[PROPOSED] Privacy review request for a WD that is moving to CR soon

[anssiko]

⚠️ This issue is created for WebML WG review purposes ahead the Privacy review request submission. The Web Neural Network API Working Draft is expected to move to Candidate Recommendation in 2022. This is the proposed review request to the W3C Privacy Interest Group (PING) to satisfy privacy review expectations for a CR publication.

PING request template, proposed input

This is the information requested by PING for "a WD that is moving to CR soon" (source), proposed input:

• name of spec to be reviewed: Web Neural Network API
• URL of spec: https://www.w3.org/TR/webnn/ (any dated version from 30 June 2022 or later is adequate)
• What and when is your next expected transition? CR in Q4 2022.
• What has changed since any previous review? See "Changes since previous privacy review" section below.
• Does your document have an in-line Privacy Considerations section, ideally one separate from the Security Considerations? https://www.w3.org/TR/webnn/#privacy
• Please point to the results of your own self-review: Self-Review Questionnaire: Security and Privacy and Self-Review Questionnaire: Security and Privacy #119 for review and discussion
• Where and how to file issues arising? https://github.com/webmachinelearning/webnn/issues
• Pointer to any explainer for the spec? https://github.com/webmachinelearning/webnn/blob/main/explainer.md

Other comments: Thanks to PING participants and other privacy experts for your contributions and participation in the Web Machine Learning Working Group on behalf of the whole WG.

Changes since previous privacy review

The Web Neural Network API received early PING review during 2020-2021: PING reviewed our initial self-review response (#119), the WG merged the self-review (#132) and added initial Security and Privacy Considerations (#170):

• issue: [2020-11-05] Initial Self-Review Questionnaire response: Security and Privacy Self-Review Questionnaire: Security and Privacy #119
• PR: [2021-02-18] Add responses to the Self-Review Questionnaire: Security and Privacy Add responses to the Self-Review Questionnaire: Security and Privacy #132
• PR: [2021-05-27] Add initial Security and Privacy Considerations sections Add initial Security and Privacy Considerations sections #170

Based on additional privacy review conducted by Google Chrome Privacy, the WG updated the privacy considerations in #259:

• PR: [2022-05-21] Add privacy considerations for cached/persisted data Add privacy considerations for cached/persisted data #259

In June 2022, the WG reviewed the changes since the previous privacy review took place identifying any privacy-impacting changes:

• HTML diff for changes since 2021-05-27
• All PRs merged since 2021-05-27

The WG identified the following potentially privacy-impacting issues, triaged with a "privacy-tracker" label:

• issue: [2020-08-27] Fingerprinting via machine-specific artifacts Fingerprinting via machine-specific artifacts #85
• issue: [2021-06-03] Related WebGPU Security and Privacy Considerations Related WebGPU Security and Privacy Considerations #175
• issue: [2021-05-13] Device selection with MLDevicePreference and MLPowerPreference Device selection with MLDevicePreference and MLPowerPreference #169
• issue: [2018-10-26] Cosine similarity between two facial features and cross origin tracking https://github.com/webmachinelearning/webnn/issues/7

The WG addressed #85 #175 and clarified #169 in PR #271. The WG elevated https://github.com/webmachinelearning/webnn/issues/7 to ethical considerations, a separate deliverable. Furthermore, the WG decided to drop WebGL dependency that removed related fingerprinting concerns:

• PR: Privacy Considerations refresh Privacy Considerations refresh #271
• PR: Drop WebGL interoperability Drop WebGL interoperability #273

[anssiko]

Review w3cping/privacy-request#96 submitted per https://www.w3.org/2022/06/30-webmachinelearning-minutes.html#r01