Donate

Article 88b: Giving People Agency Online

Customer Commons Submission on Proposed Article 88b of Regulation (EU) 2016/679 1 September 2026 Customer_Commons_Article_88b_Submission_2026-09_01

Here is the .pdf.

Here is the .docx from which the .pdf was created.

And here it is in .html—

CUSTOMER COMMONS
A 501(c)(3) non-profit · customercommons.org

Submission On Proposed Article 88b Of Regulation (Eu) 2016/679

To: Roberta Metsola, President of the European Parliament Aura Salla, Co-Rapporteur, Committee on Industry, Research and Energy (ITRE) Marina Kaljurand, Co-Rapporteur, Committee on Civil Liberties, Justice and Home Affairs (LIBE) Members of the European Parliament and representatives of the Council of the European Union engaged in procedure 2025/0360(COD)
cc: European Commission, Directorate-General for Communications Networks, Content and Technology (DG CONNECT)
From: Customer Commons · Contact: Doc Searls, Co-founder and Board Member · doc@searls.com Date: 1 September 2026
Re: Proposal for a Regulation of the European Parliament and of the Council amending, inter alia, Regulation (EU) 2016/679 as regards the simplification of the digital legislative framework (“Digital Omnibus”), COM(2025) 837 final — proposed Article 88b GDPR (renumbered Article 8a in subsequent Council drafting; automated and machine-readable indications of data subjects’ choices)
PDF version

I. Interest of the submitter

Customer Commons is a United States 501(c)(3) non-profit, established in 2013 as an outgrowth of ProjectVRM at Harvard University’s Berkman Klein Center for Internet & Society. Our mission is to restore the balance of power, respect and trust between individuals and the organisations that serve them, especially commercial entities acting online. We accept no contributions from commercial entities, have no clients, no advertisers and no products to sell. Customer Commons coined the term MyTerms for IEEE 7012-2025, Standard for Machine Readable Personal Privacy Terms1, a standard the IEEE published in January 2026. MyTerms is the product of nine years of development that began when the IEEE approached Doc and Joyce Searls (both Customer Commons founders and board members) with the idea of developing a standard for supporting operative personal privacy online. Doc and two other board members were among the primary authors of the standard, with Doc serving as Chair of the working group. Doc is also a founder and co-organizer of the Internet Identity Workshop (IIW), held twice yearly since 2005, and the founder of ProjectVRM2 at Harvard’s Berkman Klein Center in 2006. He continues to run ProjectVRM, which also holds VRM Day events at the Computer History Museum in Mountain View, California, alongside IIW3. We write because proposed Article 88b begins to address a question both Customer Commons and the MyTerms standard exist to answer: How can people obtain real privacy online, and do that at scale? The answer is by enabling people to take the lead in establishing terms of engagement with online entities, in a form that machines and their operators will obey. MyTerms does that. We support Article 88b. We urge the co-legislators to restore it, to close its gaps, and to expand it to fully support individuals’ ability to engage online entities in safe and productive ways that cannot happen when site and service operators control all choices while operating in an economic ecosystem in which personal privacy is seen as a bug rather than a feature.

