changes to policy guidance regarding category 3
== Eligibility for Default on Data Collection ==
* Categories 1 & 2 (Technical & Interaction data)
** Pre-Release & Release: Data may default on, provided the data is exclusively in these categories (it cannot be in any other category). In Release, an opt-out must be available for most types of Technical and Interaction data. Teams
can limit data collection to prerelease populations only if appopriate for testing/validation, cost reduction, or risk mitigation.
* Category 3 (Web activity data)
** Pre-Release: May be eligible for default on data collection, provided there is
(i) advance user notice (ii) consent and (iii) an opt-out.** Release: Default off. May be eligible for opt- in data collection by specific users, provided there is (i) advance user notice (ii) consent and (iii) an opt-out.
* Category 4 (Highly Sensitive data)