Title: disclosures tab – Make WordPress Core --- # Tag Archives: disclosures tab [ ](https://profiles.wordpress.org/carike/) [Carike](https://profiles.wordpress.org/carike/) 7:57 pm _on_ August 19, 2020 Tags: [consent-api ( 5 )](https://make.wordpress.org/core/tag/consent-api/), [core-media ( 116 )](https://make.wordpress.org/core/tag/core-media/), [core-privacy ( 53 )](https://make.wordpress.org/core/tag/core-privacy/), disclosures tab, [local avatar project ( 2 )](https://make.wordpress.org/core/tag/local-avatar-project/), minutes    # 󠀁[Minutes: Core Privacy Meeting 19 August 2020](https://make.wordpress.org/core/2020/08/19/minutes-core-privacy-meeting-19-august-2020/)󠁿 **The Consent APIAPI An API or Application Programming Interface is a software intermediary that allows programs to interact with each other and share data in limited, clearly defined ways.:** The Consent API is the oldest of the privacy initiatives currently under active development, not yet merged into CoreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress..It was created in response to the following ticketticket Created for both bug reports and feature development on the bug tracker.: [https://core.trac.wordpress.org/ticket/44043](https://core.trac.wordpress.org/ticket/44043)( Framework for logging/retrieving a user’s consent state)The proposed feature pluginFeature Plugin A plugin that was created with the intention of eventually being proposed for inclusion in WordPress Core. See [Features as Plugins](https://make.wordpress.org/core/handbook/about/release-cycle/features-as-plugins/) can be found here: [https://wordpress.org/plugins/wp-consent-api/](https://wordpress.org/plugins/wp-consent-api/) The code is extremely light-weight (13KB, excluding the readme.txt and the licence). The Consent API could greatly benefit from a wp_set_cookie(); function in WordPress Core, which would make adoption by pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) or can be cost-based plugin from a third-party. and theme developers more likely than the current has_consent(‘type’) approach.These two items have natural synergies and would do well scoped together.In its current form, the Consent API does not have any User Interface.However, it would be more valuable to allow registered users to save their consent (functional, preferences, anonymous statistics, statistics and marketing) more permanently under their profile page for when they are logged in. There could also be settings for whether or not to make the profile visible to search engines, etc.Logged out users, or users who are not signed up for an account, would not have a UIUI User interface in Core, but instead their UI would be provided via a cookie banner or comprehensive consent management plugin. **The Disclosures Tab:** The Disclosures Tab is intended to aggregate the information collected from individual disclosures.jsonJSON JSON, or JavaScript Object Notation, is a minimal, readable format for structuring data. It is used primarily to transmit data between a server and web application, as an alternative to XML. files in individual plugins, themes and Core.Compiling a disclosures.json file for Core would be a significant undertaking, as, among other things, it is intended to disclose any external references( calls to other sites, available APIs, feeds, etc.)The intention of the tab is to help site owners and admins to understand what information their site collects, where it is stored and where it is sent.This will help site owners / admins to make more informed privacy-related choices and understand their privacy risk profile. Any actual “controlling” (the Permissions Tab) is likely more suited as an optional plugin.The Disclosures tab would require creating a JSON schema and writing a function( first in a plugin and then in core) to validate the schema.The UI would most likely exist as a new tab under the Settings tab. **Enter the Local AvatarAvatar An avatar is an image or illustration that specifically refers to a character that represents an online user. It’s usually a square box that appears next to the user’s name. Project:** CNDs have privacy considerations in that, at least in theory, it is possible for the CDN to track users across sites. Some CDNs do use data obtained this way as a source of marketing analytics data. Furthermore, the hashing that is used can be brute-forced, which may lead to unwanted disclosures of someone’s identity.The Local Avatar Project has tremendous value as a case study in best practices.Avatars are a highly relatable way to explain complex privacy concepts to users and developers like.Furthermore, it has tremendous persuasive potential for achieving developer buy-in, as a common refrain includes“ But avatars do the same thing!”The UI for registered users would be located on the user’s profile page.This UI would allow a registered user to upload an avatar (and could be extended by plugin to allow for more options, like selecting from a pre- set).The UI for authorized users would be located as a new tab under the Media tab. The UI for site-level settings would be located where the avatar settings are currently located, as this would most likely be the most intuitive for users. **Vision:** Each of the above projects can be developed in a modal way in order