Here’s Estonia, beautiful, built on over 2,300 islands. A fascinating mix of history and reconstruction.

And here’s Utah, landlocked, mountainous; no need for reconstruction.

So what do they have in common? Nice people? Great place to go on vacation? Yes to both in my experience.

But that’s not what I’m getting at.

Here’s the thing: Estonia, for the last 20 years or so, has been the poster child for how a country manages and uses digital identity.

My contention is that Utah and their SEDI/ State Endorsed Digital Identity programme, and others that pick up this direction, will be the poster children for the next 20. That’s the common ground. And to be clear, that is no sleight on the Estonia approach which was exactly the right approach at that particular point in time and situation.

But technology changes, so does geopolitical, societal and commercial context.

To the detail….

Decentralised identifiers as a technical construct and standard have been around for maybe a decade now; patiently waiting for the conditions that would drive adoption to surface. They now have…, in Utah. Don’t get me wrong, they are also showing up in many other places; even in huge projects like EUDI wallet. But the Utah instantiation is different.

That’s down to one simple innovation. One that fundamentally changes the inherent capability of the identifiers in question. And more importantly the agency they give to their holder - the human; in any of our guises, individual, parent, citizen, employee, patient, guardian and more. So let me re-emphasise that just for clarity. I, as an individual would be enabled to do quite a few things in the Estonia model. I will be able to do those things and a LOT more in the Utah/ SEDI model.

Why so?

In the SEDI model the ownership of the strong digital identifiers (actually cryptographic keys and thus a major security upgrade) lies with the individual. They can and will get them from a range of providers - like getting a mobile phone number is the best analogy I have right now. So, I get get up and running from a relevant service provider; but then that number is mine and I can port it across to other providers. And use it for more than just making phone calls. There are natural limits to what I can do with the phone number/ identifier based on who/ what allows me to use it.

That latter point is the dam that I believe SEDI breaks. In short the State of Utah is saying ‘get yourself one of those technically trustworthy identifiers; bring that along to one of our locations with some relevant proofs and we will give you a credential from the state that a) says ‘we agree that you are who you say you are’, and then b) enables you to attach that to your identifier in a digital wallet or similar, and then use that in any relevant interaction with the state. So as a minimum you can use that credential to do the things you could do if the state had just issued you a standard state issued document (a driving licence for example). The big bet therefore is that the SEDI form credential will then be useable in many more contexts as well. I think that bet will win big. I think organisations will say ‘well if it is good enough for the state, and verifiable as such, then it is good enough for us. In fact it will save us a lot of money on the existing approaches to KYC/ Know Your Customer and similar)’. It does so because the individual in a KYC context is no longer bringing evidence that the organisation can check and decide upon; they are bringing verifiable proof. I contend that this approach will be both better and cheaper than existing KYC models. What’s not to like about better and cheaper in one package?

That then takes me to how this approach will create a new product/ service category - the EDI….The Endorsed Digital Identity. In other words, it does not need to only be states that take this route. They are clearly a good place to start. Buy why not:

CEDI - College Endorsed Digital Identity as proof of student status and qualification

EEDI - Employer Endorsed Digital Identity as proof of role

HEDI - Healthcare provider Endorsed proof of circumstances/ eligibility

And no doubt many more; whole businesses in there I expect. And as a colleague pointed out, we just need to find one beginning with J……

Then back to Estonia. There is nothing whatsoever to stop Estonia adding state endorsement to credentials for their citizens (or indeed for citizens from elsewhere). That’s one of many great things about the SEDI approach; it triggers a race to the top.

Who else might get involved?

I have some vague aspirations of a tartan SEDI 2, Scotland Issued Digital Identity. We certainly need something like that to help address NHS challenges around personal data, and cross-life aspect/ sector data sharing. That would be do-able, and would be an ‘AND’ not an ‘OR’ alonsgide UK.Gov digital identity plans. (I think SEDI is too early for the UK.Gov main plans around identity; but they should certainly be looking at it as that AND not OR).

Or maybe (for Mike Riddell and his projects) SEDI 3, Stoke Issued Digital Identity. This model would work much more readily for local authorities in UK than for the giant central government machine I think.

Clearly, a lot more to say on this direction. But hat’s off to the State of Utah for making that leap.

That’s what began to emerge two weeks back over at Internet Identity Workshop number 42 in Silicon Valley. As ever, a fantastic gathering of people trying to enable the best of The Internet to emerge, whilst also trying to limit and mitigate the worst. And last week it felt like we were making tangible progress in one big and good direction.

I’d summarise that in the visual below…. Data FOR people is much more valuable than data ON people. The former is future looking and empowering. The latter increasingly toxic…., like a fossil fuel. That is to say the only approach available at a prior point in time; but increasingly seen as having harmful planetary-scale side effects.

So what are those three components mentioned in the opening paragraph; and why are they so good in isolation, and more so when combined? Let’s look at each:

1. SEDI - short for State Endorsed Digital Identity, prototyped by the State of Utah but i’d expect that to go much wider, deeper and more geographically spread. This approach is highly empowering, exemplified by the initial use case - the state endorsing an identifier for a newly born child in the process of a birth registration. Like a more evolved of our old DIDs 4 Kids project in MyData.

2. MyTerms - aka IEEE 7012, the recently published global standard for machine-readable privacy policies written from the perspective of the individual

3. Personal AI Agents - AI powered software agents working for individuals on a fiduciary basis; with duties of care, loyalty and fidelity

I’m obviously in creative photo mode today; here’s how I see the above in pictorial terms.

So - the road to empowerment is powered by those 3 complementary, future-looking and sustainable forces. If we looked the other way, we’d see the current model - industrial, fossil fuel powered and much uglier. (It’s actually the road to Stirling in Scotland….)

It was therefore great to see at IIW that all 3 were very much front of mind and conversation. And that went further in this post from Phil Windley noting that MyTerms can be the ‘rails’ for SEDI. And Drummond Reed making a similar connection between Personal AI agents, online trust, and MyTerms. I can’t find that presentation online but will try down the track

Imagine then - the vast power and potential of AI, working un-deniably for people, on terms that are worthy of trust. Best get back to building that then.

This post is dual-purpose. It acts the notes for a session I ran at The Internet Identity Workshop number 42. And then as my wider sharing of the same subject matter.

The subject was as above from the session announcement. My thesis is that we are now at the point where all of the tooling required to empower people in the digital realm is in place. And therefore the focus moves to specific implementations and adoption.

We discussed each tool or component in turn. We only had an hour so did not get too much detail on the fiduciary AI agents capability.

1. Sovereign hardware

We used the example of the Fairphone to ilustrate this point. This comes from an EU based provider, runs on a ‘de-googled’ version of Android with added privacy features, and much favours open-source and privacy-minded apps and utilities in their also de-googled App Store. Cloud back-up tends to use Nextcloud; so robust in functional terms and definitely more private.

The net result of this approach at this stage is that the Fairphone user has a sophisticated smart-phone, with all parts replaceable; and no tracking from the operating system perspective. Apps can conceivably track should they persuade the user to enable that. The approach still has some rough edges; but privacy minded people could now quite safely choose this direction for their next smartphone.

This is just one example of many of privacy-minded and ‘local first’ hardware and connectivity.

2. Identifiers/ keys (self-sovereign, self-created owned and controlled)

‘Keys’, that is to say decentralised identifiers/ DIDs with cryptographic properties that are a representation of an individual online, are clearly on an upward trajectory with many ‘wallet providers’ now in the market with various focus areas.

The one we majored on in this discussion was the soon to be launched MyKey (https://www.mykey.me) which has the USP of being highly functional; but also directly created, owned and controlled by the individual who wishes to gain more control over their sign-up/ sign-in methods (with other properties mentioned below). Conceptually, and before too long in reality, these keys/ identifiers can be life-long and thus highly enabling for individuals - because they have the capability to be transferred across service providers (like a mobile phone number), and have mechanisms to deal with ‘lost phones’ or compromised digital relationships.

The underlying point here is that if YOU don’t own and control the primary means of representing you in the digital world then SOMEBODY ELSE DOES.

3. Identity (of a human)

A subset of the MyKey app is identity itself; and verification/ use thereof.

By that we mean what amounts to a core profile data-set. Typically name, date of birth, gender, home address and contact details. So the data asked for and provided to a significant number of the organisations we each deal with online.

Each of those data attributes might self-asserted, or assured, or otherwise verified.

In technical terms the variant of this we showed in demo was the standard Open ID Connect core profile. That is the profile that sits inside all ‘social sign up/ in’ methods; e.g. ‘sign in with Google’.

4. Persona/ Context (roles within human)

We all have one body, but within that typically operate in different persona or ‘contexts’. This can be as simple as ‘me, the default one, or ‘me at work’, perhaps ‘me the parent’, ‘me with power of attorney for someone else’. In the physical world we flit in and out of these different contexts invisibly. In the digital world we will often have different profiles or associated data attributes to signify these differences. In practical terms in our demo the individual signing up for/ into an online service can set up these different profiles, and then choose with which they are entering into a relationship.

This capability becomes really important for example in engaging AI agents, which need to know the context on/ in which they are operating in order to deliver appropriate responses.

5. My Data (personal)

Associated with each persona/ context there can and will be LOTS of data. Simplistically, which I think is necessary to scale, I mentally and technically bucket this data into these five categories:

- Core Profile(s)

- About Me

- Things I Have (or had)

- Things I Want

- Jobs to be Done

That subject is huge and complex, and includes the various interpretations of ‘how does a person manage their data?’ That includes personal data stores, vaults, pods, wallets and many more. But for now this is just the physical storage. For now, and for the majority of people they typically have two methods:

- Physical storage, filing cabinets for example, holding paper copies of key documents; birth certificates onwards

- Scattered across hundreds of web sites and apps, behind the terms of service and privacy policies or other. And maybe a spreadsheet, password manager or similar tool that are populated manually.

Neither of the above are sufficient, but that is now being addressed in the market with various options available. The one shown in the session was DataPal, a fiduciary data service in UK.

6. API’s to/ from My Data

For the currently small number of people using a personal data service/ store/ vault/ pod, they will usually have some form of API and/ or webhook approach. These enable external parties to read or write (or both) to a persons own data store.

There is an important branch of these APIs being driven by regulation, specifically in EU. The Digital Markets Act mandates real time APIs that enable people to pull data out of the 7 huge ‘gatekeepers’ (GAFA plus Microsoft, Booking.com and TikTok). And another branch in the form of The Data Act, which does as above for IoT devices and services - including cars.

This will be an area of huge growth over the next decade.

7. Terms and Conditions of Service (ToS)

These typically ‘contracts of adhesion’, and their close cousin below (privacy policy) are what underpins many of the ills of the digital realm today.

They will continue conceptually much as they are, because every service is entitled to set out what it is, how to engage with it, how much it costs etc.

But two improvements will happen over time:

- AI agents, especially those acting on a fiduciary basis for individuals, will increasingly shine a light on deeply opaque practices within the ToS, and help their humans avoid such services. Or at least not stumble into them with no or limited awareness.

- Personal data practices, currently often conflated into the ToS, will be held separately so that they are more easily upgraded to standardising approaches such as MyTerms.

8. Privacy Policy (inc. cookie banners et al)

This is where MyTerms/ IEEE 7012 directly impacts. Quite simply a MyTerms agreement is a direct equivalent and thus an optional replacement for an organisation’s own custom built privacy policy. It addresses the long since unreasonable practice in which we humans have a different privacy policy in place with every single organisation we deal with. Compounded then by the fact that we don’t read them anyway.

9. Registration/ account (the relationship artefact)

We showed the latest version of the MyKey app proposing a MyTerms agreement, signing up/ in to a demo site, and recording the signed agreement.

That video demo is at the link below.

10. Agency (doing stuff across the infinite loop)

Now somewhat short of time in the session, we simply noted that significant difference between

• Fiduciary AI agents, that work for individuals and only individuals with a duties of loyalty, care and fidelity

• Non-fiduciary agents, which may provide very useful services for individuals; but ultimately owe their allegiance to the entity that runs them as a service

Each of the above could easily be an IIW session on their own; so this was a skim through to back the original assertion that the tools that are required for ‘VRM’ and empowered people online are now in place; albeit at a base level. So the path from here must turn to adoption.

I guess I’ll return to that, and no doubt some of the above for more detailed drill downs over the next few weeks and months.

