If a controller operates many different web domains they often want to ask for consent, or let it be revoked, for multiple domains in one go. This can be implemented using the current API by using the domain property, but this only lets sites register consent for subdomains i.e. using "cookie rules". It could perhaps be implemented via the dynamic creation of iframes inside a a "click" handler but this would not be efficient beyond a handful of domains, and would depend on browsers implementing the API in a way that would allow this.
Controllers can declare themselves in the "controller" TSR property so consent could be applied to a named set of domains that have the identical "controller" property as the caller in their own TSRs. Before granting the exception the user agent can check that the caller domain is listed in the "same-party" array of the target domain, i.e. that the sites mutually refer.
This could be implemented by having a new property "domains" in the API dictionary (the TrackingExceptionPropertyBag), which would be an array of strings indicating the domains where consent is being asked to be registered. There would be no wildcard characters allowed, each "target" domain would have to be explicitly listed.
The user agent would check the controller properties were identical for each domain, and that each TSR same-property array referred back to the calling origins domain. This procedure would only need to be checked when the exception "store" API is called, and would only require the prefetching of the target domains TSRs.
The existence of the "cookie rules" domain property increases the clock-cycle cost in implementing the API because all subdomain components must be checked for every request. This new parameter would make the domain property redundant.
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.3