II. Summary

This submission calls attention to five propositions and makes three recommendations.
  • Proposition 1. Article 88b is the most important provision in the Digital Omnibus, and it should not be removed from the final document. It is an essential step towards enabling individuals to express their choices using software and hardware they control, rather than being confined to choices unilaterally presented by a controller’s interface. This is a critical structural change and is to be applauded.
  • Proposition 2. In today’s online environment, “consent” by individuals to terms and conditions set out by online entities is a fiction—for five reasons:
    1. “Consent” as currently practiced, and in the form the advertising industry wishes to maintain, pretends to obtain voluntary approval of site and service cookie practices even while the structure for obtaining that purported approval makes it impossible for people either to express meaningful refusal or to suggest alternative terms.
    2. No person, however diligent, can know exactly what she is and is not “consenting” to.
    3. Much (perhaps most) of the online advertising industry depends on tracking and surveillance. Thus, it is highly motivated to at least appear to obey the letter of the GDPR while violating its spirit.
    4. In most cases cookies are set irrespective of consumer desires,4 and there is no way for those who supposedly agreed to keep records of what they supposedly agreed to, which makes auditing of compliance difficult or impossible. The entire “consent” system as it exists today is a vast and systematic failure. It cannot be fixed.
    5. Violation of the GDPR’s guidance for consent is wanton, rampant, and systematic. Article 4(11) says, “’consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.”5 Current online “consent” plainly does not meet this standard.
  • Proposition 3. “Consent” in the online world is not meaningful because of the severe structural asymmetry, as between online entities and individual people, of both power and information. Online entities offer terms on a take-it-or-leave-it basis; they engineer their interfaces to exploit the known limits of human cognition; and the surveillance those interfaces purportedly licence funds and enables the targeting that makes downstream “choices” and “consents” even less free than the original.
  • Proposition 4. Personal privacy in the online world is a fiction. It does not yet exist. Here is why:
    1. Personal privacy in the natural world relies on tacit agreements, arising from long-established interpersonal social and cultural norms, about what information someone may collect and what they may properly do with it. These tacit agreements are well understood but are not laid out anywhere in any specific language. To the contrary, in the natural world, people signal their privacy expectations (indeed, their privacy demands) by means of clothing and shelter, buttons and zippers, doors and locks, and notebooks that can be closed and voices that can be lowered to a whisper when others are around. In the natural world, people use hints and gestures to signal what is permitted, or preferred, and what is not. All of these cues and signals have been deeply embedded in culture for millennia, which means that these critical informal understandings about privacy are mostly established without anyone’s conscious awareness.
    2. That process does not work in the online economic ecosystem for a simple reason: online, people are not interacting with other human beings; they are interacting with soulless, amoral software—online entities’ websites and app interfaces. Online, people are essentially naked, with effectively no equivalents of clothing and shelter, and no easy ways to signal permissions or preferences. In the absence of both privacy-protecting technologies and established privacy customs, people are easily exploited by systems designed to relentlessly surveil them. This is why, in a visit to an ordinary website, a person’s browser may become infected with hundreds or thousands of cookies and tracking beacons about which the person knows little or nothing, while exploitation of the personal data thus harvested happens on a grand scale.
    3. The digital world is composed of binary code and is entirely programmed. Code only works when everything is explicit. Online, there are no tacit understandings, informal cues, or interpersonal cultural contexts. This means that to give people real online privacy protections, we need an entirely new framework in which people have a meaningful capacity to operate with full agency over how their privacy is protected and that assures that their signals about it are received and obeyed.
  • Proposition 5. Under the MyTerms (IEEE 7012) standard, the individual (“natural person” or “data subject” in the GDPR) is the first party, proffering privacy requirements and terms respecting data processing requirements to online sites and services as second parties, with both parties keeping identical records of agreement. MyTerms enables individuals to choose standard agreement terms from a short roster kept on the public website of a disinterested nonprofit (such as Customer Commons in the US or MyData Global in the EU). This parallels the successful model established by Creative Commons for copyright. Making use of standard terms enables personal agency to scale in the online world. This is an essential prerequisite to establishing business and other relationships on a solid basis of mutual trust.
Accordingly, we recommend that the co-legislators:
  • (1) Adopt Article 88b, with amendments (suggested below) that make an individual’s refusal of consent binding; that remove the media-service and SME carve-outs; that prohibit circumvention of an individual’s expressions of intent by technical or any other means; and that direct the request to develop standards by which individuals can communicate their intentions to online entities to existing published work – including MyTerms – rather than to assume that this work needs to be done from scratch;
  • (2) Guarantee that an individual may deal with any large online platform through an AI agent of her own choosing, on functionally equivalent and non-discriminatory terms. This is similar to the approach taken in the draft AI AGENT Act released in the United States on 29 June 2026;6
  • (3) Direct the standardisation work under Article 88b(4) to encompass machine-readable agreement—terms proffered by the individual as first party and accepted, declined or countered by the site as second party—covering not only privacy but price and other terms of the transaction.
The third recommendation is deeply consonant with the Omnibus’s stated purpose. Establishing a machine-implemented process of negotiation and agreement—which necessarily requires online entities to acknowledge and respond to individuals’ expressions of intent—would make mechanisms such as cookie banners obsolete, while creating durable, auditable, programmable, and mutually trusting relationships.

