Introduction

In recent years, global regulatory trends have significantly emphasized privacy protection of personal data, driven by notable regulations such as the EU’s General Data Protection Regulation (GDPR) [1], the California Consumer Privacy Act (CCPA) [2], and similar authority activities emerging around the world. These regulations establish user consent as a foundational principle: individuals must be informed about how their data will be used and must obtain explicit permission before it can be collected, stored, processed, or exposed.

In the context of mobile communications system, the importance of user data privacy has also grown with the expansion of data-driven services related to location-based features, network analytics and exposure of network capabilities to third party applications. A service may be provided by the operator or by the third parties, which means user data privacy is applicable to utilization of the collected data within the operator domain and/or when shared to the third party (via north bound interface). Especially, collection of any data related to a user (as a subscriber of a mobile network) should ensure that the user retains the rights and control his/her own data, before and after being provided to the network.

Recognizing these trends, the 3^rd Generation Partnership Project (3GPP), the global standards development organizations body specifying mobile telecommunications technology, has expanded efforts to provide standardized user consent mechanism over the mobile communications system and services. These efforts span multiple Service and System Aspects (SA) Working Groups (WGs) that address different aspects of user consent management, from service and security requirements to architecture.

This article provides a comprehensive overview of the user consent management framework specified for the 3GPP-defined 5G system and outlines potential considerations pertaining to its evolution in the upcoming 6G system.

User consent management framework in 3GPP 5G system

3GPP has identified potential issues that have impacts on subscriber privacy in 3GPP 5G system through the followings efforts:

Fig. 1 below depicts the comprehensive user consent management in 3GPP 5G system.

Figure 1. User consent management in 5G system

Scope of privacy-sensitive user data in 5G system

User data requiring privacy protection is considered to be any information relating to an identified or identifiable end-user. In 3GPP an end-user is a subscriber (of tele communication services) itself or has authorized a subscriber to provide consent on behalf of the end-users [3]. Such privacy-sensitive data include UE identifier (e.g., Mobile Station Integrated Services Digital Network; MSISDN), UE location (e.g., GPS coordinates, cell ID), UE measurement information.

Further, privacy protection may be required for the user data information at an application layer as well. Especially, when owner of the data (a.k.a. resource owner) has to provide authorization in order to consume such data for e.g., by the API Invoker at the northbound.

Acquisition of consent and privacy setting

In 3GPP, two subscription data types, user consent and Location Service (LCS) privacy profile, are specified to explicitly represent the end-user permission for given data set(s) to be stored, processed, and transferred [4], [5].

The user consent (as subscription data) indicates whether the user has given consent for a specific purpose (e.g., data collection for MDT, generation of analytics, exposure of the data).

The LCS privacy profile is defined to mitigate privacy risk for UE location information. Thus, it includes an indication of whether positioning (i.e., obtaining or calculating the UE location) is allowed or not.

The above user consent and LCS privacy profile are both stored in a core network function, called the Unified Data Repository (UDR) while these two data are provisioned through different methods in the UDR as follows. User consent is obtained from the end-user and configured by the operator in the UDR via a (non-standardized) procedure, whereas the LCS privacy profile can be provisioned by UE or application function (AF) via the procedures specified by SA2.

Common API Framework (CAPIF) in 3GPP has been enhanced to support Resource owner-aware Northbound API Access (RNAA), which enables the resource owner to issue an authorization grant to the API Invoker to support Northbound APIs invocation. Such authorization of the resource at the application layer is currently independent of the user consent stored in the core network at UDR.

Enforcement of user consent during privacy-sensitive data processing

User consent can be enforced within the 3GPP core network (CN) via the following operations: (i) determination of the purpose of data processing prior to the actual data processing, (ii) retrieval of consent related subscription data (i.e., user consent per purpose and LCS privacy profile) from Unified Data Management (UDM), noting that UDM can get the subscription data from the aforementioned UDR, (iii) decision on whether to accept any services or request for data processing based on the consent related subscription data, (iv) termination of data processing pertaining to the revoked consent

The following section describes details of coordinated approaches to standardization of the above user consent management across 3GPP SA2 (architecture), SA3 (security), and SA6 (application enablement) working groups.

