From d2c0a1f0fabac4b89ed17cf52b310cd949261e41 Mon Sep 17 00:00:00 2001 From: Valerie Liu <79415174+ValwareIRC@users.noreply.github.com> Date: Sat, 7 Jun 2025 22:53:44 +0100 Subject: [PATCH 1/3] Allow servers to advertize clear privacy policy information and require consent --- extensions/privacy-policy.md | 207 +++++++++++++++++++++++++++++++++++ 1 file changed, 207 insertions(+) create mode 100644 extensions/privacy-policy.md diff --git a/extensions/privacy-policy.md b/extensions/privacy-policy.md new file mode 100644 index 00000000..fdce5a69 --- /dev/null +++ b/extensions/privacy-policy.md @@ -0,0 +1,207 @@ +--- +title: Privacy Policy extension +layout: spec +work-in-progress: true +copyrights: + - + name: "ValwareIRC" + email: "valerie@valware.co.uk" + period: "2025" +--- + + +## Notes for implementing work-in-progress version +This specification relies on the Standard Replies framework. + +Software implementing this work-in-progress specification MUST NOT use the unprefixed account-registration capability name. Instead, implementations SHOULD use the draft/privacy capability name to be interoperable with other software implementing a compatible work-in-progress version. +The final version of the specification will use an unprefixed capability name. + +## 1. Motivation + +This draft introduces a privacy consent workflow for IRC servers and clients. It allows clients to render a structured privacy policy UI via the `draft/privacy` capability. Users can explicitly consent to the privacy policy via the `/CONSENT` command. Consent MAY be required for specific actions (e.g. account registration) or for general usage, depending on server configuration. + +## 2. ISUPPORT Token + +Servers supporting this specification MUST advertise one of the following ISUPPORT tokens: + +### 2.1 Optional Privacy Consent + +``` +005 PRIVACY +``` + +- Consent is **supported**, but **not required** to connect. +- The server MAY still require consent before specific actions (e.g. `/REGISTER`, `/LOGIN`, joining private channels, etc.). +- Clients can opt-in to show the privacy policy and allow proactive consent. + +### 2.2 Required Privacy Consent + +``` +005 PRIVACY=consent-required +``` + +- Consent is **mandatory** before the user can interact with the network. +- Users must explicitly accept the policy via `/CONSENT` or will be prompted accordingly. + +## 3. Capability Registration + +Clients MAY negotiate the following IRCv3 capability: + +``` +draft/privacy +``` + +This enables structured delivery of privacy policy content using `NOTE PRIVACY` messages, suitable for modal rendering. + +## 4. Server Behavior + +### 4.1 On Connection + +Upon user connection, the server MUST check whether the user has already consented to the privacy policy. + +- If `PRIVACY=consent-required` is set and the user has **not yet consented**, the server MUST prompt them. +- If only `PRIVACY` is present, the server MAY wait until a restricted command (e.g. `/REGISTER`) is issued before prompting. + +#### With `draft/privacy`: + +``` +:irc.example.com NOTE PRIVACY :Privacy information: +:irc.example.com NOTE PRIVACY :This service collects and processes personal data in accordance with our privacy policy. +:irc.example.com NOTE PRIVACY :You can read the full policy at: https://example.com/privacy-policy +:irc.example.com NOTE PRIVACY :By using this service, you consent to the collection and processing of your personal data as described in the policy. +:irc.example.com NOTE PRIVACY :If you do not agree with the terms, please disconnect from the service. +:irc.example.com NOTE PRIVACY :To accept the privacy policy, click Accept or type /CONSENT +``` + +#### Without `draft/privacy`: + +``` +:irc.example.com NOTICE :You must read and accept our privacy policy before continuing. View it at https://example.com/privacy-policy — type /CONSENT to accept. +``` + +### 4.2 Consent-Gated Commands + +When `PRIVACY` is set (without `=consent-required`), the server MAY reject specific commands until the user consents. + +Example behavior: + +```irc +REGISTER valware hunter2 valware@example.com +:irc.example.com