Thread · 5 tweets · 23 Apr 2020

There is a proposal on the table for "First-Party Sets", or the ability to treat disparate domain properties as a single first-party, but what I would like to see is the opposite: First-Party Splits, or the ability for users to prevent reuse across services of a same domain. 🧵

The use case is this: some services are offered under a single domain's umbrella, but from a user's standpoint they are distinct and data sharing between them is a violation of privacy taht should therefore be strictly controlled, ideally prescribed. To give an example:

You don't want to be targeted with sweet tooth recipes on cooking.nytimes.com because you solved a candy-themed crossword exceptionally fast on crosswords.nytimes.com. (Note: believe it or not this example is fictitious. It may, however, resemble real-world cases.)

The hard part is: how do we make this work knowing that the first parties in question might not collaborate (otherwise they would simply not do it)? Part of the answer is that you need policy to back this with teeth. The GDPR helps here with purpose limitations.

But beyond policy I find it hard to support this with tech. Browsers could membrane off various parts of the same site but that feels limited. Is this anyone has given thought to?