Add referrerpolicy to media elements (<audio> and <video>)

[SegaraRai]

It seems to me that currently referrerpolicy can be used for <img> but not for <audio> or <video>.
It would be great if this could be used in the same way.

Related: whatwg/html#7822

[domfarolino]

This seems pretty reasonable to me, thanks for filing. I think we need go determine if any implementers are interested in doing this. Let's loop some people in:

• Blink: @dalecurtis
• @annevk do you know who might be the right person to ask for Firefox (maybe it is you, or maybe a media expert)
• WebKit: @cdumez / @rniwa

Any thoughts on this proposal?

[annevk]

I guess one question I have is how often people end up configuring referrer policies on a per request basis. And especially with user agents thinking of limiting referrer for cross-site subresource requests to origin in general, this might not add a lot of value anymore?

cc @padenot @mozfreddyb

[domfarolino]

Unfortunately it looks like we don't have use counter metrics for script elements in Chromium, but we at least have information on the following elements:

• iframe: ~4%
• img: 2.8%
• link: 2.15%
• a .041%

I suspect referrerpolicy on audio and video would be quite low, perhaps lower than a, but whether or not that low of a percentage justifies pursuing this I am not sure. I don't see too much appetite for it, but technically it could be useful.

[dalecurtis]

Sounds fine to me. I'm also not sure how useful it'd be though.

[chrisgraham]

I have ended up on this issue after looking at referrerpolicy as a solution to broadening privacy guidelines. For example, a German court ruled that Google Fonts could not be used on a site and issued a fine; that was about IP addresses (and I'd argue a silly judgement), but referrers are far more circumspect IMHO and IMHO we need fine-grained control and consistency in the standard. For example, what if we want to prevent a referrer on a small number of remote hosted videos, but allow it on all hyperlinks (without having to manually set it each time)? There are legitimate reasons for this kind of thing that different organisations will need to look at when it comes to balancing considerations of laws and also considerations of digital marketing.

I also wanted to add to this issue for completeness...

There are also the track and source elements, although we probably are best ignoring those and just saying to declare referrerpolicy on the wrapping media element.

Also, object and embed, although it'd be understandable to leave those elements to die.

And finally for completeness, there is the input element when showing an image button. For example, showing a PayPal payment button.

[annevk]

Distinguishing between navigations and subresources is an interesting and rather compelling suggestion.

(And yeah, img but not input seems like an oversight.)

[khemarato]

Distinguishing between navigations and subresources

Is what brought me here looking for this feature, for whatever that data point is worth 😊