Added based on issue 936

#936 (comment)

Author: ianbjacobs

index.html

@@ -4900,6 +4900,18 @@ 
           The <a>user agenta> MUST NOT share information about the user with
           a developer (e.g., the shipping address) without user consent.
         p>
+        <p>
+          In particular, the {{PaymentMethodData.data}} and
+          {{PaymentResponse.details}} members allow for the arbitrary exchange
+          of data. In light of the wide range of data models used by existing
+          payment methods, prescribing data specifics in this API would limit
+          its usefulness. The {{PaymentResponse.details}} member carries data
+          from the payment handler, whether Web-based (as defined by the
+          [[Payment Handler API]]) or proprietary. The <a>user agenta> MUST
+          NOT support payment handlers unless they include adequate user
+          consent mechanisms (such as awareness of parties to the transaction
+          and mechanisms for demonstrating the intention to share data).
+        p>
         <p>
           The <a>user agenta> MUST NOT share the values of the
           {{PaymentDetailsBase/displayItems}} member or