Firstly, let me share some evidence of customers very clearly voting with their feet and being able to do so… I’ve done the EDI-SFO flight via Dublin more times than I care to remember. I go through customs in Dublin to save the queue at the other end. It usually takes an hour to get through that process with a huge queue. Today - no queue whatsoever. Ten minutes to get through end to end, so time for a nice relaxing pint of Guinness (or two) before my flight. Then…, plane 70% empty. So thanks to whoever is steering how many people are travelling EU or UK to USA right now.

That leads in to ‘what do we mean by a free customer anyway?’. My friend and colleague John Wunderlich has a great way to summarise this; he says ‘a free customer stays because they are locked-on, not because they are locked-in’. If I un-pack that, I think we mean something like ‘relationships between customers and their suppliers in which the customer is in the relationship because they want to be, not because they have to be; or have been trapped. Another friend and colleague, Doc Searls unpacks that further, reminding that corporate speak about customers often involves words like ‘branding’, ‘targeting’, ‘capture’ and ‘lock-in’ - none of these have great connotations when one takes a step back.

Compare that with how things used to be between individuals and their suppliers; effectively before the digital age really kicked in. Things that were the norm included:

- Either party could get in touch with the other, usually through non-invasive means

- Both parties had their own useable copy of interaction and transaction records

- Face to face interactions and conversations; which may or may not lead to a transaction

- Suppliers not following people around sticking tracking devices on them

- Prices not changing based on who you are, what loyalty programme you were in, and how much the supplier thought you would pay

Needless to say the digital world has completely turned that relatively well-mannered situation on its head.

To cut to the chase, the free customer concept sees us return to a version of that well-mannered means of managing individual to supplier relationships. I think about ‘free’ is about freedom from unreasonable or unfair constraints such as might be put in place when one party has more power than the other. It is therefore ‘free’ as in ‘independent’; that is to say, the relationship typically has no dependencies. The customer is free to walk away from the relationship without significant consequences; as indeed is the supplier. Each party is engaged with the other through choice, trust and mutual benefit. Interaction goes both ways, learning comes from conversations, potential abuses of power are not enacted.

In the IEEE 7012 / MyTerms standard work this is simplified down to ‘organisations should not do in the digital world things that they would not dare do in the real world. In that respect the standard, at the top level, is about manners.

So here’s where I think the economic case for the ‘free customer’ becomes a lot easier to understand and articulate. Actually it’s really simple - both parties are doing business together because they want to. And because they are each meeting the others needs. It’s symbiosis.

But we are miles from that at present. Take the ‘customer experience’ I had at Avis SFO this afternoon.

1. I walk up to the Preferred desk to confirm pre-booked car

2. I hang around for 3-4 mins while the 3 members of staff ‘do stuff’ on their computers.

3. I’m then told ‘we’ve given you an EV’. I say ‘I don’t want an EV, can’t you just give me the small saloon I ordered?’ (driving on the wrong side of the road is tricky enough without having to figure out an EV as well when I don’t have one). Then…

4. ‘We don’t have any of those, we’ll give you an SUV’.

5. OK then, I’ll take that. Then, the bill was about $300 more than I had signed up for. ‘A security charge that gets refunded at the end’ was all the explanation offered.

6. I ask which of the 3 different ‘fuel deals’ I was signed up for. I did not understand the answer but by that time I’d given up and figured I could track it down on the receipt more easily than expect that from the team at the desk.

So…., not symbiosis at all. An ordeal in car hire form. I hate to imagine what the non-Preferred customers get as their experience.

I wish I had a vCon record of that conversation!!!! vCon is great in many ways; but my favourite is that it will shine a light on the vast number of poor customer experience realities.

The trouble is, those car hire suppliers are all pretty much the same. And the same in many other sectors now. Optimisation from the supply side is the norm; the customer can take it or leave it.

How might the free customer concept fix that mess then?

Here’s my thesis, in a Venn diagram.

I think free customers as seen above show up when we get back to more equitable, symbiotic relationships. And that will only come when new capabilities are built on the customer side, to balance up the power grab that has happened on the organisation-side over the last 25 years.

There are two enablers:

1. People with the ability to manage their own identifiers, and their data - most probably via Personal AI Assistants. This combination gives people that ‘place to stand’ in the digital world; personal AI powered agents will do a lot of the heavy lifting.

2. MyTerms/ IEEE 7012 agreements, as the means to bring balance back to relationships (these agreements assume the parties want to do business together..).

Then, the really big shift… organisations willing and able to accept MyTerms agreements.

Why would they do that then? I think two main reasons:

1. A recognition that today’s digitally-enabled, highly optimised customer experiences are often dreadful. The head of CX knows that, so does the CMO; so must the CEO if they look hard enough. The CFO might be quite happy…, the numbers look ok.

2. Innovators, and forward looking teams look beyond the loss of direct control that comes from accepting MyTerms agreements, and see the relationship and then financial benefits that will come along with them.

What might that look like in practice?

Probably not absolutely like this, but I’ll put that out there because I’ll be talking about it next week at IIW as a think piece that illustrates the art of the now possible.

This app (in fact ‘app’ is probably not the right word for it even though it shows here in app form.) In practice this is partly a functional and operational app in private mode in both main app stores. But also part visioning; none of those middle boxes (end points for services) are built as yet; the plumbing for them is. If anything it is the next generation articulation of the Omie concept; i.e. a full empowerment stack and ecosystem built around and for an individual.

I’ll describe what’s under the hood of that below and get into more detail at IIW.

So what’s under the hood?

Firstly, let’s talk hardware. Clearly we can have lots of fancy empowering software, data and terms. But if our hardware is doing all sorts of things we’d rather it did not do (especially around lock-in), then that’s a problem to be taken into account. That’s frustrating because our phones these days are incredibly empowering, high end computing devices that we have with us often 24 hours a day. We need the good parts of that without the bad, and if we get to that then people genuinely have a full empowerment stack working for them and only them. In my case I use a Fairphone (https://www.fairphone.com/) to make that point (alongside an iPhone for now).

The Fairphone has many great features; my favourites:

1. It uses de-googled Android (e/OS) for its operating system; so high end phone functionality without the surveillance and lock-in

2. Every single part is self-substitutable and repairable, batteries, the lot.

3. It has Nextcloud as the default cloud back-up, so functional but EU based and very privacy-minded cloud storage, file sharing and core tools like word processors and spreadsheets.

After the hardware, in the app we have software with multiple important functional components:

1. Identifier(s), in W3C Decentralised Identifier standard format. The are ‘the keys’ in MyKey, encrypting/ decrypting data, signing in to this, signing things, proving things and more.

2. Roles / persona - reflecting that we each play different roles in life that need different relationship management/ login details.

3. Personally managed profile(s) for each role above (default, work, parent of etc). Open ID Connect format so inter-operable with huge numbers of existing web sites and applications.

4. Sign in to MyKey enabled web sites via scanning a QR code (which sites already using OIDC can add just like another social login button). The difference being that this button does not enable surveillance as the others do. Presenting own QR codes comes next.

5. Propose, negotiate , sign and record MyTerms agreements. This is the real magic sauce. All of the other protections are technical in nature. This one is rooted in contract and commercial logic, underpinned by regulations.

All of the above is working now, and is therefore already a significant new capability built to empower individuals online.

Let’s then turn to the thoughts on the second order effects. That is to say, what can then be built when the individual has a strong place of their own online that they can connect other things to - using standard enabling terms.

Those are the 9 boxes and the + icon in the visual above. These look like apps, but are not. They are end points for substitutable services. And they all have one thing in common. They are things that we all need to do, and are the same basic tools across many organisations and even personal relationships. So unlike current apps that are organised (built in or via the app stores) by providing organisation; these are open source capabilities, organised by what they do.

The substitutable aspect means that people can disconnect their own side of the relationship with a service provider without any interruption or change in the core service. A bit like home energy, I might change from British Gas to Octopus Energy. The core service remains the same, differentiation comes from the things around it - price, or quality of customer service for example.

As these are person-controlled access points for multiple core services, this app/ capability itself can be seen as one almighty strategic control point for people online. Much needed, and now tantalisingly close.

Let’s look at each of these hypotheses briefly to ponder on their potential value to people.

1. My Agents - the connection point for multiple personal, AI powered assistants working for people on a fiduciary basis. Or non-fiduciary agents willing and able to connect on MyTerms.

2. My Calendar - the single point of control through which other parties can read from or write to my master calendar; which itself separates its data from its interface. A lifelong listing of calendar events if you will; backwards and able to project forwards.

3. My Cart - as Joyce Searls has long said, ‘why can’t I take my own shopping cart around the web with me?’. Quite… And more than that, there is no constraint on how that cart operates. It might keep a record of everything I’ve ever bought, and use that to help me figure out next best actions, what to buy, from whom and when. And then many more obvious extensions when the principle is established. Like micropayments; more on that below.

4. My Contacts - the long talked about but now much easier to deliver ‘Smart Address Book’.

5. My Messages - a single in and out point for messages, irrespective of channel. And recorded in vCon standard format where useful for downstream use.

6. My Payments - as above, as single in and out point; this time for payments irrespective of account or payment method. This can certainly extend to deliver the long discussed micro-payment capability.

7. My Proofs - dealing with the many and varied times through life when we need to prove things. One of many processes this improves upon is ‘KYC/ Know Your Customer’. When customer-side tooling is engaged this goes from ‘show me some evidence’ from the organisation side to ‘would you like proof’ from the individual side.

8. My Receipts - the delivery of useable data on the things I have bought will be transformative on the individual/ demand side of the economy. Then will have many positive downstream effects on the supply side and both parts of the economy become much more in sync and data driven.

9. My Tasks - the proverbial ‘jobs to be done; but now brilliantly, consistently and easily articulated via AI. And then shareable on MyTerms and undertaken, most often, by personal fiduciary agents.

10. The + Icon. This simply articulates that the above list is not finished. Not quite an app store for capabilities; but yet some means through which new ones can emerge to continue the race to the top.

Whew…, a lot to think and talk about there then.

Actually, I think this post will need a follow up…. That’s what happens when I sit on a plane for 10 hours!!!

Next up then, the next Scottish Enlightenment….; and digital birth certificates.

It’s a familiar phrase—heard on train platforms as a warning to passengers. A small gap, perhaps. But one that, if ignored, can cause real problems.

In the digital world, there is another gap. Far larger. Far more consequential.

A gap between what organisations—and regulators—believe is acceptable behaviour when it comes to personal data…
…and what individuals actually expect.

This is the Trust Gap.

And right now, it is widening.

The Trust Gap Is Real—and Structural

There is a growing disconnect between the experience individuals have online and the standards organisations are meeting.

Organisations point to:

• Cookie banners

• Privacy policies

• Consent mechanisms

• Regulatory compliance

As evidence that they are acting responsibly.

Regulators, in turn, assess whether these mechanisms meet legal thresholds—and in many cases, they do.

But individuals see something very different.

They see:

• Endless pop-ups designed to nudge “Accept All”

• Policies written for lawyers, not humans

• Repeated requests for the same data

• News of breaches from organisations that were “fully compliant”

The result?

A system that is technically compliant—but fundamentally distrusted.

Three Gaps, Not One

To understand the scale of the issue, it helps to break the Trust Gap into three distinct layers.

The Expectation Gap

Individuals expect:

• Transparency

• Fairness

• Control

• Respect

But what they experience is:

• Opacity

• Friction

• One-sided terms

• Minimal real control

People believe they are in a digitally-enabled relationship.
Organisations behave as if they are processing a resource.

The Understanding Gap

The current system relies heavily on the concept of “informed consent.”

But in practice:

• Privacy policies are rarely read

• Even more rarely understood

• And almost never actionable

All three are designed to be that way.

If no one reads it, understands it, or can meaningfully act on it—can we really call it consent?

What we have instead is an out-dated ritual.
A moment of interaction that signals compliance, but delivers little comprehension.

The Power Gap

Today, organisations define the terms of engagement.

Individuals are given a binary choice:

• Accept

• Or leave

That is not empowerment.
It is coercion—with a softer interface.

Even where rights exist—access, erasure, portability—they are difficult if not impossible to exercise, inconsistent in execution, and disconnected from the moment of interaction.

People become rationally dis-engaged. They don’t like what they have to do to get things done online; but they also know they have no option but to do so. It’s not as if the other services they could use behave any differently.

The Compliance Trap

At the heart of this issue is a subtle but critical shift.

Many organisations have moved from asking:

“Is this the right thing to do for our customers?”

To asking:

“Is this compliant?”

Compliance is, of course, essential.
But it is not sufficient.

