"power-supply" is a fingerprinting vector w3cping/tracking-issues#606.
-
"User notifications" section should be more specific w3cping/tracking-issues#607.
-
describing the privacy threat of disclosure of use of assistive technology w3cping/tracking-issues#608.
-
"first party context" section concerns w3cping/tracking-issues#602.
-
"no side channels" subsection issues w3cping/tracking-issues#603.
-
Feature can be abused to create cross-site covert channels w3cping/tracking-issues#604.
-
Text and clarity issues in the security and privacy considerations section w3cping/tracking-issues#605.
-
Clarify in text the relationship to Trace Context w3cping/tracking-issues#599.
-
private browsing mode: upgrade recommendation w3cping/tracking-issues#600.
-
add more discussion of sec and priv analysis; split sections w3cping/tracking-issues#601.
-
More architectural description w3cping/tracking-issues#596.
-
Make trust/privacy boundary explicit (at least in browsers) w3cping/tracking-issues#597.
-
Relationship to other HTTP Header encoding proposals w3cping/tracking-issues#598.
-
Encrypt SPC Credential Identifiers in authentication flows to increase privacy w3cping/tracking-issues#670.
-
11.3 & 11.4: define the mitigation w3cping/tracking-issues#667.
-
11.2 define the mitigation w3cping/tracking-issues#668.
-
Richer negotiation re: address redaction? w3cping/tracking-issues#664.
-
Consider separating the SPC powers of Third Party invocation and Payment display w3cping/tracking-issues#665.
-
Is it possible for a user to downgrade a credential creation request? w3cping/tracking-issues#666.
-
Spec is silent on its role in facilitating arbitrary communication between top level contexts w3cping/tracking-issues#663.
-
Redundant definition about allowed filenames? w3cping/tracking-issues#660.
-
Section 1.1 requires loading the entire app at once? w3cping/tracking-issues#661.
-
PING Review w3cping/tracking-issues#662.
-
How to validate / verifying app_id? w3cping/tracking-issues#657.
-
Clarify relationship to Web Application Manifest w3cping/tracking-issues#658.
-
Privacy considerations section requires users to manage storage w3cping/tracking-issues#659.
-
Under definition of some properties and elements w3cping/tracking-issues#654.
-
use of of callbacks instead of events w3cping/tracking-issues#655.
-
What are sessions? w3cping/tracking-issues#656.
-
Add 'privacy and security' section w3cping/tracking-issues#651.
-
Beef up privacy and security section with regards to the various risks related to the different surfaces w3cping/tracking-issues#652.
-
Accessibility Considerations text is confusing or incorrect w3cping/tracking-issues#653.
-
Improvements to Privacy & Security Considerations w3cping/tracking-issues#649.
-
Fingerprint surface coming from MediaRecorder-able types - needs consideration? w3cping/tracking-issues#650.
-
Spec should document anticipated differences from v2.0 w3cping/tracking-issues#646.
-
Provide guidance on potential device label sanitization w3cping/tracking-issues#647.
-
PING review w3cping/tracking-issues#648.
-
Disable prompting in third parties w3cping/tracking-issues#720.
-
Should lazy loading be bound to scripting being enabled? w3cping/tracking-issues#717.
-
Mitigate canvas fingerprinting risk w3cping/tracking-issues#718.
-
Add a timezonechange event to Window/WorkerGlobalScope w3cping/tracking-issues#719.
-
Add privacy recommendation to autofill/autocomplete attribute w3cping/tracking-issues#714.
-
Spec should not specify behavior of other specs in Editors Draft status (i.e., Reporting API) w3cping/tracking-issues#715.
-
Consider Spec warning re: Detectability of Assistive Technology w3cping/tracking-issues#716.
-
Add responses to the Self-Review Questionnaire: Security and Privacy w3cping/tracking-issues#712.
-
Privacy/Security considerations section w3cping/tracking-issues#713.