III. Article 88b should be restored and expanded

The Commission is correct that banner-based consent is inefficient and structurally flawed. The European Data Protection Board and the European Data Protection Supervisor welcomed Article 88b in their joint opinion of 11 February 2026, while recommending improvements on defaults, scope, standards, the SME exemption for browser providers, the media-service exception and enforcement.7 We agree with each of those recommendations and address several below. The advertising industry has taken the opposite view and has urged that Article 88b be deleted outright.8 After discussion in Coreper on 8 June 2026, the Council Presidency decided on 11 June to delete proposed Article 8a (originally Article 88b in the Commission proposal) and the corresponding recitals from its compromise text.9 We understand industry’s reasoning, but it is deeply flawed and should not have been accepted. Maintaining the existing consent framework will do nothing to foster the meaningful management by people of their own privacy. What makes Article 88b structurally significant is not any specific technology, but rather the question of within whose interface privacy choices are made. Today the person expresses her will inside a surface—the online entity’s website or app—that the entity designs, tests, optimizes, owns, and uses against the interests of the individual. Article 88b, by contrast, lets her express her choices in software she chooses. The difference is as stark as that between voting in a private booth and voting in the candidate’s living room while he watches over your shoulder and offers you a biscuit. Actual online behavior by individuals is illustrative. By the second quarter of 2026, though hard numbers are impossible to obtain, an estimated 1.77 billion people worldwide were running ad blockers.10 It is fair to characterize the actions of these 1.77 billion people as the largest consumer boycott in human history. People have been voting against online advertising and its targeting methods, at scale, for more than a decade, using the only instruments available to them. Article 88b would give their effective, operationalized rejection of ads and surveillance a legal voice. That alone is a good reason to keep Article 88b.

V. The underlying problem is a severe asymmetry of power and opposed interests and incentives

“Consent” cannot work to protect online privacy because of the conditions in which it is asked for. We identify seven key issues below.

A. The entity’s side has full control while the person’s side has no more than what the entity provides.

Nearly all entities attempting to obey EU privacy directives use consent management platforms (CMPs): third party services that provide cookie notices and other consent mechanisms, keep records, and handle the main required burdens. Persons encountering these systems have no power other than to passively assent or to make “choices” (with no reason to believe they will be respected) in a state of grudging futility.

B. The entity has scale across countless people, while people have no scale across countless entities, all of which provide different means of engagement and provisions for record-keeping.

Large online entities engage in millions of interactions with people every day. They can learn from these interactions how to maximize extractions of “consent” to their privacy practices and how to use the information they gain from surveillance to maximize people’s decisions to respond to ads. Individuals online face this industrial-scale manipulation. Meaningful online privacy protections must take steps to counter this vast imbalance.

C. Tracking people is structurally embedded in the online advertising industry. Personal control over privacy is a threat to that.

The key goal of the operators of the online surveillance ecosystem is to keep it running. All the lobbying by Google, the IAB, and the advertising industry is aimed at this goal. The goal for people is personal privacy. These objectives are opposed, because the current online advertising industry depends on the absence of personal privacy, and uses “consent” to create the illusion of personal choice while containing, minimizing, and ignoring it. Ironically, both entities and people should welcome better ways of doing business, based on maximized agency, trust, and good two-way communication. The consent regime prevents that by preserving the status quo.

