Everything should be permitted by default, however, the user can choose to return blank, fake or real data.