-
Add initial Security and Privacy Considerations sections w3cping/tracking-issues#709.
-
Device selection with MLDevicePreference and MLPowerPreference w3cping/tracking-issues#710.
-
Make WebNN API a policy-controlled feature with default allowlist 'self' w3cping/tracking-issues#711.
-
Privacy considerations for cached/persisted data w3cping/tracking-issues#707.
-
Related WebGPU Security and Privacy Considerations w3cping/tracking-issues#708.
-
Identifiers don't seem to rotate enough w3cping/tracking-issues#704.
-
Limitations on TDs Utilising nosec w3cping/tracking-issues#705.
-
Add privacy considerations for cached/persisted data w3cping/tracking-issues#706.
-
Remove or rephrase sentence around Trusted Networks w3cping/tracking-issues#702.
-
Personal devices and public/private TDDs w3cping/tracking-issues#703.
-
Screen labels seem especially privacy risking and identifying w3cping/tracking-issues#700.
-
isExtended is additional fingerprinting surface w3cping/tracking-issues#701.
-
Add origin clean check on objects that support it. w3cping/tracking-issues#697.
-
Move existing methods of inferring multi-montior support behind permission w3cping/tracking-issues#698.
-
Security considerations section links to non-versioned GH doc w3cping/tracking-issues#699.
-
Output of decoding and encoding bytes are fingerprintable w3cping/tracking-issues#696.
-
-
5 issues reopened.
-
media-playback-while-not-visible Permission Policy w3cping/tracking-issues#500, by @plehegar.
-
IP Protection (in Incognito mode) w3cping/tracking-issues#499, by @plehegar.
-
Reduce Accept-Language w3cping/tracking-issues#497, by @plehegar.
-
Wrong naming of the neq operator w3cping/tracking-issues#496, by @plehegar.
-
[meta][css-fonts-4] Index of local font issues: fingerprinting, I18n, privacy w3cping/tracking-issues#495, by @plehegar.
-
-
1 issue received 2 new comments.
w3c/gpc
-
1 issue opened.
-
Meaning of `lastUpdate` for "strange" dates w3c/gpc#103, by @Schnark.
-
-
3 issues received 6 new comments.
-
w3c/gpc#6 (1 comment by @SebastianZimmeck)
-
1 pull request opened.
-
2 pull requests received 21 new comments.
-
Align all descriptions of GPC to say it's meant to restrict sale and sharing of data. w3c/gpc#102 (1 comment by @jyasskin)
w3c/fingerprinting-guidance
-
1 pull request opened.
-
Reorganize the Best Practices as described in #70 w3c/fingerprinting-guidance#81, by @tomrittervg.
-
-
2 pull requests received 4 new comments.
-
Add references for Ephemeral Fingerprinting w3c/fingerprinting-guidance#74 (3 comments by @jyasskin, @pes10k, @tomrittervg)
-
Expand the section on randomness and update it. w3c/fingerprinting-guidance#76 (1 comment by @tomrittervg)
-
w3c/security-questionnaire
-
1 pull request received 2 new comments.
-
Embed the markdown template into the main questionnaire. w3c/security-questionnaire#191 (2 comments by @jyasskin, @pes10k)
-
w3c/credential-considerations
-
1 pull request opened.
-
Minor updates and fixes w3c/credential-considerations#19, by @RByers.
-
-
1 pull request received 6 new comments.
TR publications
-
3 documents published.
-
Global Privacy Control (GPC) published twice as a Working Draft. History of Global Privacy Control (GPC)
-
Past meetings
-
1 meeting.
GitHub
w3c/gpc
-
1 issue opened.
-
3 issues closed.
-
Private mode/incognito w3c/gpc#34.
-
1 issue received 4 new comments.
-
3 pull requests opened.
-
Clarify scope of GPC w3c/gpc#99, by @j-br0.
-
5 pull requests merged.
-
Rename explainer w3c/gpc#90.
