Ambiguous use of 'link'

[sebbASF]

AIUI, the privacy policy only relates to page assets that are automatically downloaded, i.e. without any user intervention.
If a link has to be clicked by the user, AFAIK that is fine.

But the following appears to relate to all links:

infrastructure-website/content/pages/csp.md

Line 10 in 79e34b4

- Links to external resources **are allowed** if the site visitor must give explicit consent in order to see or use the content. This consent cannot be opt-out, and there must be a clear way for the visitor to retract consent at a later time.

[ML-dev-crypto]

I would like to work on this. I plan to clarify the language in csp.md (specifically line 10) to distinguish between automatically downloaded assets and user-initiated links, ensuring the policy accurately reflects that standard hyperlinks usually do not require the same explicit consent mechanism as embedded resources.

[cottage14]

Statement now reads - Links that lead to downloadable external resources are allowed if the site visitor must give explicit consent in order to see or use the content (such as by clicking a button or a link). This consent cannot be opt-out, and there must be a clear way for the visitor to retract consent at a later time.