In Section 3 (the introductory part), it is stated that "[the mandatory mechanism that protects the user's privacy] SHOULD ensure that no location information is made available through this API without the user's express permission." This seems weak to me. It means that a conforming implementation of the privacy mechanism does not need to prevent the sharing of location information without user consent. I would suggest a `MUST.```
In Section 3 (the introductory part), it is stated that "[the mandatory mechanism that protects the user's privacy] SHOULD ensure that no location information is made available through this API without the user's express permission." This seems weak to me. It means that a conforming implementation of the privacy mechanism does not need to prevent the sharing of location information without user consent. I would suggest a `MUST.```