search

w3ctag / privacy-principles

https://w3ctag.github.io/privacy-principles/
Other
44 stars 13 forks source link

Reconcile browser funding with Loyalty #414

Closed jyasskin closed 3 months ago

jyasskin commented 4 months ago

The Duty of Loyalty states that

When a user agent carries out processing that is detrimental to its user's interests and instead benefits another actor, this is disloyal.

This seems to be in conflict with certain funding models for browsers. Imagine that some cloud provider wants to sell encrypted computation capacity without building more data centers, so they offer to pay a browser company to run on the browser's users' machines. Even if users are fully informed and agree to pay this way before downloading the browser, this processing still seems to violate our description of the Duty of Loyalty, since the ongoing processing spends the user's resources but benefits the browser and the cloud provider.

This way of paying for a browser seems reasonable, so we should find a way to tweak the Duties so that it's allowed.

chrisn commented 4 months ago

I don't think we should necessarily change anything in the document. It already recognises that there are tradeoffs, but that doesn't mean the Duty of Loyalty itself should be relaxed.

jyasskin commented 3 months ago

We discussed this in today's meeting with the conclusion that the intentional and voluntary exchange of processing for browser use isn't detrimental to a user's interests, and that one shouldn't read the Duty of Loyalty as looking at only the half of the exchange in which the user gives something up. That is, this isn't a situation where another goal has to be balanced against the Duty of Loyalty, it's just not a violation of that duty.

However, folks also didn't want to spend as many words as it would take to spell that out, so we're going to resolve this without changing the document. I think folks would probably be willing to take a PR that didn't increase the size of the document, if someone comes up with one.