Add a principle that sites should not be _able_ to retaliate when users say no

[w3cbot]

This is a tracker issue. Only discuss things here if they are a11y group internal meta-discussions about the issue. Contribute to the actual discussion at the following link:

§ w3ctag/privacy-principles#418

[matatk]

We were happy to sign off on the doc without this change as APA. @AutoSponge left a good comment (that APA members on the calls liked) that was taken up and filed as the tracked issue by the Privacy Principles team, which is great. They labelled it as a 'back burner' issue, which means they intend to address it. We might want to put 'needs-resolution' on this in future to remind ourselves of that, but am not doing so yet.

[jyasskin]

Note that 'back burner' means that it's worth addressing eventually but that we don't expect to fix it before the document is published as a W3C Statement. 'needs-resolution' here would, I think, say that you want it fixed before publication as a Statement. If that's the case, please comment on and/or provide suggested text for w3ctag/privacy-principles#418.