to achieve a cohesive privacy-by-design vision.This would require distinct, but complimentary education drives for developers and for site owners / admins. [#consent-api](https://make.wordpress.org/core/tag/consent-api/), [#core-media](https://make.wordpress.org/core/tag/core-media/), [#core-privacy](https://make.wordpress.org/core/tag/core-privacy/), [#disclosures-tab](https://make.wordpress.org/core/tag/disclosures-tab/), [#local-avatar-project](https://make.wordpress.org/core/tag/local-avatar-project/), [#minutes](https://make.wordpress.org/core/tag/minutes/) [ ](https://profiles.wordpress.org/carike/) [Carike](https://profiles.wordpress.org/carike/) 1:23 pm _on_ August 17, 2020 Tags: [consent-api ( 5 )](https://make.wordpress.org/core/tag/consent-api/), [core-media ( 116 )](https://make.wordpress.org/core/tag/core-media/), [core-privacy ( 53 )](https://make.wordpress.org/core/tag/core-privacy/), [core-restapi ( 34 )](https://make.wordpress.org/core/tag/core-restapi/), disclosures tab, [local avatar project ( 2 )](https://make.wordpress.org/core/tag/local-avatar-project/), [privacy ( 39 )](https://make.wordpress.org/core/tag/privacy/)    # 󠀁[Agenda: Office Hours 19 August 2020 at 18:00 UTC](https://make.wordpress.org/core/2020/08/17/agenda-office-hours-19-august-2020-at-1800-utc/)󠁿 [@paaljoachim](https://profiles.wordpress.org/paaljoachim/) has asked what the UI needs to look like for a Privacy screen in Core. You can read the conversation here: https://wordpress.slack.com/archives/C9695RJBW/p1597418745430800 (a Slack account is needed) * **Site-level privacy** Initiatives: 1.) Disclosures and Permissions Tab; 2.) Local AvatarAvatar An avatar is an image or illustration that specifically refers to a character that represents an online user. It’s usually a square box that appears next to the user’s name. Project (in collaboration with the [#core-media](https://make.wordpress.org/core/tag/core-media/) team)The DPT would require writing a JSONJSON JSON, or JavaScript Object Notation, is a minimal, readable format for structuring data. It is used primarily to transmit data between a server and web application, as an alternative to XML. schema, as well as a coreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress. function to validate it (hopefully in collaboration with the [#core-restapi](https://make.wordpress.org/core/tag/core-restapi/) team).The UIUI User interface would most likely be under Settings -> Privacy. This interface should help site owners / admins understand what information their site collects (by means of individual plugins, themes, as well as Core), where it is stored and where it is sent.Ideally, this would provide a mechanism for the site owner to prevent data from being transmitted off-site / make choices with regards to third party access.Part of the Local Avatar Project would overlap with site-level privacy in the following areas: Settings, Permissions and Library. There is currently still a discussion as to whether a fully-fledged library is needed (defined as that image metaMeta Meta is a term that refers to the inside workings of a group. For us, this is the team that works on internal WordPress sites like WordCamp Central and Make WordPress.-data needs to be edit-able). * **Website-visitor level privacy** Initiatives: 1.) Consent APIAPI An API or Application Programming Interface is a software intermediary that allows programs to interact with each other and share data in limited, clearly defined ways.; 2.) Local Avatar User Upload ScreenThe Consent API in its current form is not intended to have any UI.This is due to the fact that website visitors who are not registered / not logged in still need to be able to exercise privacy choices.However, it may be nice to allow logged-in users to save their privacy choices on a more permanent basis, perhaps by making use of user_meta. In this case, there would need to be a UI on the user’s profile screen to support this.There would presumably still be no UI for users who are not logged in. A UI could be provided by means of a consent management pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) or can be cost-based plugin from a third-party..Additionally, the Team needs to discuss which filters / functions may be necessary in Core in order to convert the Consent API feature pluginFeature Plugin A plugin that was created with the intention of eventually being proposed for inclusion in WordPress Core. See [Features as Plugins](https://make.wordpress.org/core/handbook/about/release-cycle/features-as-plugins/) into a more fully-fledged API, e.g. wp_set_cookie();Part of the Local Avatar Project would overlap with website-visitor level privacy. This would mainly be in the following area(s): User Profiles. For example, users may want to indicate that they do not wish for their avatars to be indexed by search engines. Please join us for this week’s office hours to discuss what these solutions may look like! [#consent-api](https://make.wordpress.org/core/tag/consent-api/), [#core-privacy](https://make.wordpress.org/core/tag/core-privacy/), [#disclosures-tab](https://make.wordpress.org/core/tag/disclosures-tab/), [#local-avatar-project](https://make.wordpress.org/core/tag/local-avatar-project/), [#privacy](https://make.wordpress.org/core/tag/privacy/)