Compliance is internal-facing.
It asks: Did we follow the rules?

Trust must be outward-looking.
It asks: Will you act in my best interest?

Somewhere along the way, compliance won.

And in doing so, we have created a system where:

• Legal defensibility is prioritised over customer understanding and experience

• Minimum viable compliance replaces meaningful engagement

• Responsibility is demonstrated—but not necessarily felt

The Role of Regulation

It would be easy to place the blame solely on organisations. But the reality is more nuanced.

Regulators have done an enormous amount to establish rights, frameworks, and accountability.

But in doing so, they have also—perhaps unintentionally—standardised a broken interaction model.

• Cookie banners and their underpinning frameworks have become legal theatre

• Privacy notices have become liability shields

• Consent has become a compliance artefact

Regulation optimises for enforceability, but then fails, in the main, to enforce.
But individuals need usability and agency.

The result is a system that works on paper—but is broken in practice.

The Human Cost: DPOs in the Middle

Nowhere is this tension more visible than in the role of the Data Protection Officer (DPO).

DPOs are tasked with protecting individuals, and enabling their rights
But they operate within organisations driven by commercial, operational, and technical realities.

They are often asked to:

• Interpret complex regulation

• Translate it into organisational policy

• Ensure compliance across fragmented systems

• And represent the interests of individuals—without direct mechanisms to do so

In effect, they sit between two worlds:

• The expectations of individuals

• The constraints of organisations

Without the tools to fully reconcile the two.

A System Designed for Friction

The current model doesn’t just fail to build trust—it actively erodes it.

Consider the experience:

• Repeated consent requests across every site

• Default settings nudging maximum data capture

• Complex opt-out processes

• Data held in silos across multiple organisations

We have designed a system where:

• The safest choice is often the most inconvenient

• The easiest choice is the least informed

Over time, this leads to:

• Consent fatigue

• Learned helplessness

• Disengagement

And ultimately—distrust.

The Economic Cost of Low Trust

This isn’t just a societal or ethical issue. It’s an economic one.

Low trust creates inefficiencies across the digital economy:

• Poor data quality (because users provide minimal or inaccurate data)

• Higher acquisition costs (because relationships lack depth)

• Increased regulatory overhead

• Greater reputational risk

• Reduced long-term loyalty

In short:

The Trust Gap is not just a moral problem.
It is a structural inefficiency.

Bridging the Gap with MyTerms

If the problem is structural, the solution must be too.

This is where MyTerms comes in.

MyTerms introduces a fundamentally different model—one that shifts the point of control from organisations to individuals.

It does this by enabling:

• Machine-readable, standardised expressions of individual intent

• Persistent, reusable permissions

• Clear, explicit agreements between parties

Rather than asking individuals to navigate endless variations of organisational policies, MyTerms allows them to define their own terms—once—and use them everywhere.

We can visualise the Trust Gap and MyTerms as below.

From Consent to Agreement

The most important shift MyTerms enables is this:

From consent → to agreement

Today:

• Organisations set the terms

• Individuals react to them

With MyTerms:

• Individuals express their terms

• Organisations choose whether to engage

This creates a fundamentally different dynamic.

Today

With MyTerms

Organisation-defined policies

Individual-defined terms

One-size-fits-all

Personalised permissions

Passive consent

Active agreement

Legal text

Machine-readable signals

Creating Symmetry

Perhaps the most important outcome is symmetry.

Today’s system is deeply asymmetrical:

• Organisations operate at scale, with structure and automation

• Individuals operate manually, reactively, and inconsistently

MyTerms levels the playing field.

It allows individuals to:

• Express preferences once

• Apply them consistently

• Enforce them automatically

In doing so, it brings individuals closer to operating with the same clarity and scale as organisations.

A Better Role for Compliance

Importantly, MyTerms does not replace compliance—it reframes it.

Compliance becomes:

• A baseline

• A prerequisite

• Table stakes

But it is no longer the goal.

Instead, the focus shifts to:

• Alignment

• Transparency

• Mutual agreement

In this model:

Compliance is a subset of trust—not a substitute for it.

A Glimpse of What’s Next

In a MyTerms-enabled world:

• Cookie banners disappear

• Permissions persist across services

• Data flows with intent, not assumption

• Individuals are supported by agents acting in their interest

Organisations no longer need to guess what users might accept.

They know.

Because the terms are explicit.

Closing the Gap

The Trust Gap isn’t closing on its own.

In fact, left unchecked, it will continue to widen—fuelled by increasing complexity, more data, and greater automation.

We cannot solve this with:

• More banners

• Longer policies

• Additional layers of compliance

We need a different approach.

A different infrastructure.

A different contract.

Because if we want a digital economy built on trust, we need to stop asking for consent…

…and start agreeing terms.

I think that place to stand, and the lever, have just shown up.

Some context….

We humans have a good track record of developing tools that help us exist and sometimes even thrive in hostile environments.

- Underwater we have wetsuits and scuba gear

- In space we have pressurised space suits

- In extreme heat we have fire proof suits and breathing apparatus

- At extreme heights we have oxygen cylinders and masks

So, we adapt…

I contend that ‘Digital’ is also now a very hostile environment that we humans operate in. Surveillance, deliberately addictive products, fraud, theft, triggering news dominating feeds, personalised pricing, AI slop, deepfakes, mental health assault. And no doubt more. So we need to adapt and get the right tools to keep those humans safe, and even enable them to thrive in the digital environment.

What tools might help then? We have tried things like ad blockers. But that’s a sticking plaster on an open wound when set against the assault wave that adtech and AI has triggered.

So, what else could we use? And how would that change things?

The place to stand…. I think that means a person must have a tiny little piece of the digital realm that is their very own. They must create it, they must control it, they must own it. They could theoretically run it themselves, but more likely they would appoint a service provider to do so on their behalf. But that service provider would have to operate on a fiduciary basis. And the service provider must be 100% substitutable. With no lock-in.

MyKey is such a tool, a personal agent if you will. One that provides that place to stand, and manages connections to and from that place. A relationship manager.

Then the lever…, which gives a person leverage? I think that is the MyTerms standard. When the individual has that place to stand and they need / want to interact digitally with another entity, they can use their stance to propose means to manage their digital relationships. They can propose terms that are standardised, machine-readable, and more equitable than the current norm.

What can that mean in practice? I think that is simple, but profound. When we, as individuals, do not have strong relationship management tools of our own, we are always dis-advantaged and need to deal with every organisation separately – on their terms.

Here’s how that looks. In the current technical model, organisations always run the ‘server’, and individuals can only be a client of each individual; one by one. Servers have the power and set the terms; clients can only do as they are allowed to by the server.

But here’s what changes when we have that place to stand, and the lever. The individual is dealing with all of their digital relationship through the one tool. And that tooling is intelligent, flexible and has inherent capability of its own (the lever). So those relationships become equitable and balanced.

Two things then happen…

In practice individuals would ‘employ’ an AI agent at that interface to manage those relationships. They can do so because the agreements that define the relationship are standardised and machine-readable. And organisations can do the same. So Server - Server becomes Agent - Agent.

And, as the digital relationships are now running on equitable agreements rather than contracts of adhesion and meaningless consent, trust grows continually over time. This leads to a positive sum game. Or a ‘tide that floats all boats’; ok maybe not for those boats/ organisations that fight against that tide and stick with their dominant power position for as long as they can.

Here’s a first look at that place to stand, and the lever it enables.

We call it MyKey. It’s your’s and it keeps your (digital relationship) key(s).

And here’s the lever….

Both place to stand, and lever are early in their implementation. The team and I will be actively working on both over the next few weeks and months with first test sites up and running in April.

Where that goes…, well that will be very interesting indeed.

When people have strong, future-looking, standards based tools of their own many things that previously been hypothetical become possible:

• Can I genuinely be a strong point of origination and integration for data about me? Absolutely.

• Can I have my own smart shopping cart that I take around the web with me that has my requirements, preferences and context built-in? Absolutely.

• Can I use new micro-payment based approaches at my end to enable moving beyond the current advertising and surveillance based model for funding The Internet? Absolutely.

• Can we completely re-shape the flow of data between individuals and organisations and make them much more equitable and enabling of a race to the top? Absolutely.

• Can we completely re-invent key business concepts such as ‘Know Your Customer/ KYC’ and Consumer Protection? Absolutely.

• Can we re-invent the $700bn a year monster that is digital advertising, and make it something people actually welcome rather than avoid? Absolutely.

• Can organisations create completely new customer experiences that see customers, citizens, users, volunteers, patients, employees and more as equal parties to a relationship? Absolutely.

• Can all of the above be safely overlaid and enhanced by AI and genuine agency for individuals? Absolutely.

Endless positive possibilities become possible when we move beyond the weaknesses in the current architecture, and build genuine digital capability on the side of the human.

So maybe Archimedes was right after all….

The programme and related bill outlines that identity belongs to the individual, not to the government. The role of the state is to verify, endorse, and protect. In practice, this means the state can attest to facts, such as age, or residency, while the individual retains control over how those facts are stored, presented, and shared.

What I like most is the associated Bill of Rights. I’ve re-shared that as is below, and then added my own derivation that looks at these rights in individual/ first party language.

63A-20-101. Digital identity bill of rights.

The following rights constitute the digital identity bill of rights in this state:

1. An individual possesses an individual identity innate to the individual's existence and independent of the state, which identity is fundamental and inalienable.

2. An individual has a right to the management and control of the individual's digital identity to protect individual privacy.

3. An individual has a right to choose, receive, and use a physical form of identity assertion that is endorsed by the state.

4. An individual has a right to not be compelled by the state to possess, use, or rely upon a digital form of identity assertion in place of a physical form of identity assertion that is endorsed by the state.

5. An individual has a right to state endorsement of the individual's digital identity upon meeting objective, uniform standards for eligibility and verification established by law, and a right to not have such endorsement arbitrarily or discriminatorily withheld or revoked.

6. An individual has a right to have the state's operation of digital identity systems governed by clear standards established by the Legislature, including for eligibility, issuance, endorsement, acceptance, revocation, or interoperability of digital identity assertions.

7. An individual has a right to transparency in the design and operation of a state digital identity, including the right to access, read, and review the standards and technical specifications upon which the state digital identity is built and operates.

8. An individual has the right to choose what identity attributes are disclosed by the individual's state digital identity in accordance with standards established by the Legislature.

9. An individual has the right to any service or benefit to which the individual is otherwise lawfully entitled based on the individual's choice of a lawful format or means of identity assertion without denial, diminishment, or condition.

10. An individual has a right to be free from surveillance, profiling, tracking, or persistent monitoring of the individual's assertions of digital identity by the state, except as authorized by law.

11. An individual has a right to not be required by the state to surrender the individual's device in order to present the individual's digital identity.

Each of the above has a longer and useful description. But for me the logical derivation of these principles is to move them into ‘first person/ first party’.

Here’s my first stab at that.

1. My existence is independent of the state.

2. I have the right to manage and control my own digital identity to protect my privacy.

3. Where and when I need to prove my identity, I have the right to choose and use a physical form identity credential and not be made to use a digital equivalent should I prefer not to do so.

4. I have the right to never be forced to use digital forms of identity should I prefer to not do so.

5. I have the right to have the state endorse a digital identity under my control, provided I meet the necessary standards required by the state for them to do so.

6. I have the right to engage using clear standards around how identity management processes are designed and deployed by the state.

7. I have the right to transparency around how state identity management processes and designed and run.

8. I have the right to choose which of my state endorsed identity attributes are onward shared in any given context.

9. I have the right to service without denial when I use any approved state identity assertion format.

10. I have the right to be free of surveillance, profiling, tracking or other persistent in relation to my use of digital identity in dealing with the state.

11. I have the right to not be forced to surrender my device in order to present a digital identity.

Three thoughts occur when looking at the first party perspective version:

Firstly, that from the individual perspective, the lines between public and private sector can often blur. That a state is able to act in this principled and rights based way should mean private sector could easily go in a similar direction it it wished.

Next, that these rights can and should extend beyond just identity attributes (but kudos to Utah for taking this important first step).

Then, it occurs that this work is all compatible with the IEEE 7012/ MyTerms standard; and if so then maybe over time we could have a twelth right. If so then the empowerment this approach brings to individuals goes through the roof.

Something like…

‘Where and when I am asked to share my identity or my data attributes, I have the right to propose sharing terms of my choosing.