-
Update legal changes as of Feb 2025 w3c/gpc#95.
-
2 pull requests received 5 new comments.
-
Align all descriptions of GPC to say it's meant to restrict sale and sharing of data. w3c/gpc#102 (4 comments by @darobin, @dmarti, @j-br0, @jasonekint)
-
w3c/privacywg
-
2 issues opened.
-
[agenda] 2025-05-15 w3c/privacywg#11, by @npdoty.
-
[agenda] 2025-04-17 w3c/privacywg#10, by @npdoty.
-
-
2 issues closed.
-
[agenda] 2025-04-17 w3c/privacywg#10.
-
[agenda] 2025-04-03 w3c/privacywg#9.
-
-
3 issues received 8 new comments.
w3c/security-questionnaire
-
1 issue closed.
-
"Explainer" in Markdown template is a dead link w3c/security-questionnaire#190.
-
-
1 issue received 1 new comment.
-
There are three active versions of this questionnaire w3c/security-questionnaire#175 (1 comment by @jyasskin)
-
-
1 pull request opened.
-
Embed the markdown template into the main questionnaire. w3c/security-questionnaire#191, by @jyasskin.
-
-
1 pull request merged.
-
Update links now that this repo has moved from the w3ctag org to the w3c org. w3c/security-questionnaire#184.
-
-
3 pull requests received 9 new comments.
-
Update links now that this repo has moved from the w3ctag org to the w3c org. w3c/security-questionnaire#184 (5 comments by @jyasskin, @pes10k, @simoneonofri)
-
Remove the TAG from the groups responsible for this document. w3c/security-questionnaire#185 (3 comments by @jyasskin, @pes10k, @tantek)
-
Embed the markdown template into the main questionnaire. w3c/security-questionnaire#191 (1 comment by @jyasskin)
-
w3cping/privacy-request
-
5 issues opened.
-
Web Authentication 2025-04-24 > 2025-05-25 w3cping/privacy-request#162, by @simoneonofri.
-
[wg/media] Media Working Group Charter w3cping/privacy-request#161, by @w3cbot.
-
[wg/payments] Web Payments Working Group Charter w3cping/privacy-request#160, by @w3cbot.
-
[ig/wai] WAI IG recharter w3cping/privacy-request#159, by @w3cbot.
-
[ig/chinese-web] Chinese Web Interest Group re-charter w3cping/privacy-request#158, by @w3cbot.
-
-
3 issues closed.
-
[ig/wai] WAI IG recharter w3cping/privacy-request#159.
-
Final Review Request of seven (7) W3C VCWG Specifications w3cping/privacy-request#153.
-
[ig/chinese-web] Chinese Web Interest Group re-charter w3cping/privacy-request#158.
-
-
4 issues received 7 new comments.
-
Final Review Request of seven (7) W3C VCWG Specifications w3cping/privacy-request#153 (3 comments by @iherman, @kdenhartog, @npdoty)
-
Web Neural Network API 2025-03-20 > 2025-06-20 w3cping/privacy-request#156 (2 comments by @anssiko, @sandandsnow)
-
[ig/chinese-web] Chinese Web Interest Group re-charter w3cping/privacy-request#158 (1 comment by @plehegar)
-
w3cping/tracking-issues
-
4 issues opened.
-
IP Protection (in Incognito mode) w3cping/tracking-issues#499, by @w3cbot.
-
Define registry inclusion rules w3cping/tracking-issues#498, by @w3cbot.
-
Reduce Accept-Language w3cping/tracking-issues#497, by @w3cbot.
-
Wrong naming of the neq operator w3cping/tracking-issues#496, by @w3cbot.
-
-
10 issues closed.
-
comparison with alternative revocation mechanisms w3cping/tracking-issues#444.
-
describe dummy or decoy entries as a privacy mitigation w3cping/tracking-issues#442.
-
status list index randomization requirement w3cping/tracking-issues#443.