D. Terms are offered on a take-it-or-leave-it basis

Online terms are what Friedrich Kessler named contracts of adhesion19 at the height of the industrial age. These are contracts drafted by one party, presented whole, enforced against a counterparty who did not read them and could not have negotiated them even if they had tried, and subject to revision only by the first party. Such an “agreement” is binding “glue” for the weaker party and flexible “Velcro” for the stronger one. As Professor Kessler explains, in such a scenario freedom of contract belongs only to companies, never to customers. Professor Radin’s term for the cumulative effect of adhesive contracts is democratic degradation—the private, wholesale displacement of rights that a legislature granted to everyone.20 The GDPR recognised the natural person as a holder of rights. But it left untouched the industrial-age convention under which organisations—not individuals—are the parties that originate terms at scale, and enjoy freedom of contract. That assumption is reflected in the language of the regulation: a living, individual person online is a “data subject”—grammatically and legally the object of someone else’s actions—rather than an equally respected first party to a transaction or an agreement. A related asymmetry (as suggested above) is repetition. A platform is a repeat player facing hundreds of millions of one-shot players; platforms can and do study design decisions via A/B testing across billions of encounters, while each individual—to the extent that clicking “I agree” constitutes a meaningful decision at all—makes far fewer decisions, with no cohesion from one encounter to the next, other than frustration, weariness and resignation. Even if consent were cognitively feasible, the costs for the platform to learn from its interactions, as compared to the person, are asymmetric in the platforms’ favor by several orders of magnitude. The question of whether people should be confronted with an option to either consent to surveillance or pay for access to a site poses the same problem. Where refusal to consent means that the individual loses access to a platform or must accept a fee the platform sets unilaterally, the notion that consent is “freely given” is dubious—as the EDPB has observed with large online platforms.21

E. Interfaces are engineered against known features of human cognition

Dark patterns do not arise as a result of incidental misconduct by bad actors. They are expressions of mature technologies, based on well-established findings of cognitive science and behavioral economics—including some of those discussed above—refined by experiment, and deployed at scale. A large-scale audit found dark patterns on more than a tenth of shopping sites surveyed, concentrated among the most popular.22 A study of the most common consent management platforms on top UK sites found that only about 11.8% met even the minimal requirements of EU law, and that removing a simple (and popular) ‘reject all’ button from the first layer of the interface increased ‘consent’ by roughly 22 to 23 percentage points.23 Consider what that second figure means. There is no difference in the informational content available to consumers if the “reject all” button appears one click away. But that change in the user interface supposedly changes the “consent” obtainable from a quarter of the population. It simply cannot be true that a swing of 25% in favor of “consent” induced by interposing a single click reflects any true preference for more surveillance and disclosure. Instead, it reflects the fact that the inherent bounds on human rationality affect all of us and make all of us subject to manipulation. The European Data Protection Board made essentially this same point in its guidance on deceptive design.24 The key problem is that bounded rationality is a known aspect of human nature. It is predictable, and therefore exploitable at industrial scale. Continuous experimentation by platforms converts cognitive science into an operating procedure: the platform does not need a theory of why a particular interface design feature leads to greater “consent”; it needs only the empirical knowledge that it does. Professors Hanson and Kysar anticipated this problem in 1998; Professor Calo named its digital form market manipulation.25

F. The current system requires surveillance

The problems are not just take-it-or-leave-it terms and interfaces engineered to induce “consent.” Unfortunately, these are joined by another aspect of the online surveillance economy that makes the system self-reinforcing. Data gathered under “consent” funds and enables targeting; targeting individualises persuasion; and individualised persuasion makes the next consent less free than the last.26 An asymmetry of information becomes an asymmetry of influence. Surveillance-based algorithmic targeting of content and advertisements, such as that employed by the major search engines, social media platforms, and e-commerce systems, is tuned to maximize engagement by amplifying appetites and prejudices. “Consent” enables the entire process.

G. What Article 88b does not reach

Article 88b as proposed reflected real progress as compared to the status quo by giving the individual a machine-readable voice. But the voice was limited: a binary yes/no vote, on one subject only—processing associated with terminal equipment. The voice envisioned by Article 88b could only respond to a specific question from a platform. It could not propose anything. It could not negotiate. But a party who may only accept or reject what another has written is not, in any functional sense, a party at all; that is the definition of someone subject to adhesion. Human agency begins when someone can make an offer (or a counteroffer), not just refuse what someone else proposes.

