Restrict to user-activation-received frames (was: Restrict access to visible and user-activation-received frames)

[w3cbot]

This is a tracker issue. Only discuss things here if they are privacy group internal meta-discussions about the issue. Contribute to the actual discussion at the following link:

§ w3c/geolocation#48

[marcoscaceres]

This issue has two parts. The "user visible" part was addressed by:
w3c/geolocation#90

And shipping across all browsers now.

For the second part, "user-activation-received frames": There is general agreement to make The API reliant on transient activation, but that will break potentially thousands and thousands(!) of websites, so a multi-year transitional strategy is be needed. We have a pull request up for discussion:

w3c/geolocation#94

It won't be in scope of the current REC cycle.

This issue can probably closed (or not?) - but the discussion is going to take a very long time.

[samuelweiler]

I've asked @pes10k to weigh in. Even if we decide to let the second part wait, we'll still want a tracked/tracking issue for it, so perhaps just leave this issue open?

[marcoscaceres]

Agree, yes. We definitely want to keep the issue open. As I mentioned in the issue, it will be a Herculean task to make it happen, but everyone agrees it's definitely worth doing.

[samuelweiler]

@pes10k and I concur re: letting the current Rec cycle go, but this issue needs to be resolved next time around.