Prevent VPN being preloaded and activated without user's awareness
To protect the end user's privacy clarify that
when a VPN is preloaded, before activating the VPN
the device asks for user's consent.
Bug: 18449508
Change-Id: Ifade4c2d2b9377eabba229f5d3a097f1253a0b06
diff --git a/src/compatibility/5.1/android-5.1-cdd.html b/src/compatibility/5.1/android-5.1-cdd.html
index df1183f..9ffed99 100644
--- a/src/compatibility/5.1/android-5.1-cdd.html
+++ b/src/compatibility/5.1/android-5.1-cdd.html
@@ -4107,12 +4107,16 @@
<h2 id="9_8_privacy">9.8. Privacy</h2>
-
<p>If the device implements functionality in the system that captures the contents
displayed on the screen and/or records the audio stream played on the device,
it MUST continuously notify the user whenever this functionality is enabled and
actively capturing/recording.</p>
+<p>If a device implementation has a mechanism that routes network data traffic
+through a proxy server or VPN gateway by default (for example, preloading a VPN
+service with android.permission.CONTROL_VPN granted), the device implementation
+MUST ask for the user's consent before enabling that mechanism.</p>
+
<h2 id="9_9_full-disk_encryption">9.9. Full-Disk Encryption</h2>
<div class="note">