Thread · 4 tweets · 29 Apr 2021

If your argument is that 1P/3P isn't the best implementation of privacy, then that's IMHO pretty clear. The problem is: what can be automated by the browser? We can make a typology: • 1P being one context, doing context inappropriate things. Bad, but browser can't tell.

• 1P being several contexts and sharing data across those (eg. G). Almost always bad, browser can't tell. • 1P/1 ctx, using 3P that can reuse data independently. Bad, the browser can tell. • 1P/1ctx using 3P only for 1P. Likely OK, but browser can't tell apart from previous.

• User agent collecting data as if it were 1P. Always bad, but the entity supposed to protect you isn't. The question is: can we fix that at the tech level? Some of it but not without policy support. Distinguishing the 3P cases could be done with a header (and the 1st blocked).

But it's easier to fix with policy: just outlaw transferring data unless there is a consent *for that specific transmission* (and not permanently, as with the GDPR nonsense). The UA is also a relatively easy policy fix. The 1P multicontext one is harder, I'm looking for ideas.