VI. Recommendations

Recommendation 1 — Adopt Article 88b, and close its gaps

We support Article 88b as proposed and ask that it be reinstated. But we also recommend that it be strengthened in several respects. Suggested drafting appears in the Annex; the key points follow:
  • (a) Silence is not consent. The absence of a machine-readable indication must not be capable of being treated as consent, nor as a licence to seek consent by means that override an existing signal.
  • (b) Refusal must be binding. A controller that receives a refusal or objection must not deny, degrade, delay or price-condition the service in response, nor re-ask by other means, except where the processing is objectively necessary to provide the service the individual has requested.
  • (c) Controllers must listen to individuals. Controllers must not detect, block, throttle or otherwise discriminate against software (such as an individually-controlled AI agent) that carries an individual’s signal. If a person’s “right” to make her views known to a controller can be engineered away, it is not a right at all. The history of “Do Not Track” provides a cautionary tale: what was originally envisioned as a polite request from individuals, unenforceable by design, was reframed by the advertising industry as Tracking Preference Expression—as though anyone preferred being tracked.
  • (d) Delete or narrow the media-service exception in paragraph (3). Neither an individual’s terminal equipment nor their desire for privacy changes with the business model of the party with whom they are dealing. If the exception is retained, it should be confined to what is strictly necessary to deliver content the individual has actually requested. The EDPB and EDPS have raised this same concern.
  • (e) Delete the SME exemption in paragraph (6), or replace it with a functional threshold. Browser markets are concentrated; the exemption’s practical effect is to fragment the individual’s experience. Independent and privacy-protective browsers are where innovation in this space has actually come from. Better still, extend the obligation to providers of operating systems, mobile platforms and application stores above a de minimis EU user base.
  • (f) Direct the standardisation request to existing work. Paragraph (4) rightly routes the technical question of how individuals’ preferences can be communicated to online entities to the European standardisation organisations under Regulation (EU) 1025/2012. The request should invite CEN, CENELEC and ETSI to begin from published specifications rather than from a blank page. In particular, they should be directed to consider starting with IEEE 7012-2025, the Advanced Data Protection Control specification, and Global Privacy Control.
  • (g) Shorten the timetable and require auditability. Twenty-four and forty-eight months are long periods in this field. As drafted, Article 88b gives the longer lead time to providers of browsers, but they are the parties whose cooperation makes the individual’s right to express their preferences real. Also, both sides should retain a durable record of what was signaled and what was honoured. Evidence is what makes a dispute resolvable, and the prospect of evidence is what makes most disputes never happen.

Recommendation 2 — Guarantee non-discriminatory access for agents acting for individuals

The true value of Article 88b will be determined by the scope of what the individual’s software is permitted to do. If a platform may detect and exclude software that carries an individual’s signal, the individual’s right to express her preferences will exist on paper only. Automated blocking, confining functionality to a proprietary application, and/or degrading the experience of anyone not using the platform’s own agent must all be forbidden. We urge the co-legislators to provide that a person may deal with a large online platform through software of her own choosing, on terms functionally equivalent to those available when she acts directly via her browser, without discrimination in favour of the platform’s own agent. This is the approach of the AI AGENT Act discussion draft released in the United States on 29 June 2026, which would require covered platforms to permit authorised third-party agents to act “on the same terms as a user” through interoperable, non-discriminatory interfaces, and would subject agent providers to best-interest duties toward the people they serve. This recommendation is an instance of the fundamental concept that entities must not unreasonably discriminate in the offering of their services. The concept appears throughout regulatory law, including common-carriage duties of just, reasonable and non-discriminatory dealing, and FRAND commitments in standards licensing. Indeed, the Digital Markets Act already obliges gatekeepers to permit interoperability and to refrain from self-preferencing, and the Data Act requires data holders to make data available to a third party at the user’s request.27 Our recommendation here is that online entities must not abrogate an individual’s right to be represented by her own software wherever she has a right to act herself. We do not minimise the objections to this approach. Platforms will raise concerns about security, authentication, rate-limiting, fraud and liability for disputed transactions. While these are in some sense legitimate, each is solvable. The AI AGENT Act’s certification-and-registry model is one workable answer; a European variant might build on eIDAS wallets rather than a new registry. Two additional points deserve to be written into any standardisation mandate:
  • Agents must owe duties to the person they serve, not to whoever pays for their deployment. An agent that is nominally the person’s and functionally the platform’s reproduces the problem it was meant to cure.
  • Agents built on large language models are susceptible to prompt injection and untrusted site-supplied instructions: they cannot reliably distinguish instructions from data, which makes them vulnerable to manipulation by the very sites they are sent to negotiate with. Any standard for agent interaction must therefore treat site-supplied content as untrusted input, and must specify authenticated, signed channels for anything that binds the individual. This is a technical problem, but it is also a legal one, because loss allocation turns on it.

