@stephengentle No idea. Given malicious compliance is what companies like Google, etc., have been undertaking with GDPR/cookie notices/right to be forgotten, I don’t see why not. (Then again, things have a way of being implemented differently whenever “national security” enters into the picture… Here’s hoping we don’t have to find out.)