-
when revocation status is and isn't appropriate to present w3cping/tracking-issues#445.
-
information revealed by status updates w3cping/tracking-issues#446.
-
anonymizing proxy rather than CDN as a privacy mitigation w3cping/tracking-issues#447.
-
caching status lists as a mitigation for identifying when the holder visited a verifier w3cping/tracking-issues#448.
-
mitigations for risk of unique status lists w3cping/tracking-issues#449.
-
status list index is a persistent cross-origin identifier w3cping/tracking-issues#450.
-
Define registry inclusion rules w3cping/tracking-issues#498.
-
-
6 issues received 6 new comments.
-
w3cping/tracking-issues#444 (1 comment by @npdoty)
-
w3cping/tracking-issues#442 (1 comment by @npdoty)
-
w3cping/tracking-issues#446 (1 comment by @npdoty)
-
w3cping/tracking-issues#449 (1 comment by @npdoty)
-
w3cping/tracking-issues#450 (1 comment by @npdoty)
-
w3c/fingerprinting-guidance
-
2 pull requests received 4 new comments.
-
Add references for Ephemeral Fingerprinting w3c/fingerprinting-guidance#74 (3 comments by @AramZS, @bvandersloot-mozilla, @tomrittervg)
-
Expand the section on randomness and update it. w3c/fingerprinting-guidance#76 (1 comment by @tomrittervg)
-
TR publications
-
3 documents published.
-
Global Privacy Control (GPC) published as a Working Draft. History of Global Privacy Control (GPC)
-
Past meetings
-
1 meeting.
Participants
-
1 participant joined.
-
Kester Quist-Aphetsi (CRITAC) joined.
-
-
1 organization joined.
-
CRITAC joined.
-
GitHub
w3c/fingerprinting-guidance
-
1 issue closed.
-
Wordsmithing for 2025 w3c/fingerprinting-guidance#68.
-
-
4 pull requests opened.
-
Add missing w3cid w3c/fingerprinting-guidance#80, by @plehegar.
-
add Tom Ritter as editor w3c/fingerprinting-guidance#79, by @npdoty.
-
Include link to fingerprinting guidance publication decision w3c/fingerprinting-guidance#78, by @plehegar.
-
Various fixes for publication w3c/fingerprinting-guidance#77, by @plehegar.
-
-
6 pull requests merged.
-
Wordsmithing for 2025 w3c/fingerprinting-guidance#69.
-
Add missing w3cid w3c/fingerprinting-guidance#80.
-
add Tom Ritter as editor w3c/fingerprinting-guidance#79.
-
Enable PR-Preview w3c/fingerprinting-guidance#75.
-
Various fixes for publication w3c/fingerprinting-guidance#77.
-
Include link to fingerprinting guidance publication decision w3c/fingerprinting-guidance#78.
-
-
2 pull requests closed.
-
Adjust the metadata from PING->Privacy WG w3c/fingerprinting-guidance#67.
-
Remove reference to browser.display.max_font w3c/fingerprinting-guidance#55.
-
-
6 pull requests received 11 new comments.
-
Add references for Ephemeral Fingerprinting w3c/fingerprinting-guidance#74 (4 comments by @jyasskin, @pes10k, @tomrittervg)
-
Adjust the metadata from PING->Privacy WG w3c/fingerprinting-guidance#67 (3 comments by @jyasskin, @npdoty)
-
Expand the section on randomness and update it. w3c/fingerprinting-guidance#76 (1 comment by @pes10k)
-
w3c/fingerprinting-guidance#55 (1 comment by @npdoty)
-
w3cping/privacy-request
-
3 issues opened.
-
[ig/chinese-web] Chinese Web Interest Group re-charter w3cping/privacy-request#157, by @w3cbot.
-
Web Neural Network API 2025-03-20 > 2025-06-20 w3cping/privacy-request#156, by @anssiko.