Recommendation 3 — Complete Article 88b: from consent to agreement

Article 6(1) of the GDPR offers six lawful bases for processing. The advertising economy relies almost entirely on two of them—consent under point (a) and legitimate interests under point (f)—which permit compliance with the letter of the Regulation while defeating its purpose. The familiar online consent model resembles a contractual arrangement between the controller and the data subject: the controller offers access to a platform and, in return, the data subject ‘consents’ to being surveilled and subjected to targeted ads. But nothing in the GDPR provides that terms governing such an exchange must be set by the data controller. Article 4(7) of the GDPR says, “‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.”28 Nothing in this language requires that the terms governing processing originate solely with the controller. Yet the longstanding assumption is that individual people will merely supply data in response to the terms and conditions proffered by online platforms. The assumption that terms flow in one direction (from a platform to an individual) while data flows in the other (from an individual to a platform) is a habit of the industrial age, not a requirement of the law. IEEE 7012—MyTerms—breaks the habit. In outline:
  • The person—not a “data subject”—is the first party; the site or service is the second party;
  • The person proffers an agreement drawn from a short, public, plain-language roster maintained by a disinterested non-commercial body (akin to the “Creative Commons” approach to copyright licensing);
  • The second party (the platform) accepts, declines or counter-offers in machine-readable form; and
  • Both parties retain an identical record, which supports auditing, dispute resolution and — more valuable — dispute avoidance.
The roster of standard terms is an essential feature of this design. With hundreds of millions of individuals engaging in billions of interactions with online sites, supposedly giving people “freedom of contract” without a set of standard terms does not produce agency; it produces a million bespoke deals that nobody can read and no counterparty can process. By contrast, a short public roster of terms will permit expression of individual preferences at scale. Creative Commons worked in the copyright context because there are six licenses, not six million. Customer Commons was founded to do the same thing for personal online terms. We ask that the standardisation request under Article 88b(4) be widened accordingly — moving from the interpretation of machine-readable indications to the exchange, recording and enforcement of machine-readable agreements, and that the recitals confirm that an agreement so concluded may provide a basis for processing under Article 6(1)(b), to the extent that the processing is necessary for performance of that agreement. We also ask that the mandate on platforms to address machine-readable terms from individual people not be confined to privacy. The same communications pathway between individuals and online entities that will carry indications of privacy terms can carry any relevant term: price, delivery, returns, warranty, subscription renewal and cancellation, dispute resolution. Once an individual can express a machine-readable offer, sellers can respond to individual demand that has actually been stated rather than guessing what the individual wants from profiles and surveillance. In this regard, the surveillance economy is limited by its own method: it can only infer what people want; it can never know. But an online economy in which customers can state intentions directly will lead to a larger economy, not a smaller one.29 This last point bears emphasis. Commerce at scale requires that people trust the environment in which they are expected to transact. Less trust leads people to hesitate and withdraw. But greater trust leads to a larger and more robust marketplace.30 Unfortunately, the online economic ecosystem has evolved into one where major entities maximize their profits by exploiting individuals’ trust as much as they can—including by obscuring privacy practices—up to the limit of degrading the ambient level of trust so much that confidence in online transactions simply collapses.31 Enacting and expanding Article 88b as suggested here—by truly empowering individuals not only to protect their privacy interests, but also to affirmatively express their preferences—will increase the level of ambient trust in connection with online commerce, which will inevitably expand the scope of that commerce. While some entities may experience a temporary lessening of profits as various forms of exploitation and manipulation are no longer possible, the market as a whole will grow, to everyone’s benefit.

VII. Conclusion

Article 88b would treat a person’s own software as a legitimate speaker of their will. Short as the text is, that is a change of constitutional character, and it should not be traded away in negotiation. A voice that can only say “no,” and only to one question, has almost no agency. The natural world of face-to-face interaction manages privacy through tacit understandings that both sides read without effort. The digital world has no tacit understandings; agreements in that context must be explicit, programmable, and machine-readable or they do not exist at all. Customer Commons is a small organisation with no commercial interest in the outcome, and we offer our work to the co-legislators, the Commission and the European standardisation organisations without charge or condition. Our founding thesis is easily stated and, we believe, correct: free customers are more valuable than captive ones—to themselves, to the companies they deal with, and to the whole economy. We would welcome the opportunity to present this work in person, and to make our roster, our standard and our engineers available to the standardisation process. Respectfully submitted, CUSTOMER COMMONS Doc Searls, Co-founder and Board Member doc@searls.com · customercommons.org

Annex — Suggested drafting

Additions to the Commission text are shown in bold underline; deletions are described in square brackets. The drafting is illustrative and is offered to be improved upon.

