User Activation Requirement for SPC Credential Enrollment

Category: Miscellaneous
Type: No developer-visible change
Status: Enabled by default (Chrome 103)
Intent stage: Prepare to ship

Summary

This intent is to add a user activation requirement for Secure Payment Confirmation (SPC) credential enrollment in a cross-origin iframe to help mitigate a privacy issue (see https://github.com/w3c/secure-payme for discussion of a potential identity tracking attack).

Standards & signals

Specification: https://w3c.github.io/secure-payment-confirmation
Firefox: No signal
Safari: No signal
Web developers: Positive — Support and involvement in API development from multiple web developers and payment industry partners. Both Stripe and AirBnB have publicly stated that they have either completed or are in the process of prototyping/experimenting with SPC
Tracking bug: https://crbug.com/1322603

Explainers: https://github.com/w3c/secure-payment-confirmation/blob/main/explainer.md

View on chromestatus.com