Brave Software Web Standards at Brave: Global Privacy Control changes — 20231104_rev01

19

**Third**, Brave is interested in working with responsible, ethical, privacy-respecting publishers who want to respect user privacy _without requiring users to click through intentionally confusing dialogs and "consent forms"_. We're especially interested in working with publishers who want to respect user privacy both where the law requires it (e.g., [GDPR](https://en.wikipedia.org/wiki/General_Data_Protection_Regulation), [CCPA](https://en.wikipedia.org/wiki/California_Consumer_Privacy_Act)), as well as in areas where the law hasn't yet caught up to recognize privacy as a right (and pervasive, non-consensual tracking as wrong). We're excited by the publishers we've worked alongside during the "Global Privacy Control" proposal, and we hope others will follow their lead.

20

21

## Brave's Implementation of the "Global Privacy Control"

22

23

Brave is currently testing an implementation of the GPC proposal in our [Nightly desktop](https://brave.com/download-nightly/) and [Android beta channels](https://play.google.com/store/apps/details), and expect to implement it in our iOS browser as the proposal goes through the standardization process.

24

25

Importantly, Brave does not require users to change anything to start using the GPC to assert your privacy rights. For versions of Brave that have GPC implemented, the feature is on by default and unconfigurable. We've decided to implement GPC in this way for several reasons.

25

Brave does not require users to change anything to start using the GPC to assert their privacy rights. For versions of Brave that have GPC implemented, the feature is on by default.

26

27

**First**, we believe that anyone choosing to use Brave has already made an unambiguous expression that they do not want their data to be sold or shared online. Legislation like the [CCPA recognizes that the decision to use privacy-focused tools like Brave is itself an expression of user preference](https://oag.ca.gov/sites/all/files/agweb/pdfs/privacy/ccpa-fsor-appendix-e.pdf) for privacy. Requiring users in Brave to take an additional step to enable GPC therefore seems both unnecessary and disrespectful to our users (who have already made their preference clear!).

27

We believe that anyone choosing to use Brave has already made an unambiguous expression that they do not want their data to be sold or shared online. Legislation like the [CCPA recognizes that the decision to use privacy-focused tools like Brave is itself an expression of user preference](https://oag.ca.gov/sites/all/files/agweb/pdfs/privacy/ccpa-fsor-appendix-e.pdf) for privacy. Requiring users in Brave to take an additional step to enable GPC therefore seems both unnecessary and disrespectful to our users (who have already made their preference clear!).

28

29

**Second**, the more configuration options available in the browser, the easier it is to "fingerprint" [2]() users. We build strong, unique, and innovative defenses against "fingerprinting" into the Brave Browser, and are cautious about adding configuration options that could reduce your privacy. Unless we expect configurability to be useful to a significant number of users, we err on the side of _reducing_ configuration options. We expect few, if any, Brave users would want to disable GPC, and so have not included any configuration option.

30

31

29

## Brave, GPC, and The Inevitability of a Private-by-Default Web

32

30

33

31

Since we started, Brave has argued that a healthy, sustainable, vibrant Web requires a privacy-preserving, privacy-by-default Web; business models that depend on tracking will soon look as antiquated as Flash, Java Applets or "made for IE" badges.

34

32

35

33

Privacy-preserving tools like Brave are just one part of what's needed to keep improving the Web. Legislation (like the CCPA and GDPR) that enshrines and protects privacy is a second necessary part, and proposals like GPC that allow users to conveniently and privately assert their rights is a third. We're excited for browsers to implement GPC, more publishers to [interpret and respect GPC as discussed in the proposal](https://globalprivacycontrol.github.io/gpc-spec/), and more ways of protecting privacy on the Web.