NOTICE valware :You must first consent to our privacy policy before registering. Type /CONSENT or visit https://example.com/privacy-policy. +``` + +## 5. Client Behavior + +Clients SHOULD behave as follows: + +- If `PRIVACY` is present: + - Be prepared to show a privacy consent flow when requested. + - Optionally show a “Review and Accept Privacy Policy” button in registration/login UIs. + +- If `PRIVACY=consent-required` is present: + - Require user interaction with the policy before proceeding with any network activity. + - Send `/CONSENT` after acceptance. + +## 6. Commands + +### 6.1 `CONSENT` + +``` +CONSENT +``` + +Indicates the user agrees to the server’s privacy policy. + +**Server MUST:** + +- Persistently record the user's consent (by hostmask, IP, or account) +- Suppress future prompts +- Respond with: + +``` +:irc.example.com CONSENT SUCCESS * :Thank you. You may now use the service. +``` + +**Server MAY:** + +- Gate further commands until consent is provided (see ISUPPORT behavior) +- Treat repeated `CONSENT` as idempotent, replying with: + +``` +:irc.example.com NOTE CONSENT ALREADY_CONSENTED * :You have already accepted the privacy policy. +``` + +### 6.2 `CONSENT REVOKE` + +``` +CONSENT REVOKE +``` + +Used by the user to explicitly withdraw their prior consent. + +**Server MUST:** + +- Remove or mark the consent as revoked +- Reply with: + +``` +:irc.example.com CONSENT SUCCESS * :Your consent has been revoked. You will be prompted again when required. +``` + +**Server MAY:** + +- Immediately restrict user access to features requiring consent +- Disconnect the user if consent is mandatory at all times (`PRIVACY=consent-required`), replying with: + +``` +:irc.example.com CONSENT ERROR * :Consent is required to use this service. Disconnecting. +ERROR :Consent revoked +``` + +**Client MAY:** + +- Expose a “Revoke Consent” button in settings +- Automatically re-prompt the user when needed + +### 6.3 Example Message Types + +- `CONSENT SUCCESS` — for completed operations +- `NOTE CONSENT` — for informational messages +- `FAIL CONSENT` — for denials or issues + +## 7. Storage and Revocation + +- Consent SHOULD be stored persistently. +- If the privacy policy changes substantially, the server MAY revoke previous consent and prompt again. +- Consent SHOULD be tied to user accounts when possible. + +## 8. Security and Privacy Considerations + +- Clients MUST NOT auto-send `/CONSENT` without user interaction. +- Servers MUST maintain an accessible and accurate privacy policy URL. +- Consent-gating MUST be clearly communicated to the user. + +## 9. Example Flows + +**A. With `PRIVACY=consent-required` and `draft/privacy`:** + +``` +:irc.example.com NOTE PRIVACY POLICY :Privacy information: +:irc.example.com NOTE PRIVACY POLICY :Etc +... +:irc.example.com NOTE PRIVACY POLICY_END :End of PRIVACY +[User clicks Accept] +CONSENT +:irc.example.com CONSENT SUCCESS valware :Thank you. You may now use the service. +``` + +**B. With keyless `PRIVACY`, consent required before registration:** + +``` +REGISTER valware weewoo123 valware@example.com +:irc.example.com NOTE REGISTER CONSENT_REQUIRED * :You must first consent to our privacy policy before registering. +:irc.example.com NOTE REGISTER CONSENT_REQUIRED :Type please check visit https://example.com/privacy-policy and type /CONSENT. +CONSENT +:irc.example.com CONSENT SUCCESS valware :Thank you. You may now register an account. +``` + From e10f39726635b081202f7b10c8eee2b6df8f6e3f Mon Sep 17 00:00:00 2001 From: Valerie Liu <79415174+ValwareIRC@users.noreply.github.com> Date: Sat, 7 Jun 2025 22:56:19 +0100 Subject: [PATCH 2/3] Fix my copy+paste mistake ;D ;D --- extensions/privacy-policy.