Lack of user consent violates privacy requirements, makes this easier to fingerprint.

[duaneking]

Questions:

• If a customer or user says "I don't consent to use topics" how do we turn that off?
• If a customer persona can't legally consent to be considered for a topic that the website wants them to be considered for because they are underage/lack rights to consent under the law (GDPR, CA 's Privacy Law, etc.)" how do we honor that?
• How does the user say "no" and turn this off in a meaningful way?
• How do people know what groups they are being presented as "in"?
• How do people protect themselves from being considered part of a group that they do not want to be in, without needing to think of everything possible in advance?
• How do people remove themselves from being considered part of a group that they might have accidentally been considered part of in the past by mistake?
• What about the legal right to be forgotten?

Your docs say the document.browsingTopics() returns an array of up to three topic objects in random order; Respectfully, The fact that the items are in random order also doesn't really make any real difference since the items in question can simply be reordered on the server side; Its security theater and does not improve security at all. This randomization is useless, so why is it included?

You say the returned array looks like: [{'configVersion': String, 'modelVersion': String, 'taxonomyVersion': String, 'topic': Number, 'version': String}] but I see no consent tracking, no timestamps for when consent was collected, no validation that the claim of consent happened, so I'm unsure how this can ever possibly be within compliance. If the intention is to show ads without consent then that is a problem, Due to the GDPR and other issues.

In addition because it's a number, it's not visible enough for people to actually know what is being sent because that number could be represent anything, so how would a person be able to give informed consent (as required by compliance) if they do not know what that group even is? How do people know what groups they are being presented as? How do people protect themselves from being considered part of a group that would make them targeted

What is the actual goal? Because it doesn't look like the goal is to allow customers to consent to be shown the correct ads that will actually convert; Is the intention then just to make it easier to sell more ads that won't convert? Is conversion secondary? If people are supposed to feel safe enough to want to buy something... then they should actually be interested in the product first, and if they've already opted out of those advertisements what is the point of showing them an advertisement for that topic knowing that they will not convert the ad?