Need to think that through, and maybe get a session or two on that in the upcoming Internet Identity Workshop. I certainly don’t see any barrier to that, rights six and seven are the areas where this emerges I believe. And if there is a fit between SEDI logic and MyTerms, then that means there is also a fit with MyKey, the upcoming MyTerms personal agent.

When I see all this great work coming out of Utah, I can’t help but think back to my last trip over that way. I had gone to take advice from the great thinker - Craig Burton; sadly no longer with us. As well as providing his usual great input, somehow he and I also headed up a mountain.

Can’t help but think he would very much be in favour of SEDI; it follows much of his guidance going way back to the 00’s.

My start point for going up the learning curve is this great article (We Broke Hiring. Now We’re Automating the Damage) from Bill Boorman in which he makes it very clear that AI has done much to negatively impact recruitment processes for both recruiters, candidates and intermediaries. The key lines as I see it….

• ‘Hiring right now feels like two sides responding rationally to a system they no longer trust — and steadily making it worse.’

• ‘In tech, estimates that 30–40% of applicants are fake are now discussed without much embarrassment.’

• ‘To unlock that, platforms have to become two-sided talent marketplaces, connecting candidates and employers directly, with ever current and up to date profiles.’

Then I read Cory Doctorow’s great book about Enshittification. Much of the ‘customer’ aspect of that I was familiar with; not so much the shocking stories around how Big Tech and platforms have driven down wages and conditions in many labour markets. Not least the Gig Economy where ‘my boss is an app/ algorithm’ leads in particularly bad directions. Who can possibly justify offering lower hourly rates to people with a poor credit situation - which the employer can see because the recruiting platform sells them that credit data? More on those labour market problems here.

And finally back to Bill Boorman now pointing to building capability on the side of the candidate as a big part of possible solutions to the problems noted in that initial post. Specifically he says…

• ‘I’m interested in where the market is going and what candidates and employers should expect in return for data access.’

• ‘Raising concerns about compliance, auditability and human oversight is not anti-AI. It’s the opposite. If this tech is going to scale in enterprise, it has to be trusted.’

• ‘Ask properly. Understand properly. Match properly.’

• ‘The appetite for the anticipated benefit is huge. Compliance and security are the blockers.’

• (Re Disposition data, i.e. application status) ‘My opinion, opt-in should be explicit. Scoring transparent. Humans able to challenge machines. Audit mandatory.’

• ‘Free monetarily, with a cost in privacy.’

• ‘Transparency. Relevance. Fairness. Speed. Control.’

So here’s my thesis. It’s surprisingly simple.

The current mess around recruitment can be much improved by building robust, persisent data services for individuals. That doing so will help fix recruitment process in a strategic, sustainable way. And there will be knock-on improvements in employee-employer relationship management, because that is underpinned by appropriate relationship management tooling.

Enter IEEE 7012, aka MyTerms; the global privacy standard that enables equitable, human-centric data sharing.

I contend that the arrival of the MyTerms standard allows us to bring new thinking and deployment models around sharing of personal data in further education applications, recruitment or employment scenarios.

The new solution i’m proposing become possible only when building inside and around the protective layer that MyTerms/ IEEE 7012 based standard agreements enable.

So, my suggestion is that we build an ecosystem in which:

1. People can choose to create their own personal education and/ or employment related profiles within a digital environment with the working title - The Candidate Cloud. Think CV 2.0….

2. Those profiles are fully controlled by the individuals who create them. They can be updated, shared, moved somewhere else or deleted - entirely under the control of the individual.

3. They can be connected to agents, frameworks and data services INSIDE the Candidate Cloud to enable verification, augmentation, or any other improvement the individual wishes.

4. External parties, e.g. further education institutions, employers or related intermediaries can access profiles inside Candidate Cloud only with the active permission of the individual.

5. Access necessitates both parties signing the relevant MyTerms agreement; i.e. one the covers the specific scenario in which the personal profile is being accessed for education, recruitment or employment purposes.

6. This approach enables the individual to release and iterate on rich personal context and education or employment related interests, requirements and preferences. It is perfectly possible for context to be shared anonymously or pseudonymously if required.

7. The signed agreement enables trustworthy data exchange as data recipients are bound to the scope of the signed MyTerms agreement.

The diagram below visualises that.

So why might this model be better than current approaches?

The big picture, I believe, is that it enables much more efficient (faster) and transparent matching between individuals and their education and work requirements and capabilities, and the education and employment possibilities available to them. This model can be further enhanced by adding the ability to tap into skills frameworks and taxonomies such as Lightscape. And further still by adding standards based means to record and use conversation data with vCon.

Think in terms of:

• Course - Person Score

• Role - Person Score

• Person - Role Score

All running on transparent processes, with an audit log.

Far fetched…? Yes, it’s certainly a leap; but I would contend inevitable given how badly broken the current model is.

I’m confident in the logic of the approach. In fact, so confident the DataPal team has built a proof of concept that has data moving backwards and forwards with one modern recruitment platform. Here’s a high level view of that.

We’ll keep on tinkering with that for now and then write up the findings in more detail.

The technology stack that underpins these protocols has four components which, in combination, enable us all to be independent actors in the digital realm should we wish to be.

That word independent is critical. In this context it means ‘the individual could exist online with only capabilities that they control; so are not dependent on others for their core capabilities.

Until now (actually the final piece of the jigsaw shows up on 28th Jan 2026 with the launch of the MyTerms standard; aka IEE P7012), individuals have always had at least one of the components of the empowerment stack run outside of their control. And usually all four.

So to remind, what’s required on the side of the individual? Here’s my hypothesis on what we all need if we wish to be genuinely empowered over time in the digital realm. This is not to say that ‘get these four things and everything changes’; that’s a separate adoption point that i’ll come back to. This is about putting empowerment infrastructure in place.

Firstly. We each need to have at least one strong digital identifier in a standards based format that they create, own and control ourselves.

Next up. We should all gather and curate at least one instance of our core personal data that we own and control.

Third. We will all need to engage at least one AI powered agent that acts on our behalf on a fiduciary basis in the digital realm.

Lastly, We should get up to speed on, and begin proposing, MyTerms agreements to organisations that we engage with; and enacting them where the organisation is willing and able.

Each of those things in isolation is important; but it is only when all four are seen in combination that the magic happens? Why so? It’s quite simple, if a person has a strong digital identifer that they create, own and control, their own data-set under their control, and fiduciary agents doing things for them; but no ability to propose and enact their own terms then by definition they will be operating under terms set by another party. Alternatively, if the individual has the capability to propose their own terms but no capability to do much under those terms then that also does not make positive impact on their ability to independently act online.

But when all four come together, we effectively transition to a new, much more modern architecture for online activity.

We transition from the Client - Server architecture that dates from the early 1980’s. This works on the basis that one party (the server) sets the rules of engagement (terms and connection methods) and defines what can be done; and the client does only what the server allows them to do. Some 50 years later that architecture still dominates, and unfortunately for individuals, that has led to organisations running the servers, and individuals acting as those dumb clients (typically in the form of browsers and mobile apps). That model emerged over time, but now explains why as individuals we have to deal separately with every organisation online. If we have 100 online relationships, that means what we actually have is 100 clients talking to 100 separate servers, 100 different privacy policies, 100 user names, 100 passwords and so on….

But what will we transition to?

I contend that we will transition to what in capability terms will be Server - Server, or it might be seen as Agent - Agent (i.e. servers with agentic front ends). The distinction I see is not so much about which technology underpins what each party has; it is more about balance, equity and each of the parties being able to operate independently. And thus, if they wish to achieve something together they do that co-operatively rather than because one party can dictate to the other how they should operate. That more co-operative model will enable ‘two plus two = five’ outcomes and beyond. And thus why the transition is inevitable.

The MyTerms standard both demands, and enables the individual to have that level of independence and agency.

And then, when all parties can conceptually connect to all other parties, then we have a network model. And personal data exchange operates more like banking, or telephony.

Bring it on.

Of course we then turn to the big unknown….., adoption. There is a clear story on that; but let’s enjoy the MyTerms launch as the milestone it is; and then return to the adoption discussion next week.

Here it is…

I believe that the launch of the MyTerms standard, aka IEEE P7012, will see Intent data emerge as a powerful force for good. And, if handled well, be a driver of economic growth.

So, what is it intent data? How will it further emerge in 2026? And what differences will it make?

Intent data defined

Intent, or intention, data has long been recognised as a significant source of value. Doc Searls triggered a focus on the matter in his book (The Intention Economy) on the subject back in 2012. Doc points to the customer-side nature of Intention data; more on that below.

More typically however, over the last decade, intent data has been used by the supply/ organisation side of the market. It is seen as forward-looking, predictive, information such as website visits, content downloads, and search queries—that provide insight into the interests, needs, and potential purchase intentions of individuals. This data theoretically helps identify which people are “in-market” and actively researching solutions, allowing sales and marketing teams to prioritise leads and personalise outreach. Intent data is often associated with ‘buying things’; but can equally well apply to other aspects of life such as looking for a new job, checking out college courses, researching medical issues and similar.

For me, i’d tighten that definition a bit. I’d suggest we see intent data as ‘data in context, which specifically describes a requirement for a future potential purchase, action or decision to be taken’.

Next there is then the very important question, ‘where does that intent data come from?’. This is key to my thesis that Intent data will power forward in 2026.

There is that one currently assumed source, observed or derived intent. This comes typically from surveillance and tracking activity (adtech or martech); data brokers, or market research style surveys. The individual is usually a passive actor as regards consciously articulating the requirement; and the provenance of the intent signal can be difficult to track.

My thesis is that a second source will emerge through 2026 and beyond. For now i’ll call it Intent on MyTerms. A better name will emerge; but for now that will suffice; and it is highly descriptive… Yes, you guessed it, the new source I see emerging comes more directly from the individual. And they do so because there is a new MyTerms agreement (Personal Data Contribution - INTENT/ PDC-INTENT) designed specifically for this purpose.

(NB: the best name may be ‘Intentcasting’, which Doc outlines in the book. That framing has been around since 2007 or so which is good, but we need to more consciously define or re-define intentcasting in light of MyTerms being available).

The definining characteristic of Intent on MyTerms is that it is a result of a conscious decision in ‘going to market’ to share information IN ORDER TO SOLICIT RESPONSES. In other words, it is the individual equivalent of the classic B2B ‘Request for’ intent signalling and describing methodologies:

• Request for Information (RFI). Purpose: To educate the buyer about market offerings, vendors, and potential solutions when needs aren’t fully defined.

• Request for Proposals (RFP). Purpose: To solicit detailed, comprehensive solutions, pricing, and timelines from shortlisted vendors for a specific product/ service/ project.

• Request for Quotation (RFQ). Purpose: Used when specifications are clear and the goal is purely competitive pricing.

That sounds like quite a leap forward you say; and yes it is. So what makes me think it is possible? Two things, in combination:

1. MyTerms enables detailed requirements data to be shared safely, with built in fiduciary duties to the individual

2. Agentic commerce, the now very fast moving capability to have buying and implementation processes supported by AI-powered agents

That combination is rocket-fuel for buyer-centric commerce. Which in turn becomes rocket-fuel for economic growth.

What will that feel like?

Imagine:

• Not having that cringe-worthy ‘consent check-box’ moment when you just know you are going to be swamped by marketing messages just because you were exploring buying something. (or worse, the ongoing adverts after you have bought the item you were considering).

• Being able to have AI-powered fiduciary agents running all those taking on all of the automatable aspects of going to market; but calling on the ‘human in charge’ as and when required.

The visual below shows an agentic commerce capability being developed by The DataPal team. Two things are clear from this work:

1. The hype around agentic commerce is well-deserved; there are some very real and very important new capabilities on the horizon, but;

2. There are also some aspects that are very much in the ‘still being worked out’ area.

In some of those ‘still being worked out’ points, the emergence of MyTerms will really help. For example, agent identity’ is dealt with in the MyTerms agent appointment. ‘Who does this agent work for?’ is also addressed, in a MyTerms scenario, the delineation between ‘works for person’ and ‘works for an organisation’ are also very clear.

So how and why will this additional model enable and drive economic growth?

My start point for this in the fantastic Human Context Protocol paper from MIT Media Lab and others. The paper points to ‘Matching markets. There exist numerous matching markets where the addition of technology clarifying users preferences would be particularly useful’.

One of these markets alone, product discovery, powers the global digital advertising industry – worth over $600 billion – which fundamentally operates on the logic of reducing search frictions and facilitating product discovery. Human Context Protocol could enable an active discovery process from the user side, giving users increased latitude in the types of ads they see.

