Are ScreenOrientation change events scoped as tightly as possible

[bvandersloot-mozilla]

Reviewer from Privacy WG here 👋

If I understand correctly, these events only fire on visible, top-level windows. This seems like a great property to hold!

Further restriction to focused windows seems wrong. Is that correct? Are there any other restrictions that were considered?

It would be interesting to be able to make this a recommendation to other APIs that issue events that may reveal user information, but are essential to a page working. Do you have any links to this decision?

[marcoscaceres]

Thank you for your review. Here are the responses to your questions:

Events on visible, top-level windows

Correct. We've strengthened this further by requiring documents be a "fully active descendant of a top-level traversable with user attention" per the HTML spec.

Focus restrictions would be wrong

Yes, you're correct. Focus-only restrictions would break legitimate use cases like side-by-side windows. The "user attention" requirement provides better balance - it prevents background fingerprinting while allowing visible content to respond appropriately.

Changes made

• Events now require "user attention" (system-visible AND either focused OR able to receive keyboard input)
• Additional visibility state checks provide defense in depth
• Documents must be fully active descendants of top-level traversables

Recommendations for other APIs

This would be better addressed in W3C TAG Design Guidelines. I'll propose this principle:

Proposed TAG Design Principle:
"For APIs delivering events with potentially sensitive user information while remaining essential for functionality, require documents to be 'fully active descendant of a top-level traversable with user attention' rather than simple visibility or focus checks."

Links to design decisions

Privacy restrictions are documented in the specification's Event Delivery Restrictions section.

PR: #266

[marcoscaceres]

Considering as having resolution based on #266 (review)

[jyasskin]

This issue has

Focus-only restrictions would break legitimate use cases like side-by-side windows.

but the resolving PR used user attention, which is defined as "it either has system focus or user agent widgets directly related to it can receive keyboard input channeled from the operating system.", which would exclude the non-focused side-by-side window.

Was that intentional?

[marcoscaceres]

Nah, I got confused. 😵‍💫 Doing too many things at once.