Thread · 2 tweets · 28 Jan 2021

The spec is deliberately staying a step back from legal prescription because that's something to be done in partnership with regulators. There are ongoing conversations which I find encouraging, happy to talk with more people if you have specific ideas in mind!

But basically the logic is that the browser is conveying the expression of rights matching sole controllership of the first party as equivalent to preventing sale in CCPA. So if data is shared to 3P controllers under consent, then withdraw, if under LI (or PI), then object.