-
[wg/distributed-tracing] Distributed Tracing Working Group Charter w3cping/privacy-request#155, by @w3cbot.
-
-
1 issue closed.
-
[wg/distributed-tracing] Distributed Tracing Working Group Charter w3cping/privacy-request#155.
-
-
3 issues received 3 new comments.
-
[ig/chinese-web] Chinese Web Interest Group re-charter w3cping/privacy-request#157 (1 comment by @pes10k)
-
[wg/distributed-tracing] Distributed Tracing Working Group Charter w3cping/privacy-request#155 (1 comment by @pes10k)
-
Playout Statistics API for WebAudio 2025-01-31 > 2025-03-01 w3cping/privacy-request#154 (1 comment by @Hernqvist)
-
w3c/credential-considerations
-
1 issue opened.
-
terminology: alternatives to "real-world identity" w3c/credential-considerations#15, by @npdoty.
-
-
3 issues closed.
-
describe additional issuer risks w3c/credential-considerations#14.
-
Note concerns around naive "real name" policies and their potential increase in use w3c/credential-considerations#13.
-
Consider the addition of a 2-factor authentication method w3c/credential-considerations#11.
-
-
1 issue received 1 new comment.
-
terminology: alternatives to "real-world identity" w3c/credential-considerations#15 (1 comment by @kdenhartog)
-
-
3 pull requests opened.
-
requirements for friction including second-factor or other confirmation w3c/credential-considerations#18, by @npdoty.
-
explain risk of credentials use for real names policies and potential harms w3c/credential-considerations#17, by @npdoty.
-
add risks of government issuer misrepresenting or altering w3c/credential-considerations#16, by @npdoty.
-
-
3 pull requests merged.
-
add risks of government issuer misrepresenting or altering w3c/credential-considerations#16.
-
explain risk of credentials use for real names policies and potential harms w3c/credential-considerations#17.
-
requirements for friction including second-factor or other confirmation w3c/credential-considerations#18.
-
-
1 pull request received 3 new comments.
-
explain risk of credentials use for real names policies and potential harms w3c/credential-considerations#17 (3 comments by @bvandersloot-mozilla, @kdenhartog, @npdoty)
-
w3c/privacywg
-
1 issue opened.
-
[agenda] 2025-04-03 w3c/privacywg#9, by @npdoty.
-
-
1 issue closed.
-
[agenda] 2025-03-20 w3c/privacywg#8.
-
-
2 issues received 5 new comments.
w3c/security-questionnaire
-
1 issue opened.
-
"Explainer" in Markdown template is a dead link w3c/security-questionnaire#190, by @emlun.
-
w3c/gpc
-
1 pull request merged.
-
Enable PR Preview w3c/gpc#91.
-
-
1 pull request received 1 new comment.
w3cping/tracking-issues
-
8 issues closed.
-
[css-color-5] Question regarding on deman download of ICC file w3cping/tracking-issues#327.
-
Highlight security/privacy trade-offs between RDF-CANON and JCS w3cping/tracking-issues#409.
-
"User notifications" section should be more specific w3cping/tracking-issues#370.
-
Feature can be abused to create cross-site covert channels w3cping/tracking-issues#367.
-
Text and clarity issues in the security and privacy considerations section w3cping/tracking-issues#368.
-
"no side channels" subsection issues w3cping/tracking-issues#376.
-
Specify what kind of attacks are considered and addressed w3cping/tracking-issues#377.
-
"power-supply" is a fingerprinting vector w3cping/tracking-issues#369.
-
TR publications
-
1 document published.
Past meetings
Participants
-
1 organization joined.
-
IAB Technology Laboratory, Inc. joined.
-
GitHub
w3c/credential-considerations
-
1 issue opened.
-
describe additional issuer risks w3c/credential-considerations#14, by @npdoty.
-
-
1 issue received 1 new comment.
w3c/privacywg
-
3 issues opened.
