diff --git a/index.html b/index.html index 1313629..080e640 100644 --- a/index.html +++ b/index.html @@ -110,12 +110,12 @@
Building websites today often involves relying on services provided by businesses other than - the one with which a person choses to interact. This result is a natural consequence of the + the one with which a person choses to interact. This result is a consequence of the increasing complexity of Web technology and of the division of labor between different services. While this architecture can be used in the service of better Web experiences, it can also be abused to violate privacy ([[?privacy-principles]]). While data can be shared - with service providers for limited operational purposes, it can also be shared with third - parties or used for behavioral targeting in ways that many users find objectionable. + with service providers for limited operational purposes, it can also be shared or used for + behavioral targeting in ways that many users find objectionable.
Several different legal frameworks have been proposed or enacted by jurisdictions around @@ -127,31 +127,25 @@
-- Given the ease and frequency by which personal information is collected and sold when a - consumer visits a website, consumers should have a similarly easy ability to request to - opt-out globally. This regulation offers consumers a global choice to opt-out of the sale - of personal information, as opposed to going website by website to make individual - requests with each business each time they use a new browser or a new device. - [[?CCPA-AG-FINAL-STATEMENT]] -
-
This specification is designed for this last category of laws and addresses the problem of the difficulty of scaling user choices by providing a way to universally signal to all website publishers, through an HTTP header or the DOM, a person's assertion of their applicable rights to prevent the sale of their data, - the sharing of their data with third parties, and the use of their data for cross-site targeted + the sharing of their data with third parties, and the use of their data for cross-context targeted advertising. This signal allows users to take advantage of specific provisions in some of these opt-out based laws, such as, for example, the provisions relating to "opt out preferences - signals" in the California Consumer Privacy Act. [[?CCPA-REGULATIONS]]. + signals" in the California Consumer Privacy Act to stop the sale of sharing of personal information, + [[?CCPA-REGULATIONS]], or similar provisions for "universal opt-out mechanisms" in laws in Colorado + and other states to allow users to opt out of the sale of their information or its use for + cross-organization targeted advertising.
The specification should not be interpreted as an endorsement of the opt-out model of - regulation — or cross-site tracking more broadly — or a rejecion of other models based on + regulation — or of cross-context tracking more broadly — or a rejecion of other models based on consent or data minimization. It is instead designed to make it possible to exercise the affirmative rights granted to users in certain jurisdictions.
@@ -161,7 +155,7 @@A do-not-sell-or-share interaction is an interaction with a website in which the person is requesting that their data not be sold to or shared with any party other than the - one the person intends to interact with, or to have their data used for cross-site ad targeting, + one the person intends to interact with, or to have their data used for cross-context ad targeting, except as permitted by law.
@@ -195,7 +189,7 @@
- User agents are expected to convey person [=preferences=] as accurately as they can. User + User agents are expected to convey a person's [=preferences=] as accurately as they can. User agents SHOULD strive to represent what the user agent best believes to be the person's [=preference=] for the Global Privacy Control value.
@@ -412,7 +406,7 @@Other US state privacy laws, such as those in Virginia and Utah, give consumers new opt-out - rights around data sales and targeted advertising but are silent on the legal effect of - global opt-out signals. Regulators enforcing those statutes may determine that a user + rights around data sales and cross-organization targeted advertising but are silent on the legal + effect of global opt-out signals. Regulators enforcing those statutes may determine that a user activating a signal such as GPC may be sufficient to legally exercise opt-out rights in those jurisdictions.
@@ -454,10 +448,10 @@User agents SHOULD strive to represent what the user agent best believes to be the person's - preference for the Global Privacy Control value. While studies have shown that people do not + preference for the Global Privacy Control value. While studies have shown that most people do not want their data sold or shared, some jurisdictions have enacted "opt-out" legal frameworks where consumers have to take an affirmative action to express a [=preference=] to limit data - sharing of the use of their data for targeted advertising. + sharing of the use of their data for cross-organization targeted advertising.
Different jurisdictions have different prerequisites before a platform can enable a universal