Skip to content

Split privacy and security into separate sections #2686

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mjwilson-google merged 1 commit into from
Jul 21, 2026
Merged

Split privacy and security into separate sections #2686

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion expected-errs.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,5 +5,4 @@ LINE: Can't find the 'destinationNode' argument of method 'AudioNode/disconnect(
LINE: Can't find the 'destinationNode' argument of method 'AudioNode/disconnect(destinationParam, output)' in the argumentdef block.
LINE: Can't find the 'destinationNode' argument of method 'AudioNode/disconnect(destinationParam, output)' in the argumentdef block.
LINE: Can't find the 'input' argument of method 'AudioNode/disconnect(destinationParam, output)' in the argumentdef block.
LINE: W3C policy requires Privacy Considerations and Security Considerations to be separate sections, but you appear to have them combined into one.
✔ Successfully generated, but fatal errors were suppressed
89 changes: 47 additions & 42 deletions index.bs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13387,10 +13387,10 @@ time-constraints. It can also be caused by the audio DSP trying to do
more work than is possible in real-time given the CPU's speed.


<!-- Big Text: priv-sec -->
<!-- Big Text: privacy -->

<h2 id="priv-sec">
Security and Privacy Considerations</h2>
<h2 id="privacy-considerations">
Privacy Considerations</h2>

Per the [[security-privacy-questionnaire#questions]]:

Expand All @@ -13405,24 +13405,24 @@ Per the [[security-privacy-questionnaire#questions]]:
fingerprinting analysis is done -->


2. Does this specification deal with high-value data?
1. Does this specification deal with high-value data?

No. Credit card information and the like is not used in Web Audio.
It is possible to use Web Audio to process or analyze voice data,
which might be a privacy concern, but access to the user's
microphone is permission-based via {{getUserMedia()}}.

3. Does this specification introduce new state for an origin that
1. Does this specification introduce new state for an origin that
persists across browsing sessions?

No. AudioWorklet does not persist across browsing sessions.

4. Does this specification expose persistent, cross-origin state to
1. Does this specification expose persistent, cross-origin state to
the web?

Yes, the supported audio sample rate(s) and the output device channel count are exposed. See {{AudioContext}}.

5. Does this specification expose any other data to an origin that it
1. Does this specification expose any other data to an origin that it
doesn’t currently have access to?

Yes. When giving various information on available
Expand Down Expand Up @@ -13515,18 +13515,12 @@ Per the [[security-privacy-questionnaire#questions]]:
(stereo). Stereo is by far the most common number of
channels.

6. Does this specification enable new script execution/loading
mechanisms?

No. It does use the [[HTML]] script execution method,
defined in that specification.

7. Does this specification allow an origin access to a user’s
1. Does this specification allow an origin access to a user’s
location?

No.

8. Does this specification allow an origin access to sensors on a
1. Does this specification allow an origin access to sensors on a
user’s device?

Not directly. Currently, audio input is not specified in this
Expand All @@ -13545,7 +13539,7 @@ Per the [[security-privacy-questionnaire#questions]]:
enable communication between otherwise partitioned contexts in one
browser.

9. Does this specification allow an origin access to aspects of a
1. Does this specification allow an origin access to aspects of a
user’s local computing environment?

<!-- from f2f -->
Expand All @@ -13566,7 +13560,41 @@ Per the [[security-privacy-questionnaire#questions]]:
requiring higher-end devices to use a lower rate would merely result in
Web Audio being labelled as unsuitable for professional use.

10. Does this specification allow an origin access to other devices?
1. Does this specification expose temporary identifiers to the web?

No.

1. Does this specification distinguish between behavior in first-party
and third-party contexts?

No.

1. How should this specification work in the context of a user agent’s
"incognito" mode?

Not differently.

1. Does this specification persist data to a user’s local device?

No.

1. Does this specification have a "Security Considerations" and
"Privacy Considerations" section?

Yes (you are reading it).

<h2 id="security-considerations">
Security Considerations</h2>

Per the [[security-privacy-questionnaire#questions]]:

1. Does this specification enable new script execution/loading
mechanisms?

No. It does use the [[HTML]] script execution method,
defined in that specification.

1. Does this specification allow an origin access to other devices?

It typically does not allow access to other networked devices (an
exception in a high-end recording studio might be Dante networked
Expand All @@ -13591,7 +13619,7 @@ Per the [[security-privacy-questionnaire#questions]]:
20kHz to 24kHz band (but it is easier to avoid phase ripple
errors in the passband).

11. Does this specification allow an origin some measure of control
1. Does this specification allow an origin some measure of control
over a user agent’s native UI?

If the UI has audio components, such as a voice assistant or screenreader,
Expand All @@ -13600,30 +13628,7 @@ Per the [[security-privacy-questionnaire#questions]]:
This possibility also exists with HTML, through
the &lt;audio&gt; element.

12. Does this specification expose temporary identifiers to the web?

No.

13. Does this specification distinguish between behavior in first-party
and third-party contexts?

No.

14. How should this specification work in the context of a user agent’s
"incognito" mode?

Not differently.

15. Does this specification persist data to a user’s local device?

No.

16. Does this specification have a "Security Considerations" and
"Privacy Considerations" section?

Yes (you are reading it).

17. Does this specification allow downgrading default security
1. Does this specification allow downgrading default security
characteristics?

No.
Expand Down
Loading