My ‘growth’ thesis then is actually really simple”.

• We all know the old adage attributed to John Wannamaker that ‘50% of my advertising is wasted, I just don’t know which 50%…’. In my own 35+ year experience in advertising and marketing, I think the waste is much higher than 50%.

• The reason for this huge waste is the relative weakness in the digital signals that drive current adtech, martech and sales promotional models. In a matching market scenario, if either of the two inputs to the matching exercise is weak then the match itself can only be sub-optimal. That is to say, there will be many false-positives. People who, from what is visible to the machine, may be ‘in market’ for a product or service category, but who in practice are not.

• This is un-fixable in the current paradigm, in which the demand side/ individual inuitively or otherwise knows that they cannot and should not share any more than minimum context and intent data. (much of the point of current organisational approaches to ‘terms’ and privacy policies is to mask the current grab around anything that can be interpreted into ‘intent’ data).

• But MyTerms changes that dynamic, and specifically does so with PDC-INTENT which is absolutely aimed at enabling people to safely share rich context and related intent data.

• So, when input data to the matching process is much improved, the match itself will be much improved (a win for both parties).

• People actively in the market are self-indentified in order to get the market information that they seek.

• And those not in-market (or no longer in-market) also can be excluded from activity, thus eliminating significant amounts of waste.

Growth therefore comes from reduction in waste, which can be recycled into more productive uses. And then the many upsides that emerge from people finding the right product/ service/ solution to their requirements more quickly, easily and with significantly less exposure to widespread sharing of their peronal data.

Next up…., the related concept of ‘Product-Customer Fit’.

The 1998 update of the Act brought forward ‘consent’ as a big focus. By that time, The Internet was becoming a thing to be taken into account. The ‘consent check box’ emerged as a process in which a degree of friction was added into the registration processes of websites and applications. This friction was deliberately designed in to give individuals pause to read, understand and decide whether they wished to provide their data to enable whatever relationship they were engaging with at the time.

Personally I think that this concept was pretty much broken from the start. I certainly don’t recall any large scale consumer research commissioned either by regulators or large organisations that looked at differing approaches and concluded on the optimal one being ‘check this box to confirm that you have read, understood and agree with our terms and conditions and privacy policy’. Each organisation might research their own customer experience around registration; but ‘that bit the lawyers do’ was often out of the research scope and assumed to be un-touchable by marketers and customer experience professionals.

And then the killer problem around consent…. Whilst organisations might research their own domain; it seems no-one was been looking at the overarching effect of adding that friction many times over. That is to say, if one only looks at the registration process for one organisation, then one is presumably assuming that the individual would spend a few minutes on that necessary friction. But no-one is taking ownership of that friction multiplied many times over given that we can all easily have 100 online accounts or more. And that doing business online is now more or less essential across many aspects of life; so that friction increases in volume significantly from the individual perspective. Say 3 minutes x 100 accounts = 300 minutes, or 5 hours.

Then again, maybe that is a significant underestimate, this is how AI explains the situation; seems pretty accurate to me….

Reading Time for Individual Policies

• Average Single Policy: Reading a standard privacy policy takes approximately 27 to 29 minutes.

• Complex or Global Policies: Policies for major tech platforms like Meta (Facebook/Instagram) can take nearly 82 minutes to finish.

• "Consent Fatigue": A widely documented phenomenon is "consent fatigue," where users, overwhelmed by frequent pop-ups and requests across different websites, simply click "Accept All" or "I Agree" without reading the details, just to access the content. This "blind acceptance" undermines the core principle of informed consent.

That’s pretty clear then, the current approach using deliberately inserted friction does not and never will scale.

So why do regulators persist with this model?

I’m guessing that it is because until now there has not been a better option on the table.

MyTerms could be that option.

What then is the game changer in the MyTerms model that enables us collectively to move beyond the current ‘friction’ based model?

Quite simply, MyTerms starts with a different assumption to all prior privacy and data protection models.

MyTerms starts with the individual and builds capabilities on that side of the digital relationship. And not therefore initially on the organisation side, which is where all current ‘protection-minded’ assumptions build.

If you think about that, it becomes fairly obvious that building on the individual side is a perfectly valid construct. It takes two to form a relationship; so why expect only one of them to take on the relationship management burden when it could be shared and co-managed? That does not make MyTerms an easy lift; but the model is certainly now very do-able - for the simple reason that most people now have the highly capable devices that are our smartphones.

In fact I would contend that if people had smartphones before or alongside organisations having CRM and e-commerce then digital relationship management would have evolved very differently. Imagine, individuals coming to form the relationship with tools that:

- are always on,

- are always present,

- are highly programmable

- know and can prove who and where they are,

- and which can connect, communicate and exchange data in any number of ways,

- then just as easily evolve or terminate connections.

That’s a pretty compelling start point for a ‘subscribe to me’ model of relationship management which begins with the individual.

Let’s leap forward then and consider how MyTerms can lead tactically to much better approaches to personal data exchange. And then strategically to much improved digital relationship management.

When the standard publishes in late January 26, it will clarify that, at the top level, it is really a governance standard; more about online manners than anything else. It then sets out ‘the handshake’; the process through which standardised agreements are proposed, discussed, signed and recorded. I think of this as a bit like Docusign for machine readable privacy policies. It enables the parties to propose, discuss, sign and record data sharing agreements (contracts) in a repeatable, sector and geographically agnostic way.

Then, we have the MyTerms agreements themselves. It is probably easiest to think of these as replacements or alternates to what we currently call Privacy Policies. So, a current norm privacy policy is an organisation saying to an individual, ‘here is OUR policy towards YOUR privacy. Whereas a MyTerms agreement enables an individual to say ‘here is MY policy towards MY privacy’. A subtle but important distinction.

On launch, MyTerms will run with 5 standardised agreements. They are covered at the high level on the MyTerms website. But let’s drill into the one that likely has most impact when it comes to addressing ‘the consent problem’. This is known as ‘Service Delivery Only’, or SD-BASE. This is the default agreement for any individual setting themselves up to use MyTerms.

It pretty much does as the name suggests. An individual wishes to sign up for any product or service of some form that has a digital component. This agreement and the MyTerms standard enables them to say ‘I’d like to sign up for this product/ service; I propose we manage the data exchange aspect of this under the MyTerms Service Delivery Only agreement’. Let’s assume, for now the organisation is fine with that as they don’t do any of the things this agreement excludes anyway, such as enabling third party tracking/ surveillance. That proposal can theoretically come in through any channel, including paper or smoke signals. MyTerms/ IEEE P7012 is technology agnostic. But in practice it is more likely to come in from a MyTerms enabled personal agent, mobile app or browser plug-in. It may well come with built-in customer-powered KYC to smooth onboarding. And if both parties are leveraging the machine-readability aspect of MyTerms then there few to zero points at which individuals need to manually get involved in the onboarding process.

On the flip side, if an individual proposes a MyTerms agreement, and the organisation is not geared up to listen for and accept the proposal, then the customer might well have gone elsewhere without the organisation even being aware of their interest. (Consumer Reports Labs have a great demo of organisations winning business because they accept MyTerms, will post if and when I find it online).

The visual below illustrates what can be accomplished with the MyTerms Service Delivery Only agreement when expressed as a browser header. It shows one way in which MyTerms can be deployed as an alternative to the broken consent/ cookie banner model. The agreement can express the individual’s privacy preferences in machine readable form. When received by an organisation this confirms that the individual agrees to provide the data that is essential for the delivery of the product/ service. It also confirms that they wish to provide no data, or data use permissions over and above that required for service delivery.

That being the case, the organisation has no need or remit to serve up a cookie banner and a consent check-box. They already have the details they need for privacy regulation (e.g. GDPR, ePrivacy) compliance at their end; and have that recorded in the form of the mutually signed agreement.

We believe that model can and will work well for the vast majority of organisations; they are not doing anything beyond service delivery anyway. This will include much of public sector; and many regulated industries such as banking, financial services and health/ wellbeing which are already constrained towards service delivery only anyway.

And fear not. Organisations that need/ want a bit more granular and optional data exchange will see 4 more agreements emerge in phase 2. Loyalty programmes for example may be well suited to an agreement that offers more flexibility to incentivise greater data exchange and/ or more purposes.

To summarise then, we in the MyTerms / IEEE P7012 team believe that the standard will offer a credible alternative to the very broken current model based on added friction and consent.

The standard and the agreements are built from the individual side; but are well aware of and informed by the practices within organisations, and the needs of privacy and data protection regulators.

In the next post we’ll get into why we think this model will also paint a very positive picture commercially for all willing and able to grab the opportunity.

Or if not, they certainly should.

Why you say?

Quite simply because MyTerms offers precisely that capability. But also does in a more granular, less technical way than one might assume (given other signals in the market such as GPC/ Global Privacy Control). In fact the possibility to send signals that ‘get rid of cookie banners before they show up’ has been our most requested feature through development.

But firstly, what does the omnibus update say? Here are a few highlights…., with MyTerms related annotations from me in bold italics.

• ‘a regulatory solution on the consent fatigue and proliferation of cookies banners is long-overdue’ (yes, consent in this form has long since been meaningless. The UK Consumer Association research on the subject notes that people are ‘rationally dis-engaged’ when it comes to consent checkboxes, cookie banners and similar. That is to say, they know the approach is fundamentally flawed and unfair to them; but also know that they have no option but to go along with it).

• ‘used to track individual’s behaviour and interaction with different online services to provide personalised advertisement.’ (yes, that is why this whole issue persists)

• Many of these online services rely on the revenue from advertising, including personalised advertising. This is also the case for media services. (and here’s the exclusion that seriously waters down the whole proposal)

• Such banners contain information on purposes of processing, often linked to types of cookies, recipients of data, and they are not always easy for individuals to understand. For these reasons they might not achieve their aim – to inform the individual and give control over protecting their privacy and processing of their personal data, but instead are perceived as a nuisance to internet users. At the same time, the providers of online service incur considerable costs to design compliant banners. (both points great arguments for MyTerms)

• For these reasons, it is proposed to immediately simplify the interplay of the applicable rules. (sooner the better)

• The proposed amendments also provide for certain purposes where it should not be necessary to obtain consent and where the subsequent processing should be considered lawful, in particular where they pose a low risk to the rights and freedoms of the data subjects or where the placement of such technologies is necessary for the provision of a service requested by the data subject. (this is where MyTerms really help; they are tied to service provision/ delivery)

• Finally, the proposal paves the way for automated and machine-readable indications of individual choices and respect of those indications by website and mobile application providers and providers of mobile phone applications once standards are available. It gives the Commission a mandate to request the standardisation bodies to develop a set of standards for encoding automated and machine-readable indication of data subject’s choices, and the communication of those choices from browsers to websites and from mobile phone applications to web services. Once these are available, and after a six-month grace period, controllers using website and mobile applications to provide their service are obliged to respect those encoded automated and machine-readable indications. (great, we have long known that MyTerms will work best when the approach is baked into browsers, mobile and desktop OS. And MyTerms has already made a huge leap on the standardisation front via IEEE)

• Where controllers ensure that their websites or mobile phone applications comply with such standards, they should benefit from a presumption of compliance. On this basis, it is expected that browsers also develop relevant settings. (yes, that is helpful; the MyTerms model reinforces that by bringing a robust enforcement model into the mix)

• The provisions are formulated in a technological neutral manner so that also other tools, e.g. agentic AI, could support users in making consent choices, should they be fit for ensuring compliance with the requirements of the GDPR. (perfect, the MyTerms standard requires that people have agency/ an agent acting on their behalf - no matter how simple. This is a smooth on-ramp to agentic AI supporting individuals across their many digital relationship management needs).

But now - the differences between the MyTerms model and what EU seem to be asking for.

Firstly - IEEE P7012, aka MyTerms, is a governance standard undepinned by technology options rather than a technical standard that supports governance. That distinction is critical. MyTerms is, strange as it is to say, more about online manners and etiquette than it is about precise regulatory do’s and don’ts. Check out this great video, itself dating from 2015, on the comparison between norms and behaviours in the online world in comparison with our much more evolved physical world.

Secondly, MyTerms is very much looking forward for many years. We see ‘consent’ largely as a pre-massive scale Internet and web’ construct that will find it incredibly difficult if not impossible to scale to the complex, life-long digital existences that billions of people have from now on. Likewise, the concept that individuals will always be passive, and digital serfs ‘clients’ of organisation-run servers will disappear. When individuals have genuine agency, then brand new capabilities emerge. MyTerms is one of the early steps on that journey.

