Check how OptMeowt and Firefox GPC settings interact and address accordingly

[SebastianZimmeck]

As Firefox now has GPC built in, it occurred to me that there may be actually a conflict. For example, if someone turns on GPC in Firefox and then makes selective choices via OptMeowt to not send GPC signals to certain sites, I imagine they are still being sent via Firefox. Also, what if both OptMeowt and Firefox send signals? Are there now actually two signals? Does that cause any problems? Other constellations that we should think about?

We should investigate the different possibilities and document them in the readme. Maybe we should even have a popup or something similar in the OptMeowt Firefox version.

@OliverWang13 and @Mattm27 can you together look into this and come up with a plan?

[OliverWang13]

Just from quickly looking at the reference server and messing around with the Firefox "Tell websites not to sell or share my data" I have found the following interactions, none of which seem extremely problematic:

1. Firefox setting on without OptMeowt: GPC Sent
2. Firefox setting off without OptMeowt: GPC NOT Sent
3. Firefox setting on with OptMeowt toggled on: GPC Sent
4. Firefox setting off with OptMeowt toggled on: GPC Sent
5. Firefox setting on with Optmeowt toggled off: GPC Sent
6. Firefox setting off with Optmeowt toggled off: GPC NOT sent

These all apply to the header and the DOM signal. @Mattm27, do any of these interactions look strange to you?

We should investigate the different possibilities and document them in the readme. Maybe we should even have a popup or something similar in the OptMeowt Firefox version.

These are both good options, and I agree we should do at least one.

[Mattm27]

When testing the same interactions on my end using the reference server and with the Firefox "Tell websites not to sell or share my data", I saw identical results to @OliverWang13 regarding the header and the DOM signal. Nothing arose on my end that seemed problematic, but how could we check if two signals are being sent when both Optmeowt and Firefox send signals?

[SebastianZimmeck]

These results seem unproblematic to me. In general, the situations that warrant a note is that OptMeowt GPC is turned off (for all or some sites) while Firefox GPC is turned on (and vice versa).

So, maybe include a hardcoded line of text with an asterisk or something like that saying "Please note that your OptMeowt GPC settings may be overridden by your browser GPC settings, for example, if you turn on GPC in your browser for all sites and turn it off for some sites in the Domain List."

I'd say we do this across versions, i.e., Firefox and Chromium/Chrome. There may be some Chromium browser for which that point applies and Chrome may adopt GPC as well at some point (fingers crossed!).

A popup may be too invasive since this is not that big of a deal.

@Mattm27, can you implement this? @OliverWang13 can help and review the PR.

but how could we check if two signals are being sent when both Optmeowt and Firefox send signals?

The point I would be concerned about is if we see two Sec-GPC headers, viewable via the browser developer tools, for example. Is that the case? If so, we need to address this point because if we have two headers --- one set by the browser and one set by OptMeowt --- their values could diverge and cause confusion.

[Mattm27]

The point I would be concerned about is if we see two Sec-GPC headers, viewable via the browser developer tools, for example. Is that the case? If so, we need to address this point because if we have two headers --- one set by the browser and one set by OptMeowt --- their values could diverge and cause confusion.

After viewing the browser developer tools, it appears that only one Sec-GPC header is present when both Optmeout and Firefox are sending signals. @OliverWang13, are you seeing the same?

[OliverWang13]

I am seeing the same thing on my end.