-
[agenda] 2025-03-20 w3c/privacywg#8, by @npdoty.
-
[agenda] 2025 - next w3c/privacywg#7, by @npdoty.
-
[agenda] 2025-02-06 w3c/privacywg#6, by @npdoty.
-
-
3 issues closed.
-
[agenda] 2025 - next w3c/privacywg#7.
-
[agenda] 2025-02-06 w3c/privacywg#6.
-
[agenda] 2025-01-16 w3c/privacywg#5.
-
-
3 issues received 8 new comments.
w3cping/tracking-issues
-
3 issues opened.
-
[meta][css-fonts-4] Index of local font issues: fingerprinting, I18n, privacy w3cping/tracking-issues#495, by @w3cbot.
-
Bug w3cping/tracking-issues#494, by @jaybobbow.
-
[css-fonts-4] Detection-prevention approach to the local font privacy issue w3cping/tracking-issues#493, by @w3cbot.
-
-
1 issue closed.
-
Bug w3cping/tracking-issues#494.
-
w3c/gpc
-
1 issue opened.
-
Account locked and leaked w3c/gpc#97, by @mendezmichellemarie1266.
-
-
1 issue closed.
-
Account locked and leaked w3c/gpc#97.
-
-
1 issue received 1 new comment.
-
w3c/gpc#34 (1 comment by @j-br0)
-
-
3 pull requests opened.
-
Consolidate US legal info w3c/gpc#98, by @chrisn.
-
Update legal changes as of Feb 2025 w3c/gpc#95, by @j-br0.
-
-
1 pull request received 1 new comment.
w3cping/privacy-request
-
1 issue closed.
-
WebRTC API 2024-10-12 > 2025-01-31 w3cping/privacy-request#152.
-
-
2 issues received 4 new comments.
-
WebRTC API 2024-10-12 > 2025-01-31 w3cping/privacy-request#152 (2 comments by @lolaodelola, @plehegar)
-
Playout Statistics API for WebAudio 2025-01-31 > 2025-03-01 w3cping/privacy-request#154 (2 comments by @Hernqvist, @tomrittervg)
-
w3c/fingerprinting-guidance
-
2 pull requests opened.
-
Expand the section on randomness and update it. w3c/fingerprinting-guidance#76, by @tomrittervg.
-
Enable PR-Preview w3c/fingerprinting-guidance#75, by @jyasskin.
-
-
2 pull requests received 14 new comments.
-
Add references for Ephemeral Fingerprinting w3c/fingerprinting-guidance#74 (8 comments by @jyasskin, @mikewest, @tomrittervg)
-
w3c/security-questionnaire
-
1 pull request opened.
-
Add Simone as an editor from SING w3c/security-questionnaire#189, by @simoneonofri.
-
-
1 pull request merged.
-
Add Simone as an editor from SING w3c/security-questionnaire#189.
-
-
1 pull request received 1 new comment.
w3c/privacy-considerations
-
1 issue received 1 new comment.
-
w3c/privacy-considerations#4 (1 comment by @npdoty)
-
-
1 pull request opened.
-
work has stopped on this unofficial draft w3c/privacy-considerations#5, by @npdoty.
-
-
1 pull request received 2 new comments.
TR publications
-
4 documents published.
-
Global Privacy Control (GPC) published twice as a Working Draft. History of Global Privacy Control (GPC)
-
Self-Review Questionnaire: Security and Privacy published twice as a Note. History of Self-Review Questionnaire: Security and Privacy
-
Past meetings
Participants
-
5 participants joined.
-
Stalgia Grigg (Bocoup) joined.
-
Chris Cuellar (Bocoup) joined.
-
Andrew Liu (Google LLC) joined.
-
Johann Hofmann (Google LLC) joined.
-
Lola Odelola (W3C Invited Experts) joined.
-
-
1 participant left.
-
Benjamin Goering (Protocol Labs) left.