Then, very specifically, MyTerms is about Contract as the legal basis for personal data exchange. The innovation is that these agreements, when signed, form contracts are written from the perspective of the individual - and in three formats, plain language, machine-language and detailed legal format. All are robust, pointing to the fabulous EU—backed resource that is the Data Privacy Vocabulary where they need canonical, permanent links to key privacy and data protection related words, concepts and definitions. Note that contract can form as a consent if needs be; what matters from the MyTerms standard point of view is that the individual is an active, empowered actor in the dance - that they have agency. In signing ceremony terms that will look and feel quite different to the current model - with obviously the ability to automate as discussed above and below.

Within these standard agreements, there is one that is set as default - and which therefore is sent in MyTerms standard-based browser signals as the individuals’ default privacy preference. At present that is named Service Delivery Base, or SD BASE; but that name may evolve from its technical/ legal start point to something more tuned for mass market. Very simply, when an individual proposes SD BASE as their preferred privacy policy to an organisation they are saying ‘i’m here to look at or obtain a product or service from you. I will happily give you the data that you need for that, and enable you to use that data for the purposes that support product/ service provision and delivery. But no more. I do not want to provide more data than that, or enable more purposes than that’. In other words, ‘just give me the service please, nothing else’. And in further words…, yes MyTerms specifically enables and turbo-charges the long held privacy and data protection principles of transparency, data minimisation, purpose limitation, and reciprocity. There are then several more evolved relationships in the MyTerms registry that allow an increased data exchange. But they only kick-in if the parties, via the methods in the standard, agree to escalate; perhaps to enable analytics, or to request data portability. (each of the standard agreements has a variant that adds a data portability request to the interaction. The only capability that is specifically NOT in any of the standard agreements at present is third party tracking, i.e. surveillance.

So what does all of that mean for the possible intersect between the EU stated requirements in the omnibus update to GDPR and ePrivacy? I would contend that MyTerms could well be a valid solution to the stated EU requirement. It is already coming from a standards body, and is very ethically aligned with core EU principles. The criticism of alternates and existing privacy signals are that they can be too broad and blunt - often forming as a giant NO; you can’t do that. Which is fine in theory, but is then largely ignored in practice.

I would contend that MyTerms, and especially the default ‘Service Delivery Only’ model moves beyond the blunt ‘No’. It is effectively a ‘No…., but’. Or indeed if/ when the individual opts for a more evolved agreement with a specific organisation/ app then it becomes a ‘Yes….., but’. Two more points that may become relevant:

1. The MyTerms standard is about the handshake. The means through which agreements are proposed, iterated upon, signed and stored. A visual of that is below.

2. The agreements themselves (five in phase one and a further eight identified for phase two) are what can flex based on market conditions and their utility in practice.

The standard is due to launch in January 2026, in time for Global Privacy Week. The ‘MyTerms Alliance’ is forming now; that is the group of affiliated organisations that wish to support and enable the development and adoption of the work. Web site for that should be up soon; meantime drop me a note if you are interested in joining.

And let me close on one final reminder of what this is really about. MyTerms is for our Kids.

So, the background. The IEEE P7012 standard, also known as ‘MyTerms’ will publish in Jan 26. It specificies and standardises privacy policies as seen from the perspective of the individual. That is to say, the perspective of the person being invited to share their data rather than the current model that takes the viewpoint of the entity asking for/ recieving the person’s data. The standard will launch with two types of standardised agreements:

1. One-off contributions of personal data (Personal Data Contributions/ PDC)

2. Ongoing relationships that include personal data exchange (Service Delivery/ SD)

This article focuses on one of the former - Personal Data Contribution to AI Training and Operations (PDC-AI). For the individual this presents as ‘A Contract that indicates you are willing to provide access to specific data under your control for the purposes of Training and Operating AI technologies’.

That way the entry point for my discussion with Ben, who rightly asked ‘what could that agreement enable to happen; and why might people want to do that?

We ended up with the visual/ mindmap below that suggests there are at least 9 different identifiable areas in which people could contribute their data for AI Training and Operations through a standardised agreement should they wish to. And that each has associated, actionable benefits.

That looks promising then; it would appear that if the PDC - AI Contribution agreement is in good shape and ways to invoke it emerge that meet the standard specification, then data will flow, with control, from person to AI model training and deployment.

We then noted some questions that came up in discussion which need be addressed for that data to flow to the full extent. These are set out below.

1. Philanthropic

• Should there be contractual terms around how donated data is never commercialised unless the specific agreement purpose actively permits that?

2. Macro Benefit to Me

• How can individuals be sure their contributions actually improve local services, rather than feeding vague “research”?

• Would people stop sharing if outcomes (like traffic reduction) don’t visibly improve within a set time?

• Should data for civic benefit be voluntary, or should it become mandatory (like taxes)?

3. My Brands / Customer Experience

• Do brands risk alienating customers if they create exclusivity — making non-contributors feel second-class?

4. Monetary – Direct

• Is direct payment for data ethical, or does it prey on vulnerable groups who need cash most?

• Does putting a “price tag” on privacy permanently reduce its perceived value?

5. Status / Identity Enhancing

• Does gamifying data contributions risk creating unhealthy competition or even “data addiction”?

• If public recognition is the reward, how do we protect people who don’t want their data tied to identity?

• Could this create elitism — where only those most willing to share get the highest status?

6. To Minimise Risk / Limit Downside

• If people share data out of fear, is that genuine agreement or coerced compliance?

• How do we stop peer pressure from becoming a form of digital bullying (“everyone else shared, why didn’t you”)?

7. Research

• Should ordinary citizens be treated like unpaid test subjects for corporate experiments?

• How do we prevent “personal curiosity” from being manipulated into risky behaviour (“just try this app to see what happens”)?

8. Control / Agency

• Is true “control” even possible when algorithms can still infer data you didn’t share?

9. Reciprocity

• Is “fair exchange” ever possible, when companies always profit more from the data than individuals?

• Could open-source models of reciprocity scale, or will big corporations always dominate?

PDC-AI may be MyTerms’ Most Exciting Challenge.

It feels like there are a variety of different motivations, and people will want to contribute to AI development, if they can do so with genuine agency, protection and personal benefit as noted above.

AI pushes every MyTerms principle into new territory. Transparency means pioneering verification approaches for complex training processes. Data minimisation requires new frameworks for assessing when individual contributions add unique value. Purpose limitation with rapidly-evolving AI capabilities could pioneer “dynamic permission” models where contributors opt-in based on the most recent status.

These aren’t barriers, they are opportunities.

AI model development needs high-quality, diverse, ethically-sourced training data. Individuals have legitimate motivations to contribute. PDC-AI could be the trustworthy infrastructure and guardrails that makes the exchange work.

Each of these questions raised by Ben raised are valid. They and others can and will be taken into account during MyTerms agreement finalising and launch. But my immediate take is that:

1. Some of these opportunities for ‘good’ data sharing for AI training are huge, for example, those around philanthropy and macro-benefits should make a lot of sense to most people if they are assured that the MyTerms/ PDC-AI agreements are genuinely empowering and protect as they need to.

2. The commercial ‘My Brands/ Customer Experience variant will be extremely interesting. It may be that more of this happens in the context of MyTerms relationship agreements rather than the one-off contribution; but both are valid. There is clear existing precedent for AI firms being willing able able to contract for data; the Screen Actors Guild for example have and will continue to make agreements between their members and firms that require AI training data.

3. Given the many questions that emerge, we should tread very carefully in this area and work through the full end to end process with a small number of early MyTerms-adopting organisations before going big on the PDC-AI agreement.

Next up for discussion…. PDC-INTENT….

But there is a more important point in retrospect. MyTerms must also be seen as a mechanism through which our kids can grow up with the massive benefits that digital technology and connectivity WITHOUT the shockingly bad bits that they also have now.

I look at my own two kids. On the one hand, both are very digitally savvy. My 16 year old son (Gen Z) came over to Internet Identity Workshop with me a couple of weeks back and had a great time. That was ostensibly as work/ life experience, and part as a helper at the conference. But it quickly became apparent via him, and other youngsters that were helping out at the event, that they have voices that must be heard on this subject. Indeed he and one of his new friends gate-crashed an IIW session on a kids/ Internet type subject and made the point ‘presumably you’d like our input?’. They did i’m told, and all parties learned from it. So that’s the upside.

The downside, he has grown up in a world full of surveillance. Google Classroom, Snapchat, ‘Insta’. All handled ‘in compliance with regulations’, so far as I can see; but he has grown up in a world of school reports via BI tools, check boxes, terms and privacy policies that are never read, the complete ability to route around weak age restrictions (‘check here to confirm you are over xx’). Next he’ll be learning to drive - black box insurance et al.

I can just imagine all those marketing campaigns queued up now; ‘17th birthday you should buy xxx, 18th…, great you can buy it all….’. Life event after life event being watched and re-sold in the name of consent and legitimate interest. Imagine, then another 80, 90, hopefully 100 years of surveillance. No thanks. It’s immoral. And when it starts under 16, illegal. It takes the concept of ‘customer lifetime value’ to a ludicrous end point.

And then my daughter, 14, and a proper ‘Gen Alpha’. Very clued up, on AI in particular. I asked her to build me a ‘MyTerms image with a fork in the road’. Literally two minutes later she came back with this. Vastly better than I would have managed.

But, savvy or not, they and all the other kids out there are being brought up in a very hostile digital environment. And faced with an endless stream of risks, some of them too horrible to contemplate.

So where does MyTerms fit in that mix? That’s actually really simple. MyTerms agreements mandate transparency, data minimisation and purpose limitation. Thus, ethical services that have a young audience would really benefit from standardising via MyTerms. Imagine not having to wrestle through vast terms of service and privacy policies just to try to understand what is happening under the hood of the app or site - far less be able to do anything about it. It should then be extremely easy to identify kids focused apps that do NOT enable MyTerms. Those that don’t want or can’t handle transparency, data minimisation and purpose limitation….

Personally i’d have them banned from the app stores.

Then…, before I finished this post, I happened to be on a call with some friends at IEEE who pointed me to some great and complementary work already done in IEEE2089. That’s an ‘IEEE Standard for an Age Appropriate Digital Services Framework Based on the 5Rights Principles for Children’. And then IEEE2089.2, which I think is still a work in progress but described in its introduction as ‘The standard defines processes and practices to develop terms and conditions that help protect the rights of children in digital spheres.’.

That does, to me anyway, feel that over and above MyTerms, there are a whole range of ways to improve privacy and safety for kids online. Not before time.

Five days of face to face work at and around The Internet Identity Workshop in The Computer History Museum in Silicon Valley enabled us to take some big steps forward.

We made progress on multiple fronts.

Firstly, I think, through six workshops with expert audiences, we honed our storytelling and how we communicate what MyTerms is about. I think, at the top level, this is as below.

The simple but fundamental shift that MyTerms enables is that people can be equal parties in their digital relationships with organisations. Here’s our emerging logo which visualises that.

So, two hands shaking and a signed contract. Implicitly the hand on the left is the individual, typically the ‘demand’ side; the right is the supply side. Both are equal size. We are still tinkering and evolving that but you get the idea.

Let’s unpack that in more detail then.

On the technical front what we are saying is that ‘client-server’ is the completely dominant current paradigm around how relationships between individuals and organisations are managed. And that does not support that equality in relationship management. One party, almost always the organisation, runs the server and therefore defines what the ‘client’, typically an individual, is able to do - and what ‘terms’ are offered/ available. MyTerms, under the hood insists, on a different model. The standard requires that the individual has an Agent, and that the organisation also has an agent.

In both cases the assumptions is that they are MyTerms specific agents that do the ‘proposing, discussing, signing and recording’ workflow/ set of tasks. The other way to think about that then is ‘Server - Server’ rather than Client - Server. Or Agent - Agent.

The MyTerms/ IEEE7012 standard itself is about that handshake:

1. Who the parties are, and their delegates (agents)

2. The agreement proposal step

3. Dialogue around acceptable choices to both parties to a conclusion

4. Signing of an agreement when the parties

5. Recording of what then becomes a signed contract

The agreements themselves have their format specified in the standard. Their actual content is designed outside of the standard by relevant bodies (in this case Customer Commons and the emerging MyTerms Alliance). That is because the content and precise shape of the agreements could well evolve quickly; and certainly more quickly than the underpinning standard will need to. And we will certainly need geographic variations to deal with specific local contexts.

