https://www.w3.org/TR/security-privacy-questionnaire/
No.
No.
3.3 Does this specification introduce new state for an origin that persists across browsing sessions?
No. State is shared within an origin across active agents (tabs, workers) but does not persist beyond the lifetime of the agents.
No.
3.5 Does this specification expose any other data to an origin that it doesn’t currently have access to?
No.
No.
No.
No.
3.9 Does this specification allow an origin access to aspects of a user’s local computing environment?
No.
No.
No.
No. All identifiers (the arbitrary resource names) are provided by the web application itself.
Depending on the browser, yes. The scope of locks is expressly tied to the scope of storage. Browsers that partition storage separately for origins depending on first-party or third-party context (ee.g. "double keying") would reflect that for locks as well.
The collection of agents within an incognito browsing session behave as a separate user agent for the purposes of this API. That is, locks requested/held outside such a session have no affect on requested/held inside such a session, and vice versa. This prevents a website from determining that a session is "incognito" while also not allowing a communication mechanism between such sessions.
No.
Yes.
No.