36

34

35

```

36

<em>This page was updated September 2023 to remove the mention that GPC could not be disabled in the Brave browser.</em>

37

```

38

37

39

- * *

38

40

39

41

1. Brave also advocates for, and improves privacy in, proposed Web standards, as members of the [W3C](https://www.w3.org/) and co-chairs the W3C's [privacy review interest group](https://www.w3.org/Privacy/IG/) (PING). [↩︎]()

40

41

2. i.e., identify users by their browser configuration and characteristics, instead of through stored identifiers like cookies. [↩︎]()

 **Third**, Brave is interested in working with responsible, ethical, privacy-respecting publishers who want to respect user privacy _without requiring users to click through intentionally confusing dialogs and "consent forms"_. We're especially interested in working with publishers who want to respect user privacy both where the law requires it (e.g., [GDPR](https://en.wikipedia.org/wiki/General_Data_Protection_Regulation), [CCPA](https://en.wikipedia.org/wiki/California_Consumer_Privacy_Act)), as well as in areas where the law hasn't yet caught up to recognize privacy as a right (and pervasive, non-consensual tracking as wrong). We're excited by the publishers we've worked alongside during the "Global Privacy Control" proposal, and we hope others will follow their lead.
 ## Brave's Implementation of the "Global Privacy Control"
 Brave is currently testing an implementation of the GPC proposal in our [Nightly desktop](https://brave.com/download-nightly/) and [Android beta channels](https://play.google.com/store/apps/details), and expect to implement it in our iOS browser as the proposal goes through the standardization process.
+Importantly, Brave does not require users to change anything to start using the GPC to assert your privacy rights. For versions of Brave that have GPC implemented, the feature is on by default and unconfigurable. We've decided to implement GPC in this way for several reasons.
+Brave does not require users to change anything to start using the GPC to assert their privacy rights. For versions of Brave that have GPC implemented, the feature is on by default.
+**First**, we believe that anyone choosing to use Brave has already made an unambiguous expression that they do not want their data to be sold or shared online. Legislation like the [CCPA recognizes that the decision to use privacy-focused tools like Brave is itself an expression of user preference](https://oag.ca.gov/sites/all/files/agweb/pdfs/privacy/ccpa-fsor-appendix-e.pdf) for privacy. Requiring users in Brave to take an additional step to enable GPC therefore seems both unnecessary and disrespectful to our users (who have already made their preference clear!).
+We believe that anyone choosing to use Brave has already made an unambiguous expression that they do not want their data to be sold or shared online. Legislation like the [CCPA recognizes that the decision to use privacy-focused tools like Brave is itself an expression of user preference](https://oag.ca.gov/sites/all/files/agweb/pdfs/privacy/ccpa-fsor-appendix-e.pdf) for privacy. Requiring users in Brave to take an additional step to enable GPC therefore seems both unnecessary and disrespectful to our users (who have already made their preference clear!).
+**Second**, the more configuration options available in the browser, the easier it is to "fingerprint" [2]() users. We build strong, unique, and innovative defenses against "fingerprinting" into the Brave Browser, and are cautious about adding configuration options that could reduce your privacy. Unless we expect configurability to be useful to a significant number of users, we err on the side of _reducing_ configuration options. We expect few, if any, Brave users would want to disable GPC, and so have not included any configuration option.
 ## Brave, GPC, and The Inevitability of a Private-by-Default Web
 Since we started, Brave has argued that a healthy, sustainable, vibrant Web requires a privacy-preserving, privacy-by-default Web; business models that depend on tracking will soon look as antiquated as Flash, Java Applets or "made for IE" badges.
 Privacy-preserving tools like Brave are just one part of what's needed to keep improving the Web. Legislation (like the CCPA and GDPR) that enshrines and protects privacy is a second necessary part, and proposals like GPC that allow users to conveniently and privately assert their rights is a third. We're excited for browsers to implement GPC, more publishers to [interpret and respect GPC as discussed in the proposal](https://globalprivacycontrol.github.io/gpc-spec/), and more ways of protecting privacy on the Web.
+```
+<em>This page was updated September 2023 to remove the mention that GPC could not be disabled in the Brave browser.</em>
+```
 - * *
 . Brave also advocates for, and improves privacy in, proposed Web standards, as members of the [W3C](https://www.w3.org/) and co-chairs the W3C's [privacy review interest group](https://www.w3.org/Privacy/IG/) (PING). [↩︎]()
+. i.e., identify users by their browser configuration and characteristics, instead of through stored identifiers like cookies. [↩︎]()

Web Standards at Brave: Global Privacy Control

Full text changes — 20220205_rev01 to 20231104_rev01