Coordinated Standardization of User consent across 3GPP SA2, SA3, and SA6

Within 3GPP, three groups have taken primary roles in standardizing different aspects of user consent as follows:

Generic security requirements and mechanisms for user consent enforcement

SA3 addresses the privacy and security implications of user consent including generic security requirements and mechanism to support user consent enforcement in 3GPP services. Some of the important requirements documented in SA3 specification [3] are as follows:

Based on the above requirements and the generic mechanism defined by SA3, SA2 provides technical realization for them by specifying architecture and procedures for user consent in 5GS as follows.

Architecture and procedures for user consent management in 5GS

SA2 specifies overall system architecture and how UE and network functions (NFs) such as NEF, UDM and UDR operate to enforce the user consent check for UE data processing cases, e.g., UE data collection at NWDAF and UE location information acquisition [6].

Figure 2. An illustration of (a) user consent check for specified purposes and (b) permission mechanism for calculating and accessing UE location based on UE LCS privacy profile. Note that some NFs are not depicted for simplicity.

Fig. 2-(a) shows the user consent check for different purposes, which include UE measurement collection for MDT, UE-related data collection in the CN for analytics/training at NWDAF, and network capability exposure to outside of the CN. This user consent check shall be performed before processing or exposing UE related data. For example, the NWDAF shall check if user consent is given in UDM/UDR before requested UE-related data from data source NFs [7].

As depicted in Fig. 2-(b), SA2 specification provides a dedicated mechanism for checking whether acquisition of UE location is allowed based on UE LCS privacy profile, which also include information related to which entity are permitted or conditionally permitted to obtain UE location information. The LCS related NF (e.g., Gateway Mobile Location Centre; GMLC) in the CN checks the UE LCS privacy profile via UDM when it is requested to provide UE location. Also, during a positioning procedure, it is supported that the CN can notify the positioning target UE with privacy verification, indicating the identity of the requestor of UE location (i.e., identity of LCS client). Once the UE receives this notification for privacy verification, the target UE notifies the end-user of the location request and waits for the user to grant or withhold permission. As a result of this interaction between UE and the end user, the UE indicates to the CN NF whether permission is granted or denied by the user for the current LCS request. Additionally, Location Privacy Indication, an information element in UE LCS privacy profile, can be provided and updated by UE and/or AF as depicted in Fig. 2-(b). [4].

User data privacy protection for application layer

3GPP SA3 and SA6 have jointly specified the application layer mechanism Resource owner-aware Northbound API Access (RNAA) for enabling the authorization of an API invoker when the invoked API is associated with the resource owner (i.e., when the API invocation requires processing or exposing the resource related to end user as MNO subscriber). For example, the API invoker (e.g., application function in Fig. 1) accesses the resources exposed by 3GPP northbound APIs (e.g., API exposed by NEF in Fig. 1) and these resources may require exposure of end user specific information (e.g., UE location). The Authorization function (as shown in Fig. 1) obtains consent from the resource owner (e.g., via resource owner client on the UE) to issue an authorization grant to the API invoker. Fig. 3 illustrates the realization of the AF-originated API invocation use case where a gaming server invokes the service API based on the trigger from a gaming client on the UE, using the CAPIF RNAA procedures [8].

Figure 3. An illustration of a typical flow for CAPIF RNAA

Conclusion

As 5G system has evolved to incorporate data-driven services such as location-based services, network analytics and exposure of network capability, 3GPP SA WGs have been actively working to enhance user data privacy protection through standardization efforts related to user consent management.

For the upcoming 6G system, it is expected that data-driven services would be further extended to include AIML based operations, and integrated sensing and communications. Also, it is anticipated that regulatory bodies are developing and enforcing regulations to protect personal data. In line with this, Samsung continues to contribute to the 3GPP standardization of privacy protection in mobile communications system.