-
-
1 organization joined.
-
Bocoup joined.
-
-
1 organization left.
-
Protocol Labs left.
-
GitHub
w3cping/privacy-request
-
1 issue opened.
-
Playout Statistics API for WebAudio 2025-01-31 > 2025-03-01 w3cping/privacy-request#154, by @Hernqvist.
-
-
1 issue received 1 new comment.
w3c/security-questionnaire
-
1 issue opened.
-
Improving: Does this specification have both "Security Considerations" and "Privacy Considerations" sections? w3c/security-questionnaire#181, by @simoneonofri.
-
-
2 issues closed.
-
Example 10 is not supported by referenced article w3c/security-questionnaire#174.
-
Questionnaire markdown file is not actually convenient w3c/security-questionnaire#172.
-
-
2 issues received 3 new comments.
-
Improving: Does this specification have both "Security Considerations" and "Privacy Considerations" sections? w3c/security-questionnaire#181 (2 comments by @jyasskin, @simoneonofri)
-
There are three active versions of this questionnaire w3c/security-questionnaire#175 (1 comment by @jyasskin)
-
-
7 pull requests opened.
-
Minor tweaks w3c/security-questionnaire#188, by @plehegar.
-
Update w3c.json with Security w3c/security-questionnaire#186, by @simoneonofri.
-
Remove the TAG from the groups responsible for this document. w3c/security-questionnaire#185, by @jyasskin.
-
Update links now that this repo has moved from the w3ctag org to the w3c org. w3c/security-questionnaire#184, by @jyasskin.
-
Update references from PING to the Privacy WG. w3c/security-questionnaire#183, by @jyasskin.
-
Update the boilerplate to try to pass Pubrules. w3c/security-questionnaire#182, by @jyasskin.
-
Add the Security Interest Group to the list of groups jointly responsible for this document. w3c/security-questionnaire#180, by @hober.
-
-
11 pull requests merged.
-
Minor tweaks w3c/security-questionnaire#188.
-
Update w3c.json with Security w3c/security-questionnaire#186.
-
Update references from PING to the Privacy WG. w3c/security-questionnaire#183.
-
Link to Lukasz' specific analysis on visited links. w3c/security-questionnaire#178.
-
Copy-edit the AT section. w3c/security-questionnaire#168.
-
Fix uses of "effect" that should "affect" things. w3c/security-questionnaire#167.
-
Update the boilerplate to try to pass Pubrules. w3c/security-questionnaire#182.
-
Add the Security Interest Group to the list of groups jointly responsible for this document. w3c/security-questionnaire#180.
-
Add `class=question` to a header so it's included in questionnaire.markdown. w3c/security-questionnaire#176.
-
Don't describe this document as having conformance requirements, using the RFC2119 keywords, or having algorithms. w3c/security-questionnaire#170.
-
Make questionnaire.markdown convenient for copying into an explainer. w3c/security-questionnaire#177.
-
-
3 pull requests received 4 new comments.
-
Add the Security Interest Group to the list of groups jointly responsible for this document. w3c/security-questionnaire#180 (2 comments by @hober, @jyasskin)
-
Update references from PING to the Privacy WG. w3c/security-questionnaire#183 (1 comment by @npdoty)
-
Update the boilerplate to try to pass Pubrules. w3c/security-questionnaire#182 (1 comment by @jyasskin)
-
w3c/fingerprinting-guidance
-
4 issues opened.
-
detail different levels of availability, including user gesture/iteraction where helpful w3c/fingerprinting-guidance#73, by @npdoty.
-
[Accept-CH] is a relatively new approach; we're still evaluating - are done evaluating? w3c/fingerprinting-guidance#71, by @tomrittervg.
-
Adjust the organization of BPs and split one into two. w3c/fingerprinting-guidance#70, by @tomrittervg.
-
Wordsmithing for 2025 w3c/fingerprinting-guidance#68, by @tomrittervg.
