Default capabilities of cross domain iframe about turtledove

[michaelkleber]

I agree that it should be possible to have cross-domain iframes both with and without the ability to add people to interest groups. But it seems to me that there are two reasons we might want the default to be off:

1. Lots of sites have lots of iframes for lots of reasons today, and as you say, "Updating these iframes can be a challenge for publishers." It seems likely that publishers would want to exercise judgement about what 3rd parties can add the site's visitors to an interest group. Giving that ability to anyone who got an iframe for any reason in the past doesn't seem like the site owner making a judgement call.

2. Transitive inclusion. When iframes include other iframes, it's easy for a site to end up including a third party that the original site owner doesn't know about. But it seems unlikely to me that sites would want to give this capability away globally.

You're quite right that these need to be balanced against the work we're requiring of sites that do want to give this capability to a 3rd party. But it sounds like you're thinking about publishers who get some financial benefit from including these iframes. That's the right sort of motivation for sites to make this change when they intend to do so!

[JensenPaul]

Closing this issue as it represents past design discussion that predates more recent proposals. I believe some of this feedback was incorporated into the Protected Audience (formerly known as FLEDGE) delegation mechanism. If you feel further discussion is needed, please feel free to reopen this issue or file a new issue.