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/extensions/privacy-policy.md b/extensions/privacy-policy.md index fdce5a69..eb0c4568 100644 --- a/extensions/privacy-policy.md +++ b/extensions/privacy-policy.md @@ -13,7 +13,7 @@ copyrights: ## Notes for implementing work-in-progress version This specification relies on the Standard Replies framework. -Software implementing this work-in-progress specification MUST NOT use the unprefixed account-registration capability name. Instead, implementations SHOULD use the draft/privacy capability name to be interoperable with other software implementing a compatible work-in-progress version. +Software implementing this work-in-progress specification MUST NOT use the unprefixed `draft/privacy` capability name. Instead, implementations SHOULD use the `draft/privacy` capability name to be interoperable with other software implementing a compatible work-in-progress version. The final version of the specification will use an unprefixed capability name. ## 1. Motivation From 0dc677828efc387e69e179a18d807c42a11f2506 Mon Sep 17 00:00:00 2001 From: Valerie Liu Date: Wed, 11 Jun 2025 20:37:04 +0100 Subject: [PATCH 3/3] Remove teh ISUPPORT token and rename language to "POLICY" --- extensions/policy.md | 252 +++++++++++++++++++++++++++++++++++ extensions/privacy-policy.md | 207 ---------------------------- 2 files changed, 252 insertions(+), 207 deletions(-) create mode 100644 extensions/policy.md delete mode 100644 extensions/privacy-policy.md diff --git a/extensions/policy.md b/extensions/policy.md new file mode 100644 index 00000000..16ae540b --- /dev/null +++ b/extensions/policy.md @@ -0,0 +1,252 @@ +--- +title: Policy Consent Extension +layout: spec +work-in-progress: true +copyrights: +- +name: "ValwareIRC" +email: "valerie@valware.co.uk" +period: "2025" +--- + +## Notes for implementing work-in-progress version + +This specification relies on the Standard Replies framework. + +Software implementing this work-in-progress specification MUST NOT use the unprefixed `draft/policy` capability name. Instead, implementations SHOULD use the `draft/policy` capability to ensure interoperability with compatible implementations. + +The final version of the specification will use an unprefixed capability name. + +## 1. Motivation + +This draft introduces a structured policy consent mechanism for IRC servers and clients. It enables clients to present a policy UI via the `draft/policy` capability and allows users to explicitly agree to the terms using the `/CONSENT` command. Consent MAY be required for specific actions (e.g. account registration) or for general usage, depending on server configuration. + +## 2. Capability Advertisement + +Servers supporting this specification MUST advertise the following IRCv3 capability with an optional value: + +- `draft/policy` – Consent supported, but not required +- `draft/policy=consent-required` – Consent is mandatory to use the service + +### 2.1 Optional Policy Consent + +``` +CAP LS +draft/policy +``` + +- Consent is **supported**, but **not required** to connect. +- The server MAY still restrict specific commands (e.g. `/REGISTER`) until consent is granted. + +### 2.2 Required Policy Consent + +``` +CAP LS +draft/policy=consent-required +``` + +- Consent is **required** before the user may proceed. +- The user MUST explicitly agree to the policy via `/CONSENT`. + +## 3. Server Behavior + +### 3.1 On Connection + +Servers MUST check if the user has previously provided consent. + +- If `draft/policy=consent-required` is advertised and no consent exists, the user MUST be prompted before proceeding. +- If only `draft/policy` is advertised, prompting MAY be deferred until a restricted action is attempted. + +#### With `draft/policy` (grouped sections): + +``` +:irc.example.com NOTE POLICY TOS * :Terms of Service +:irc.example.com NOTE POLICY TOS 1 :You agree to follow network etiquette. +:irc.example.com NOTE POLICY TOS 2 :You will not spam or flood. +:irc.example.com NOTE POLICY TOS * :End of Terms of Service. + +:irc.example.com NOTE POLICY RULES * :Community Rules +:irc.example.com NOTE POLICY RULES 1 :Be respectful to others. +:irc.example.com NOTE POLICY RULES 2 :No harassing language. +:irc.example.com NOTE POLICY RULES * :End of Community Rules. + +:irc.example.com NOTE POLICY PRIVACY * :Privacy & Data Use +:irc.example.com NOTE POLICY PRIVACY 1 :Minimal personal data is collected. +:irc.example.com NOTE POLICY PRIVACY 2 :Data is retained for 30 days. +:irc.example.com NOTE POLICY PRIVACY * :End of Privacy & Data Use. + +:irc.example.com NOTE POLICY * :To accept, click “Accept” or type /CONSENT +``` + +#### Without `draft/policy` support: + +``` +:irc.example.com NOTICE :You must review and accept our policy to continue. Visit https://example.com/policy — type /CONSENT to accept. +``` + +### 3.2 Consent-Gated Actions + +When `draft/policy` is present without `=consent-required`, servers MAY block certain commands until consent is obtained. + +Example: + +``` +REGISTER valware hunter2 valware@example.com +:irc.example.com NOTICE valware :You must first accept our policy to register. Type /CONSENT or visit https://example.com/policy. +``` + +## 4. Client Behavior + +Clients SHOULD behave as follows: + +- If `draft/policy` is present: +- Prepare to show a policy consent flow when prompted. +- Optionally display a “Review and Accept Policy” button in the UI. +- Render **TOS**, **RULES**, and **PRIVACY** as separate sections or panels. + +- If `draft/policy=consent-required` is present: +- Require user interaction with the policy before proceeding. +- Automatically send `/CONSENT` after user approval. + +## 5. Commands + +### 5.1 `CONSENT` + +``` +CONSENT +``` + +Indicates the user agrees to the server’s policy. + +**Server MUST:** + +- Persistently store the user's consent (by hostmask, account, etc.) +- Suppress further consent prompts +- Reply with: + +``` +:irc.example.com CONSENT SUCCESS * :Thank you. You may now use the service. +``` + +**Server MAY:** + +- Block commands until consent is received +- Treat multiple `CONSENT` calls as idempotent, replying: + +``` +:irc.example.com NOTE CONSENT ALREADY_CONSENTED * :You have already accepted the policy. +``` + +### 5.2 `CONSENT REVOKE` Command + +``` +CONSENT REVOKE +``` + +Explicitly withdraws prior consent. + +**Server MUST:** + +- Revoke or mark consent as withdrawn +- Reply: + +``` +:irc.example.com CONSENT SUCCESS * :Your consent has been revoked. You will be prompted again when required. +``` + +**Server MAY:** + +- Restrict or disconnect the user if consent is mandatory: + +``` +:irc.example.com CONSENT ERROR * :Consent is required to use this service. Disconnecting. +ERROR :Consent revoked +``` + +**Clients MAY:** + +- Provide a “Revoke Consent” button +- Automatically re-prompt as needed + +### 5.3 Message Types + +- `CONSENT SUCCESS` — for successful operations +- `NOTE CONSENT` — for consent-related messages +- `FAIL CONSENT` — for failures + +### 5.4 `POLICY` Command +Requests the current structured policy information from the server. + +Server MUST: + +- Send a series of NOTE POLICY messages grouped by type (TOS, RULES, PRIVACY) + +- Ensure message order allows clients to render sections properly + +- End each group with a final * line indicating the section is complete + +- If the policy has already been shown recently, MAY still resend it on request + +Example Response: +``` +:irc.example.com NOTE POLICY TOS * :Terms of Service +:irc.example.com NOTE POLICY TOS 1 :You agree to follow network etiquette. +:irc.example.com NOTE POLICY TOS 2 :No spam or flooding allowed. +:irc.example.com NOTE POLICY TOS :Other text. + +:irc.example.com NOTE POLICY RULES * :Network Rules +:irc.example.com NOTE POLICY RULES 1 :Be kind to others. +:irc.example.com NOTE POLICY RULES 2 :No illegal activity. +:irc.example.com NOTE POLICY RULES :Other text. + +:irc.example.com NOTE POLICY PRIVACY * :Privacy Policy +:irc.example.com NOTE POLICY PRIVACY 1 :We collect minimal connection data. +:irc.example.com NOTE POLICY PRIVACY 2 :Logs are retained for abuse prevention. +:irc.example.com NOTE POLICY PRIVACY :Other text. + +:irc.example.com NOTE POLICY * :To accept the policy, type /CONSENT +``` +Client MAY: + +- Trigger /POLICY when the user presses a “Review Policy” button +- Automatically call /POLICY during login flows if draft/policy=consent-required + +Notes: + +- The /POLICY command has no parameters +- Servers SHOULD send all three sections: TOS, RULES, and PRIVACY, even if some are empty +- A delayed or partial policy response MAY lead to invalid or rejected consent + +## 6. Storage and Revocation + +- Consent