-
-
2 issues closed.
-
"Availability", not "accessibility" w3c/fingerprinting-guidance#48.
-
broken link to Chromium documentation page w3c/fingerprinting-guidance#57.
-
-
6 issues received 7 new comments.
-
w3c/fingerprinting-guidance#44 (1 comment by @tomrittervg)
-
detail different levels of availability, including user gesture/iteraction where helpful w3c/fingerprinting-guidance#73 (1 comment by @tomrittervg)
-
w3c/fingerprinting-guidance#64 (1 comment by @tomrittervg)
-
w3c/fingerprinting-guidance#43 (1 comment by @tomrittervg)
-
w3c/fingerprinting-guidance#40 (1 comment by @tomrittervg)
-
5 pull requests opened.
-
Add references for Ephemeral Fingerprinting w3c/fingerprinting-guidance#74, by @tomrittervg.
-
Respec upgrade w3c/fingerprinting-guidance#72, by @plehegar.
-
Wordsmithing for 2025 w3c/fingerprinting-guidance#69, by @tomrittervg.
-
Adjust the metadata from PING->Privacy WG w3c/fingerprinting-guidance#67, by @jyasskin.
-
Fix link to Chromium's analysis. w3c/fingerprinting-guidance#66, by @mikewest.
-
-
3 pull requests merged.
-
Respec upgrade w3c/fingerprinting-guidance#72.
-
Set up auto-publish w3c/fingerprinting-guidance#49.
-
Fix link to Chromium's analysis. w3c/fingerprinting-guidance#66.
-
-
4 pull requests received 10 new comments.
-
w3c/fingerprinting-guidance#49 (4 comments by @jyasskin)
-
Add references for Ephemeral Fingerprinting w3c/fingerprinting-guidance#74 (2 comments by @mikewest)
-
w3c/gpc
-
3 issues opened.
-
Consistency in use of sell/share/track/target terminology w3c/gpc#94, by @j-br0.
-
Change phrasing of legal interpretation for EU/GDPR w3c/gpc#93, by @coolharsh55.
-
-
4 issues closed.
-
Add privacy and security considerations sections w3c/gpc#84.
-
Create consumer-facing GPC instructions w3c/gpc#63.
-
Move laws to Explainer w3c/gpc#73.
-
-
7 issues received 13 new comments.
-
Is the user's request actually "except as permitted by law"? w3c/gpc#92 (7 comments by @bvandersloot-mozilla, @coolharsh55, @j-br0, @jyasskin, @mnot)
-
w3c/gpc#80 (1 comment by @coolharsh55)
-
w3c/gpc#34 (1 comment by @j-br0)
-
w3c/gpc#63 (1 comment by @j-br0)
-
w3c/gpc#73 (1 comment by @j-br0)
-
Clarify that GPC signal does not legitimize cross-site tracking as default web condition w3c/gpc#82 (1 comment by @j-br0)
-
-
3 pull requests opened.
-
Enable PR Preview w3c/gpc#91, by @jyasskin.
-
Rename explainer w3c/gpc#90, by @j-br0.
-
Issue 84 privacy and security considerations w3c/gpc#89, by @SebastianZimmeck.
-
-
2 pull requests merged.
-
Issue 84 privacy and security considerations w3c/gpc#89.
-
-
1 pull request closed.
-
Fix inline `navigator` to use `<code>` w3c/gpc#86.
-
-
3 pull requests received 14 new comments.
-
Update Explainer to add new 6.4 (Consent to Track Notwithstanding a Universal GPC Signal) w3c/gpc#88 (12 comments by @j-br0, @jyasskin, @michaelkleber)
-
w3c/privacywg
-
1 issue opened.
-
[agenda] 2025-01-16 w3c/privacywg#5, by @npdoty.
-
-
1 issue closed.
-
[agenda] 2024-12-19 w3c/privacywg#4.
-
-
2 issues received 5 new comments.