One way to look at steps 4 and 5 is that it is ‘like Docusign for standardised privacy policies, or more accurately MyTerms Information Sharing Agreements’.

Then on the Wednesday of IIW week, we got the good news that our draft standard had passed a second to last approval step at IEEE; so we now begin work on the publication process. Aiming for January 2026.

One further massive step forward we made that day was when Ben Curtis demo-ed the first (v 0.01) technical instantiation of steps 2 through 5 above. Full video version to follow.

And then a legal workshop with Dazza Greenwood that validated the use of agency and fiduciary law in the MyTerms agreements. And a great discussion on Loyal Agents led by Consumer Reports.

The rest of the week continued in the same vein, with a great Agentic AI Workhop (No 1) on the Friday.

All in all a fantastic week, with much work still ahead. Critically we have multiplied the team of people working on MyTerms by four or five times - those cats ably herded by our great project manager Kari McMullen.

Now, back to heads down working on the agreements…

As such, it might be useful for me to write this placeholder that I can point to many times over to give the short version of the philosophy behind MyTerms/ IEEE7012. Or at least my own interpretation of it. Here goes:

1. The Internet and its various sub-regions (browsers, www, app stores, big AI, IPTV etc) are now very hostile environments for us humans. We have very constrained or negative agency in those places.

2. We, via our identifiers and our data, are captured and enslaved in a perpetual ‘client-server’ model in which we are only allowed to do what organisations allow us to do.

3. We check boxes to say that we have read, understood and agreed to all of this; when in fact we have not done any of those things. (a design feature of surveillance capitalism).

4. We are then subject to ‘optimisation’; and constrained in a model that ensures data about a person is fragmented, and of limited use to the person it relates to.

5. This model of control is part technical (client-server), but actually more by ‘terms’; those dreaded check boxes, terms of service, and privacy policies (a different one for every organisation).

6. Regulators have given us that ‘notice and consent, so called data protection’. That may have been a valid model when first introduced in the 1980’s or so; but is now like applying a sticking plaster to an open wound.

That is where are now I’m afraid. So what can ‘MyTerms/ IEEE7012’ do about that?

Personally I think about it as MyTerms creates a new sub-region of The Internet. Like boot-strapping a new country; one that declares independence from its masters because the people don’t like how they are taxed and governed from afar. Except this time we torch the privacy policies rather than throwing tea in the harbour…..

How can MyTerms do that? I think it does so by being, in effect, a governance model for that new sub-region of The Internet, underpinned by technology and standards-backed processes.

In that new ‘independent free state’ (i.e. governed data space), the following will be the case:

• Data exchange will be bilateral and transparent, underpinned by standard agreements designed to be equitable, but ultimately written from the individual perspective.

• These agreements are contracts, underpinned by contract law; and a valid legal basis for personal data exchange in GDPR. Contracts are signed by both parties to the contract and recorded by agents of each for future reference as needs be.

• All things that legitimately need to be done to provide products and services in both private and public sectors are enabled in these contracts…., except

• No third party tracking or other form of commercial surveillance is allowed in any of the standard agreements. They do enable and underpin healthy, mutually respecting digital relationships.

So, the overarching belief of the team working on MyTerms is that this new sub-region of The Internet, where no surveillance exists and there is no ‘data lock-in’, will flourish. We believe that ‘free customer’s are better than captive ones. Nitin Badjatia writes brilliantly on that here, and again here. And Doc Searls the same for many years.

We also believe that the smartest, forward looking will organisations will agree. And that they will set up agents in the new space and get on with doing business under more equitable terms.

Companies will open ‘embassies’ in that new state where they can engage with these free customers under MyTerms.

That’s the plan anyway; i’m looking forward to making much progress on that next week. Another update at the end of the week.

I do write from time to time on the very broken thing that is data portability. My last detailed iterations were back here , then here, then here; all in May 25 (it’s a big year for data portability clearly…). It’s time for another brain dump on the subject; mainly to help me organise thoughts before a full morning session on the subject tomorrow at the MyData conference.

The new thinking on the matter is that we can and should now clearly articulate the benefits that people can access when their data is more accessible to them or their delegates - because it is portable, i.e. accessible to them in a useful format.

Here’s my ‘starter for ten’ list of benefit areas; there will be more.

1. I Wish to Port my Widget Contract and Use Data for My Own Analysis and Optimisation

2. I Wish to Port my Widget Contract and Use Data for Comparison

3. I Wish to Port my Widget Contract and Use Data in Order to Switch Provider

4. I Wish to Port my Widget Contract and Use Data to a Market Research organisation who are Undertaking Relevant Analysis that I Wish to Support

5. I Wish to Port my Widget Contract and Use Data to an Entity Looking to Aggregate Demand for Group Buying

6. I Wish to Port my Widget Contract and Use Data to an Entity Acting on my Behalf to Register a Case (Customer Service) I May Have

7. I Wish to Port my Widget Contract and Use Data to another Family/ Household Member who Wants or Needs Access

8. I Wish to Port my Widget Contract and Use Data to someone Taking over the Property.

9. I Wish to Port my Widget Contract and Use Data to my Power of Attorney

10. I Wish to Port my Widget Contract and Use Data to my Executor

‘Widget’ could refer to a wide range of products, services or agreements including Home Energy, Home Broadband, Mobile Telephony and Broadband, Cloud Storage, Car Insurance, House Insurance, Life Assurance, Travel Insurance, Bank Account, Credit Card Account, Credit Score, Social Media Account, Rewards Programme, Pension, Investment Account, Employment Contract, Warranties, Playlists Viewing History and no doubt many more.

That all sounds good I hear you say….?

Yes, the promise of data portability is great; however the reality is very different. Despite us all having the general right to data portability under GDPR and similar - just try enacting those rights….

There are no standardised means to submit a data portability request. No standard ways to describe the data you want to port. No standard means for you to say where you’d like it to move to. No standard means to express the technical formats you’d like your data to be shared in. No recognised ability for you to delegate your requests to an agent acting on your behalf. And of course the killer issue…., on top of all of the above, you probably won’t get the answer you want to your request anyway. To illustrate…., I, because i’m in this line of activity, have submitted two data portability requests of late. One was to my car insurer, the other to my home energy provider - both large, UK service providers with plenty of resources allocated to privacy and data protection. Both responses came back entitled ‘Your Subject Access Request blah blah blah…; and here’s your csv file….’. In both cases I responded and made it clear that my submission was a data portability request; made no difference whatsoever. All correspondence at all points referred to ‘your subject access request’. Clearly, industry does not want to be dealing with data portability requests….

Of course, that is no great surprise; in UK we have been trying to free up data from supplier silos since the old MiData project back in 2013. With the single, partial success of Open Banking, there is clearly a huge gap betweem data portability theory, and it’s reality.

So why am I telling you all of this? Quite simply because those missing pieces of the jigsaw are about to show up - via MyTerms/ IEEE7012 draft global standard.

Whilst there is a lot more to MyTerms than data portability, there is a whole sub-set of the standard and specifically 5 of the 13 standardised data sharing agreements (aka privacy policies) that overtly fill those gaps above. Those agreements that require data portability all include:

• Standards based ability for you to delegate your requests to an agent acting on your behalf

• A standardised means to submit a data portability request

• Standard ways to describe the data you want to port. Standard means for you to say where you’d like it to move to

• Standard means to express the technical formats you’d like your data to be shared in

That model will clearly take time to bed in, but I would contend that when in place those benefits that come from data portability will be much more tangible.

Some think financial services, some health and wellbeing, some advertising and offers. A case can be made for almost any start point. And they are all valid - if one either has a large organisation willing and able to kick-start the ecosystem. Or there is a sufficiently large body of people with sufficient pain around current methods that they will try something new.

There are currently efforts underway on many of these, in multiple geographies. Sometime soon, I think one of them will catch fire.

My own current favourite, based on a lot of evidence gathered over the last few months, is that people should have their own digital record of their education and employment. When you think about that, it makes perfect sense. We already have the concept of the Curriculum Vitae, our CV. That’s currently assumed to be a bit of paper; or a document with multiple versions that can be sent by email, or uploaded. But it does not have to be. If it were a smart, accessible data record controlled by the individual then it would be so much more useful. That makes sense in isolation, and also then as a building block for personal data management tools across other parts of live.

So what might that look like; and what can it do? We’ve built a prototype within DataPal to help understand that; it’s called Learning 2 Work in that it covers education and all that entails; the transition to employment, and then the ongoing learning through work experiences and skills development. So a living record, with verification where useful; and the ability to then present different views onto it for different purposes.

The start point is that individuals must have a digital place of their own that they control, or one that is run for them by a service provider acting on a fiduciary basis for them. In my case that would be DataPal, but it could be any data service that is fiduciary to the individual.

A CV upload or re-entry could be a start point for people; or people could just create these records from scratch. Better still, verified records of institutions attended, qualfications attained and work roles could be pushed in or made available to the data service by the source.

Formats vary slightly country to country, but as LinkedIn illustrates, it is possible to come up with a standard approach that works for the vast majority of scenarios in which this data is being shared or otherwise used.

So how does an individual benefit from this model? I think there are a number of significant areas:

1. Having one record controlled by the individual, places the data with the person who gains most from it being accurate and a good representation of themselves.

2. When the individual controls the record, they also control who and what else can access it, and on what basis. As education and employment related records are shared many times over then making this work well is key.

3. Record components can be verified at source (school, college, university, employer, online learning provider), and shared onwards without loss of integrity.

4. The individual can connect their record to other useful services, e.g. course suggester, job finder, CV tuner agent

The visual below is our start point. It shows a number of data sources representing different periods of education and/ or employment being ingested in a personal data store/ service, and then formatted in a consistent way. These standardised templates are then available for AI agents, orgamisation connections, applications and data services to augment and interact with.

From the individual perspective this, in many ways, just re-constitutes that which they already know. The big difference is that all of this data is now under their control; and it’s alive - constantly being updated. That’s a big underlying shift from the current mode is which data about a person mainly just sits in some organisation system as a static record.

The real power in this more dynamic approach, I believe, emerges around career development. That combination of where and who I am, what I know, what I enjoy, my past experiences and qualifications is working on my behalf. It can:

• Help young people understand and engage with their learning and career choices

• Support them in college/ university application processes

• Flag up and source new things people may wish to learn about that will match thier interests and help their careers

• Enable people to prove their learning and qualification history by having their records verified by the relevant institutions

• Help them apply for new roles within their existing organisations, or externally - and retain records of who has accessed their records, and for what purposes

• Enable feedback to be turned into more learning experiences

There are wider societal benefits that will emerge when we upgrade academic and employment records and the statistics that emerge from them. We will collectively have a better lens onto skills being developed and how that lines up with skills being made available and acquired. In this rapidly changing, AI-fuelled world that will be an important capability.

Then, a further set of opportunities that emerge in areas adjacent to learning and employment. Financial services such as pensions, life assurance and private healthcare benefit from richer, portable human-centric data. Taxation and related processes will improve, as will the administration of public benefits.

But the best thing about this new model is that it will cost very little to get up and running; and there are no big dependencies to be addressed in advance of standing up such a service. Just like our own CV’s, we make these records ourselves. If others then wish to connect their aspects of the learning and work related records then great - they get to share in the benefits as well. It may also be that one can easily get this up and running at scale leveraging people’s existing LinkedIn profiles and the data portability API’s from that service (and then others).

I’ll be talking more on this at the MyData Global conference this week; so will follow up on this post when there is a prototype service planned to engage with.

And as a bonus, here’s an enlarged version of that illustration of one lens onto a PDEER.

An important new capability can then emerge and operate in that trusted space - My Personal Agents.

My Personal Agents are a combination of identifiers, data, AI, expert systems and workflow that help people get things done. The critical innovation, and why these agents are so important, is that they allow people to get things done without them having to be there to ‘do the clicks’. So, we are no longer constrained by that old phrase ‘there are not enough hours in the day’. And we can begin to get on top of that giant backlog of things that we all know we should do; but usually don’t get time to. Or do much earlier and more effectively than those things we always leave to the last minute.

There is a key distinction to be aware of up front. Personal Agents are contracted to work for you, the individual. This is not the same as the many organisation-centric agents that will appear on supplier apps and web sites; often surfacing at the moment as chatbots. The relationship between a personal agent and their related person will always be a fiduciary one. That is to say, the same as you’d have with your doctor, accountant, lawyer or other professions that work with that duty of loyalty and care to the individual first. At this stage it is probably also worth pointing out that this concept is not a new one. HMRC (UK Tax Office) has enabled people to appoint agents, and indeed software as their agents for many years - in the form of accountants and certain types of tax or expense management software.

