I hope we can get something in before the next milestone. In case we don't I have flagged it so I can make sure it is picked up explicitly for privacy review.

@alastc is it just when fields are hidden off-screen (per the examples linked from the article you referenced), or are there other techniques we should mention?

Logically it must be when fields (with autocomplete) are on the page, but hidden or disguised in some way.

There might be an aspect of wack-a-mole, where if hidden fields are detected by browsers then attackers might use other techniques like shrinking inputs to a couple of pixels, or making them transparent, or white on a white background or some other technique.

I suggest leaving it up to the browsers to fulfill a general requirement as they see fit.

Thanks @alastc. Proposed text:

<Warning: When fields with the 'autofill' attribute are hidden off-screen or visually disguised, personal data may still be entered when using the 'auto-fill' feature of browsers and password managers. User agents should verify that all fields with the 'autofill' attribute are visible within the viewport before inserting data automatically.<

Comment originally filed by email from Nick Doty, in response to a wide review request to the Privacy IG.

<"The warning on the autofill attribute seems particularly important. Do we know whether UAs have implemented mitigations for this threat? Are there mitigations
that should be included in future versions of the spec?"<