User Consent - Revision history

Tom: /* Context */

2024-12-05T22:21:21Z

‎Context

Tom: /* Consent Page */

2024-12-05T22:18:39Z

‎Consent Page

Tom: /* Problem */

2024-02-09T01:43:33Z

‎Problem

Tom: /* Problem */

2024-02-09T01:41:57Z

‎Problem

Tom: /* Other Sources */

2022-02-01T22:40:45Z

‎Other Sources

Tom: /* References */

2021-08-26T18:24:34Z

‎References

Tom: /* Consent Taxonomy */

2021-03-18T01:48:16Z

‎Consent Taxonomy

Tom at 21:47, 14 April 2019

2019-04-14T21:47:13Z

Tom: /* Other Sources */

2019-04-14T21:42:10Z

‎Other Sources

Tom at 23:43, 8 April 2019

2019-04-08T23:43:55Z

@@ Line 3: / Line 3: @@
 ==Context==
 *This page is about the use case of a [[User]] on a [[User Agent]] authenticated by an [[Identifier or Attribute Provider]] (IAP) that requests [[User Consent]] to [[Authorization|Authorize]] release of [[User Private Information]] and other [[Resource]]s to a [[Relying Party]] (RP).
 *This page does not consider [[User Public Information]] or the [[Right to be Forgotten]].

@@ Line 16: / Line 16: @@
 ===Consent Page===
-In order for the user to grant consent, a consent page must be provided by the [[Identifier or Attribute Provider]].
+In order for the user to grant consent, a consent page must be provided by the [[Identifier or Attribute Provider]] for [[OpenID Connect]] solutions.
 *A consent page normally renders the display name of the current user, the display name of the [[Relying Party]] (aka client) requesting access, the logo of the client, a link for more information about the client, and the list of resources the client is requesting access to. It’s also common to allow the user to indicate that their consent should be “remembered” so they are not prompted again in the future for the same client.
 *Once the user has provided consent, the consent page must inform [[Identifier or Attribute Provider]] of the consent, and then the browser must be redirected back to allow the user to continue where they left off.
 *The user's choice may be stored for later use by the same [[Web Site]] if the user opts into that option. If the user does not opt in, the choice as to scopes, date and destination MUST not be saved.
 ===Back at the Relying Party===

@@ Line 10: / Line 10: @@
 ==Problem==
 * User consent is discussed in the [[GDPR]] for transfers of [[User Information]] between two [[Data Controller]]s on the internet. It is not clear if the [[GDPR]] or other regulations apply to a site that collects user data for its own purposes and does not further process or share that [[User Information]]. Nor is any temporal relationship between [[User Consent]] acts described. So it is not clear if a new [[User Consent]] arrives, what action should be taken vis-a-vis any prior consents. If older consents are not invalidated, it is unclear how to evaluate conflict between the different consents.
-* There is an economic incentive for web sites to give user's a choice, but to pre-select the choice with a box that is checked and then the user is required to "opt-out" by clicking the box to "un-check" it.<ref>Lennart Kraft _2, ''Economic Impact of Opt-in versus Opt-out Requirements for Personal Data Usage: The Case of Apple’s App Tracking Transparency (ATT)'' (2023-10-10) https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4598472</ref>
+* There is an economic incentive for web sites to give user's a choice, but to pre-select the choice with a box that is checked and then the user is required to "opt-out" by clicking the box to "un-check" it.<ref>Lennart Kraft _2, ''Economic Impact of Opt-in versus Opt-out Requirements for Personal Data Usage: The Case of Apple’s App Tracking Transparency (ATT)'' (2023-10-10) https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4598472</ref> In the example cited "ATT reduced the share of trackable (versus untrackable) Apple traffic in the United States by 55 percentage points, from 73% to 18%."
 ==Solution==

@@ Line 9: / Line 9: @@
 ==Problem==
-User consent is discussed in the [[GDPR]] for transfers of [[User Information]] between two [[Data Controller]]s on the internet. It is not clear if the [[GDPR]] or other regulations apply to a site that collects user data for its own purposes and does not further process or share that [[User Information]]. Nor is any temporal relationship between [[User Consent]] acts described. So it is not clear if a new [[User Consent]] arrives, what action should be taken vis a vis any prior consents. If older consents are not invalidated, it is unclear how to evaluate conflict between the different consents.
+* User consent is discussed in the [[GDPR]] for transfers of [[User Information]] between two [[Data Controller]]s on the internet. It is not clear if the [[GDPR]] or other regulations apply to a site that collects user data for its own purposes and does not further process or share that [[User Information]]. Nor is any temporal relationship between [[User Consent]] acts described. So it is not clear if a new [[User Consent]] arrives, what action should be taken vis-a-vis any prior consents. If older consents are not invalidated, it is unclear how to evaluate conflict between the different consents.
 ==Solution==

@@ Line 60: / Line 60: @@
 [[Category:Glossary]]
 [[Category:Privacy]]
-[[Category:Consent]]
+[[Category: User Experience]]
-[[Category:Use Case]]
+[[Category: Consent]]

@@ Line 52: / Line 52: @@
 <references />
 ===Other Sources===
 *See the [http://hl7.org/fhir/secpriv-module.html FHIR section on security and privacy] for the HL7 take on privacy consent.
 *[https://www.priv.gc.ca/en/privacy-topics/collecting-personal-information/consent/gl_omc_201805/ Guidelines for obtaining meaningful consent] from Office of the Privacy Commissioner of Canada which began to apply these guidelines on January 1, 2019.

@@ Line 47: / Line 47: @@
 |user device location||-||4||request for location of device used for this interaction (note that IP addresses leak a fairly good approximation of this)
 |}
 ==References==

← Older revision		Revision as of 21:42, 14 April 2019
Line 58:		Line 58:
	[[Category:Privacy]]		[[Category:Privacy]]
	[[Category:Consent]]		[[Category:Consent]]
		+	[[Category:Use Case]]