So Personal Agents work on behalf of people to get things done. This plays very nicely into the long understood customer management theory of ‘Jobs to be Done’ that shapes how many organisations present their products and services. Simplistically this theory is that customers are not buying for the sake of buying; they are doing so because the purchase wholly or partially enables an outcome. Jobs to be Done can be functional, or emotional. Ultimately there are thousands of jobs to be done that can be identified across all aspects of life. This Harvard Business Review article walks through four of them as detailed examples.

The reason it is so helpful to look back from outcomes sought, and their related jobs to be done, is that when building Personal Agents we can understand, build and then optimise for the outcome sought; not just for its component parts.

From here on then, this is a story about identifiers, processes, verbs and nouns. Agents programmatically apply verbs to nouns within a defined context. For example:

• I (identifier and context) want to buy (verb) a widget (noun)

• I (identifier and context) want to renew (verb) my passport (noun)

• We ((identifiers and context) want to compare (verb) our service contract(s) (noun) with other options

• I (identifier and context) want you to fix my broken XYZ (noun)

There are thousands of these jobs to be done that can and will be supported via agents following these patterns and similar. Each will have detailed process steps, essential and optional data; guardrails to ensure they do only what they should. And data provenance should be tracked so that all parties can see and learn from what is being done. And yes, agents will work with other agents, likely with an overarching ‘conductor’ agent that is about overall orchestration an communicating with ‘the human in the loop’.

What those agents do, and how they do it, should be transparent. That, and the ‘no lock-in’ mind-set is inherited from the MyTerms protective layer. In that world, the best agent wins (as seen from the perspective of delivering best outcomes for the individual for whom the agent is working).

What will this all mean for how things work at present - you may well ask? Personal Agents, in my view, will be very disruptive of the current modus operandi…, in a good way.

The visual below uses the ‘infinite loop’ concept that dates back to the earliest days of CRM. It is always, for me anyway, great at explaining what the customer is aiming/ hoping to achieve at each step in their buying/ owning journey. I’ve picked out 4 steps in the journey that I believe Personal Agents will have a major impact (for the better of both parties):

1. How people express and share their requirements and intentions (will be vastly improved using LLM augmentation and made available under MyTerms).

2. How people share and verify their identity, and prove things (e.g. age, employment status, earnings and many more) becomes vastly better when Personal Agents are in the mix.

3. Managing privacy and data sharing becomes vastly better when Personal Agents and MyTerms are in play.

4. Customer service cases become jointly owned opportunities to fix and improve things when both parties have the Agents that have access to relevant knowledge and processes they can engage.

That’s only four areas where I think Personal Agents will radically help both individuals and the organisations they deal with. I think there are at least forty more around that Infinite Loop where I think benefits will emerge. So over time the impact of Personal Agents will be massive.

What can and should organisations do to prepare for this upcoming onslaught of Personal Agents? I think that is two-fold:

1. Watch and learn around what is being built; and offer to help (as this will be a very good thing for organisations willing and able to prototype agentic connections.

2. Enable your web sites and apps to ‘Listen and Respond’. Yes, the great shock for organisations that will come with Personal Agents is that in many/ most of the times, when dialogue is required, it will be the Personal Agent that initiates it. So this will be a bit like when customer’s realised they could get in touch with brands via social media like Twitter then they will. That means switching on protocols such as MCP and A2A, and I suspect some others yet to emerge.

I expect all of the above to emerge at scale in the next 12 months. Why so? That’s because I can already see the infrastructure being built out in some of the big AI Agent Orchestration platforms. And there are now enough organisations and service providers who recognise the inevitability of customer-side/ Personal Agents to get that ball rolling.

Watch this space.

Firstly - what do we mean by ‘MyTerms’?

MyTerms is the nickname for IEEE7012, a draft standard that will publish later in 25/ early 2026. As a standard in the IEEE ‘7 series’ it will be freely available globally; and designed for mass adoption (like IEEE802.11, i.e. WIFI). MyTerms proposes an antidote to the very broken ‘check box’/ consent notice/ privacy policies/ cookie pop-ups’ we have now that supposedly protect our privacy but which do nothing of the kind.

That being the case, MyTerms are ultimately about trust; particularly in, but not restricted to, the online environment.

So let’s dig into the problem and the current frameworks around it. And then look at how MyTerms differs.

The root cause of the problem is that organisations see major value in data about their customers/ citizens/ members/ donors/ employees/ patients etc. And they are right to do so. If that data is sourced, gathered and used well then organisations can and will make more revenue, reduce costs, drive efficiency and improve most other metrics that matter to them. That model dates back to pre-digital times; shopkeepers, bank managers, doctor and many more all knew the value of ‘knowing their customers’ and the personal touch (yes, personalisation did exist before the Web….).

However, those folks knew where the boundaries were. And they had their own natural memory limitations that constrained what they could gather. They did not gather ‘all data’; just the important stuff required to deliver and improve the service they provided.

Those boundaries, limits and constraints don’t apply when data gathering is done remotely, with no personal connection, and with computers, cameras, sensors and other devices whose sole purpose is to gather data. And they certainly don’t apply when whole industries emerge, like ‘Search’ and ‘Adtech’ whose sole purpose is to gather data and inferences from individuals and sell those to organisations.

Hence the need for ‘data protection’ and online privacy regulations.

My first encounter with ‘data protection and privacy’ in the context of personal data happened way back in 1988. I was a young Direct Marketing Manager for a big DIY chain when I guess the lawyers said ‘hey Iain, we need to figure out how to handle this new ‘UK Data Protection Act 1988’. I was always a complete advocate for the gathering and use of customer data but don’t recall being phased by these new requirements. Essentially the requirements of the Act boiled down to:

1. Be transparent about what you are gathering, and what you plan to do with it

2. Don’t gather more data than you need (the data minimisation principle)

3. Only do with the what you said you would (the purpose limitation principle)

There were other hygiene style principles (e.g. keep it safe, enable access), but for me privacy and data protection boils down to those three ‘commandments’. As they have done in every privacy regulation since. Transparency, data minimisation and purpose limitation are central to GDPR for example.

They re-surface again in MyTerms…. but more on that later.

So with those sensible protections in place in GDPR and similar; why would we need something else? And why is trust on in online services as low as it is right now?

The reason is quite simple, and unfortunately entrenched (because of that perception that gathering, managing and use data will help organisations make and save money). Organisations ignore the data minimisation and purpose limitation principles; and are allowed to do so by regulators. They also ignore hygiene factors like access, portability and right to amend which have been in the regulations for many years.

They do so by hiding behind ‘their terms’.

‘Their terms’ are those 30-40 page terms and conditions and privacy policy documents that underpin the biggest lie on The Internet. The reasons they are so long and complicated can, almost always, be tied back to data minimisation and purpose limitation. In other words, organisations use these approaches to mask that they are a) gathering more data than they need, and b) doing more things with the data gathered than the data provider would allow had they easily accessible means to do so. And in taking this approach organisations breach the other cardinal principle - transparency. The logic behind this behaviour differs quite a bit between private, public and third sectors; but it is prevalent in all 3. For private sector the dominant logic is ‘make money’, in public sector the drive is usually saving money.

MyTerms/ IEEE7012 is about providing a viable alternative to that model. It is not about persuading organisations to stop doing what they do at present; the standard is about enabling a more transparent, human-centric model to be built alongside. The belief in the team who have created the approach is that this new model will work better for the vast majority of organisations; and thus that adoption will happen first through that route. One way to think about it is as a replacement for the concept of ‘the privacy policy’. It does not replace product/ service terms and conditions, which necessarily cover pricing, levels of service etc; just any personal data implications within the terms of service.

So, what does that mean in practice. At present that looks like:

1. A technical standard, published by IEEE (project scope at that link), which sets out the methods through which individuals and organisation can discover, propose, sign and record standardised data sharing agreements that are written from the perspective of the individual. (currently looking like Dec 25/ Jan 26).

2. A series of 13 initial agreements that can be enacted through the technical methods above to then become standards based contracts that enable data to flow between individuals and organisations under contracts. These agreements will be hosted, and their use facilitated at Customer Commons (just as Creative Commons does the same for copyright licences).

3. IEEE7012 terminology and requirements supported as an extension within the excellent Data Privacy Vocabulary (DPV) to ensure machine readability, canonical definitions and permanent links for all key words and phrases. This will include definitions for data purposes, data types and attributes that are used in the agreements. This will also be a significant enabler of data portability as it becomes vastly easier to to describe and request data that individuals request to be ported either to themselves, or to other parties.

4. Through this combination, the parties are known to each other, data is inherently portable, it is exchanged via cryptographically secure methods, under standardised agreements (legal basis for the data exchange is Contract). And each has a record of the contractual relationship.

So…., what’s in those agreements then?

There are two types of agreement.

Personal Data Contribution agreements, that are about one off data transactions. There are three of these:

• PDC - AI (Contribution to AI model training and deployment)

• PDC - GOOD (Contribution to a Data for Good project)

• PDC - INTENT (Contribution of intent-specific data

Then, Service Delivery agreements. That is to say, agreements that assume individuals and organisations are entering into an ongoing relationship around the acquisition/ provision of a product or service that has some digital component (including payment). Products or services can be either private or public sector, the agreement design covers both.

There are five of these Service Delivery agreements, each of which has two variants. I’ll cover two of those for now as that will illustrate the design pattern.

• SD-BASE (Base level data and purposes required for a specified product/ service relationship)

• SD-BASE-DP (Base level data and purposes required for a specified product/ service relationship; and a requirement for data portability)

The ‘DP’/ Data Portability variants may appear to be a niche option initially; but they are carefully designed to fit into, for example, UK.Gov Smart Data schemes. Those agreements make it very easy for the individual to say ‘i’m buying/ getting a widget; and i’d like a copy of the data please for my own use or to share with others’.

The further Service Delivery agreements add additional data purposes into the agreement over and above Service Delivery; e.g. ‘Analytics’. What this then does is builds a ‘Trust Ladder’. That is to say, if relationships begin with the BASE level agreement and that goes well, the parties might move beyond the basic relationship agreement model and progress to allow each other to see/ do more together. That mirrors how trust works in the physical world - it builds over time through consistent experiences to an agreed specification. (and collapses quickly on any negative experience).

One critical aspect of MyTerms is that the signed agreements form contracts. And as such are governed under contract law. Contracts have been around for thousands of years. Everyone knows how they work. Two parties discuss, negotiate and agree something is to happen, and the contract document is the written copy of what has been agreed. Clearly that is very different to the current model of ‘take it or leave it’ privacy policies and deliberately complex cookie banners. Then again, parties forming data sharing agreements (contracts) is already a well formed practice that privacy regulators promote over and above base regulations. See here for the UK Information Commissioner work on data sharing agreements. In many ways MyTerms is effectively just a B2C variant of exactly that model in which parties agree to an additional layer of transparency to a data exchange, and form that as a contract.

As noted above, that makes the legal basis for the exchange of any personal data involved be ‘contract’. The current norm is that Consent is seen as a higher bar than Contract as a basis for personal data exchange. But that assumes the contract was written in the usual way by legal teams within an organisation, not standardised, made very transparent and ultimately written from the perspective of the individual.

What’s next then…? So the standard still has a few months before publication. In that period we need to finalise the text of the agreements; they are currently in review by a range of volunteer legal experts. And we can also now begin to talk to a range of organisations about how deployment might work for them in practice. Broadly speaking, MyTerms should work pretty well for most organisations once they familiarise with the model. It’s not going to be of interest to organisations that major on surveillance and ‘third party’ activity. It will be of interest to organisations who already focus on ‘first party relationships’; and should work well for public sector. The inner workings will also be of interest to CRM providers, E-Commerce platforms, Consent Management Platforms (CMP), Customer Data Platforms (CDP) and Systems Integrators (SI) as they may well be able to build value added services around the standard.

To conclude then, this visual might be help crystalise one of several ways in which MyTerms user journeys might begin.

This start point begins with an organisation having concluded that they are happy to enable the MyTerms; there are multiple other ways in which they can surface.

All in all i’m optimistic that this model has a good chance. It certainly has to be a better approach than the current dreaded consent checkbox…

If your organisation would like to dive deeper to understand how MyTerms might work for you then get in touch.