The Security and privacy considerations section states:

For these reasons, the user agent MAY inform the user when the API is being used and provide a mechanism to disable the API (effectively no-op), on a per-origin basis or globally.

APA WG previously reviewed this API and made a comment that users SHOULD be able to disable use of the API. We've reviewed the latest version, and feel that things have changed such that this requirement ought to be a (RFC 2119) MUST now. Here are the key reasons:

• More apps could be using vibration as a means to send signals to the user via notifications, as well as the OS. There are also many frequent sources of notifications these days. There is scope for the user to be confused as to which app (or part of the OS) is sending the notification.

• Some users may find the haptic feedback too intense. Notifications could be jarring for them, and games (where the vibrations may happen very often) could be difficult for them to interact with, due to the frequent haptic feedback.