Rewrite privacy considerations on fingerprinting in start_url (#1114)

* Rewrite privacy considerations on fingerprinting in start_url.

There is a "MUST NOT" requirement for developers about putting user data
in the start_url. This is not enforceable, so rewriting the paragraph:

1. Removed this requirement for developers.
2. Added a non-normative note that tells developers it would be
   irresponsible to do this (but acknowledging that we can't practically
   prevent it).
3. Added a MAY requirement for user agents to offer to uninstall apps
   associated with an origin when clearing site data.

* Change "UUID" to "identifier"

Co-authored-by: Marcos Cáceres <marcos@marcosc.com>

* Reword note to developers.

Co-authored-by: Marcos Cáceres <marcos@marcosc.com>

* Add title to note box.

Co-authored-by: Marcos Cáceres <marcos@marcosc.com>

---------

Co-authored-by: Marcos Cáceres <marcos@marcosc.com>

index.html

@@ -817,18 +817,29 @@ <h3>
             This can be useful for analytics and possibly other customizations.
             However, it is also conceivable that developers could encode
             strings into the start_url that uniquely identify the user (e.g., a
-            server assigned <abbr>UUID</abbr>). This is fingerprinting/privacy
-            sensitive information that the user might not be aware of.
+            server-assigned identifier, such as `"?user=123"`,
+            `"/user/123/"`, or `"https://user123.foo.bar"`). This is
+            fingerprinting/privacy sensitive information that the user might
+            not be aware of.
+          </p>
+          <p class="note" title="Don't add identifiers to start URLs">
+            It is bad practice for a developer to use the [=start URL=]
+            to include information that uniquely identifies a user, as it would
+            represent a fingerprint that is not cleared when the user clears
+            site data. However, nothing in this specification can practically
+            prevent developers from doing this.
           </p>
           <p>
             Given the above, it is RECOMMENDED that, upon installation, or any
             time thereafter, a user agent allows the user to inspect and, if
             necessary, modify the [=start URL=] of an application.
           </p>
           <p>
-            Additionally, developers MUST NOT use the [=manifest/start URL=] to include
-            information that uniquely identifies a user (e.g., "?user=123" or
-            "/user/123/", or "https://user123.foo.bar").
+            A user agent MAY offer other protections against this form of
+            fingerprinting. For example, if a user clears data from an origin,
+            the user agent MAY offer to uninstall applications that are
+            [=manifest/within scope=] of that origin, thus removing the
+            potential fingerprint from the application's start URL.
           </p>
         </section>
       </section>