Question

A privacy engineer is reviewing a new single-page web application (SPA). To improve perceived performance, developers cache the authenticated user's full profile (name, email, date of birth, and a partial payment token) in the browser's localStorage so the app can render instantly on subsequent visits without re-fetching from the API. The data persists indefinitely and is accessible to any script running on the origin. Which recommendation BEST applies privacy by design and by default to this situation?

Accepted Answer

Store only the minimal non-sensitive attributes needed for rendering in a short-lived, scoped session store, and retrieve sensitive fields from the API on demand over the authenticated session

Answer

Keep the profile in localStorage but encrypt it client-side with a key hard-coded in the SPA's JavaScript bundle

Answer

Move the cached profile from localStorage to a first-party cookie so it is transmitted with every request

Answer

Retain the current design but add a banner informing users that their profile is cached locally for performance