SHOULD be stored persistently. +- If the policy changes significantly, servers MAY revoke prior consent. +- Consent SHOULD be tied to authenticated accounts where possible. + +## 7. Security and Policy Considerations + +- Clients MUST NOT auto-send `/CONSENT` without user input. +- Servers MUST provide an accessible and accurate policy URL. +- Consent requirements MUST be clearly communicated to the user. + +## 8. Example Flows + +### A. With `draft/policy=consent-required` and UI rendering: + +``` +:irc.example.com NOTE POLICY TOS * :Terms of Service... +... +:irc.example.com NOTE POLICY PRIVACY * :Privacy & Data Use... +CONSENT +:irc.example.com CONSENT SUCCESS valware :Thank you. You may now use the service. +``` + +### B. With `draft/policy` (optional), blocking `/REGISTER`: + +``` +REGISTER valware hunter2 valware@example.com +:irc.example.com NOTE REGISTER CONSENT_REQUIRED * :Consent is required to register. +:irc.example.com NOTE REGISTER CONSENT_REQUIRED :Please review the policy by typing /POLICY. +CONSENT +:irc.example.com CONSENT SUCCESS valware :Thank you. You may now register an account. +``` diff --git a/extensions/privacy-policy.md b/extensions/privacy-policy.md deleted file mode 100644 index eb0c4568..00000000 --- a/extensions/privacy-policy.md +++ /dev/null @@ -1,207 +0,0 @@ ---- -title: Privacy Policy extension -layout: spec -work-in-progress: true -copyrights: - - - name: "ValwareIRC" - email: "valerie@valware.co.uk" - period: "2025" ---- - - -## Notes for implementing work-in-progress version -This specification relies on the Standard Replies framework. - -Software implementing this work-in-progress specification MUST NOT use the unprefixed `draft/privacy` capability name. Instead, implementations SHOULD use the `draft/privacy` capability name to be interoperable with other software implementing a compatible work-in-progress version. -The final version of the specification will use an unprefixed capability name. - -## 1. Motivation - -This draft introduces a privacy consent workflow for IRC servers and clients. It allows clients to render a structured privacy policy UI via the `draft/privacy` capability. Users can explicitly consent to the privacy policy via the `/CONSENT` command. Consent MAY be required for specific actions (e.g. account registration) or for general usage, depending on server configuration. - -## 2. ISUPPORT Token - -Servers supporting this specification MUST advertise one of the following ISUPPORT tokens: - -### 2.1 Optional Privacy Consent - -``` -005 PRIVACY -``` - -- Consent is **supported**, but **not required** to connect. -- The server MAY still require consent before specific actions (e.g. `/REGISTER`, `/LOGIN`, joining private channels, etc.). -- Clients can opt-in to show the privacy policy and allow proactive consent. - -### 2.2 Required Privacy Consent - -``` -005 PRIVACY=consent-required -``` - -- Consent is **mandatory** before the user can interact with the network. -- Users must explicitly accept the policy via `/CONSENT` or will be prompted accordingly. - -## 3. Capability Registration - -Clients MAY negotiate the following IRCv3 capability: - -``` -draft/privacy -``` - -This enables structured delivery of privacy policy content using `NOTE PRIVACY` messages, suitable for modal rendering. - -## 4. Server Behavior - -### 4.1 On Connection - -Upon user connection, the server MUST check whether the user has already consented to the privacy policy. - -- If `PRIVACY=consent-required` is set and the user has **not yet consented**, the server MUST prompt them. -- If only `PRIVACY` is present, the server MAY wait until a restricted command (e.g. `/REGISTER`) is issued before prompting. - -#### With `draft/privacy`: - -``` -:irc.example.com NOTE PRIVACY :Privacy information: -:irc.example.com NOTE PRIVACY :This service collects and processes personal data in accordance with our privacy policy. -:irc.example.com NOTE PRIVACY :You can read the full policy at: https://example.com/privacy-policy -:irc.example.com NOTE PRIVACY :By using this service, you consent to the collection and processing of your personal data