search

w3c-fedid / FedCM

A privacy preserving identity exchange Web API
https://w3c-fedid.github.io/FedCM/
Other
375 stars 72 forks source link

FedCM and GDPR regulations #533

Closed dusekjan closed 9 months ago

dusekjan commented 9 months ago

Hello, As identity providers, we must comply with the GDPR regulations within the European Union. We have already started experimenting with FedCM in development and I would like to ask if it will be possible to change or extend the list of user data (inside the disclosure text) that we as identity providers submit to the RP once the dialogue with FedCM has been agreed.

The problem is that we have to show the user in the FedCM dialog all his user data that we want to pass to the RP after clicking on "Continue as...".

Currently the disclosure text is as follows:

To continue, idp.com will share your name, email address, and profile picture with this site. See ...

In addition to the name, email, profile picture, we would need to append information about providing other data, for example whether the person is an adult or not. However, it would be best if we had full control over the user data displayed, ideally sending a list of all items in some HTTP response.

npm1 commented 9 months ago

This seems related to https://github.com/fedidcg/FedCM/issues/477. With that proposal, IDP can request custom scopes and the use a continue_on URL to display what they want to the user before providing the token to the RP. Does that seem like it would solve your use case?

dusekjan commented 9 months ago

Thanks for the reply.

Does that seem like it would solve your use case?

yes, it seems to me that this would solve the problem.

This seems related to https://github.com/fedidcg/FedCM/issues/477.

I'll keep an eye on the news within this Issue, and when this new feature makes it into the documentation, I'll implement it.