as described in the policy. -:irc.example.com NOTE PRIVACY :If you do not agree with the terms, please disconnect from the service. -:irc.example.com NOTE PRIVACY :To accept the privacy policy, click Accept or type /CONSENT -``` - -#### Without `draft/privacy`: - -``` -:irc.example.com NOTICE :You must read and accept our privacy policy before continuing. View it at https://example.com/privacy-policy — type /CONSENT to accept. -``` - -### 4.2 Consent-Gated Commands - -When `PRIVACY` is set (without `=consent-required`), the server MAY reject specific commands until the user consents. - -Example behavior: - -```irc -REGISTER valware hunter2 valware@example.com -:irc.example.com NOTICE valware :You must first consent to our privacy policy before registering. Type /CONSENT or visit https://example.com/privacy-policy. -``` - -## 5. Client Behavior - -Clients SHOULD behave as follows: - -- If `PRIVACY` is present: - - Be prepared to show a privacy consent flow when requested. - - Optionally show a “Review and Accept Privacy Policy” button in registration/login UIs. - -- If `PRIVACY=consent-required` is present: - - Require user interaction with the policy before proceeding with any network activity. - - Send `/CONSENT` after acceptance. - -## 6. Commands - -### 6.1 `CONSENT` - -``` -CONSENT -``` - -Indicates the user agrees to the server’s privacy policy. - -**Server MUST:** - -- Persistently record the user's consent (by hostmask, IP, or account) -- Suppress future prompts -- Respond with: - -``` -:irc.example.com CONSENT SUCCESS * :Thank you. You may now use the service. -``` - -**Server MAY:** - -- Gate further commands until consent is provided (see ISUPPORT behavior) -- Treat repeated `CONSENT` as idempotent, replying with: - -``` -:irc.example.com NOTE CONSENT ALREADY_CONSENTED * :You have already accepted the privacy policy. -``` - -### 6.2 `CONSENT REVOKE` - -``` -CONSENT REVOKE -``` - -Used by the user to explicitly withdraw their prior consent. - -**Server MUST:** - -- Remove or mark the consent as revoked -- Reply with: - -``` -:irc.example.com CONSENT SUCCESS * :Your consent has been revoked. You will be prompted again when required. -``` - -**Server MAY:** - -- Immediately restrict user access to features requiring consent -- Disconnect the user if consent is mandatory at all times (`PRIVACY=consent-required`), replying with: - -``` -:irc.example.com CONSENT ERROR * :Consent is required to use this service. Disconnecting. -ERROR :Consent revoked -``` - -**Client MAY:** - -- Expose a “Revoke Consent” button in settings -- Automatically re-prompt the user when needed - -### 6.3 Example Message Types - -- `CONSENT SUCCESS` — for completed operations -- `NOTE CONSENT` — for informational messages -- `FAIL CONSENT` — for denials or issues - -## 7. Storage and Revocation - -- Consent SHOULD be stored persistently. -- If the privacy policy changes substantially, the server MAY revoke previous consent and prompt again. -- Consent SHOULD be tied to user accounts when possible. - -## 8. Security and Privacy Considerations - -- Clients MUST NOT auto-send `/CONSENT` without user interaction. -- Servers MUST maintain an accessible and accurate privacy policy URL. -- Consent-gating MUST be clearly communicated to the user. - -## 9. Example Flows - -**A. With `PRIVACY=consent-required` and `draft/privacy`:** - -``` -:irc.example.com NOTE PRIVACY POLICY :Privacy information: -:irc.example.com NOTE PRIVACY POLICY :Etc -... -:irc.example.com NOTE PRIVACY POLICY_END :End of PRIVACY -[User clicks Accept] -CONSENT -:irc.example.com CONSENT SUCCESS valware :Thank you. You may now use the service. -``` - -**B. With keyless `PRIVACY`, consent required before registration:** - -``` -REGISTER valware weewoo123 valware@example.com -:irc.example.com NOTE REGISTER CONSENT_REQUIRED * :You must first consent to our privacy policy before registering. -:irc.example.com NOTE REGISTER CONSENT_REQUIRED :Type please check visit https://example.com/privacy-policy and type /CONSENT. -CONSENT -:irc.example.com CONSENT SUCCESS valware :Thank you. You may now register an account. -``` -