Article 88b (as amended)

(1) Controllers shall ensure that their online interfaces allow data subjects to: (a) give consent through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled; (b) decline a request for consent and exercise the right to object pursuant to Article 21(2) through automated and machine-readable means, and withdraw consent previously given by such means. (1a) Indications given pursuant to paragraph 1 shall be capable of being expressed separately for each purpose of processing. The absence of an indication shall not constitute consent and shall not be relied upon as consent. (2) Controllers shall respect the choices made by data subjects in accordance with paragraph 1, and shall not, on the basis of a refusal, withdrawal or objection so expressed, deny, degrade, delay or condition access to a service, impose a fee, or seek consent again by other means, unless the processing concerned is objectively necessary for the provision of a service explicitly requested by the data subject. (2a) Controllers shall not circumvent, obstruct or render ineffective the automated and machine-readable means referred to in paragraph 1, including by detecting, blocking, throttling or otherwise discriminating against software acting on behalf of a data subject, or by making a service available only through interfaces that do not support those means. (3) [Delete. In the alternative, confine the exception to processing strictly necessary for the delivery of media content explicitly requested by the data subject, and provide that it does not extend to processing for advertising, measurement or profiling.] (4) The Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft standards for the interpretation of machine-readable indications of data subjects’ choices. The request referred to in the first subparagraph shall invite the European standardisation organisations to take account of relevant existing international standards and publicly available technical specifications for the automated expression of data subjects’ choices, and to state their reasons where such work is not adopted. (4a) The request referred to in paragraph 4 shall further extend to standards by which a data subject may propose, through automated and machine-readable means, terms governing the processing of personal data relating to that data subject; by which a controller may accept, decline or propose alternative terms by the same means; and by which both parties may retain an identical and durable record of any agreement reached. Where an agreement is concluded by such means, processing that is necessary for performance of that agreement may be based on point (b) of Article 6(1). (4b) The standards referred to in paragraph 4a may provide for the expression of terms other than those relating to the processing of personal data, including terms relating to price and to the sale or supply of goods, services and digital content. (5) Paragraphs 1 and 2 shall apply from [OP: insert the date = 18 months following the date of entry into force of this Regulation]. (6) Providers of web browsers, operating systems and software application stores, in each case with more than [X] end users in the Union, shall provide the technical means to allow data subjects to give their consent and to refuse a request for consent, to withdraw consent and to exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 5 of this Article. Such providers shall not disable, override or degrade those means, and shall not set any default that constitutes consent. (7) Paragraph 6 shall apply from [OP: insert the date = 30 months following the date of entry into force of this Regulation].

New Article 88d — Access for software acting on behalf of data subjects

(1) Providers of core platform services designated pursuant to Regulation (EU) 2022/1925, and providers of very large online platforms and very large online search engines within the meaning of Regulation (EU) 2022/2065, shall permit a data subject to interact with the service through software chosen by that data subject and acting on that data subject’s behalf. (2) Access under paragraph 1 shall be provided on fair, reasonable and non-discriminatory terms and shall be functionally equivalent to the access available to the data subject acting directly, including in respect of functionality, data, price and timeliness. (3) Providers shall not favour software affiliated with the provider over software chosen by the data subject, and shall not condition access on the use of the provider’s own software. (4) Paragraphs 1 to 3 are without prejudice to measures that are strictly necessary and proportionate to authenticate the data subject and the software acting on that data subject’s behalf, to protect the security and integrity of the service, and to prevent fraud, provided that such measures are applied without discrimination and are the least restrictive available. (5) Software acting on behalf of a data subject under this Article shall act in that data subject’s interest, shall not act in its own interest or in the interest of a third party to the detriment of the data subject, and shall be capable of demonstrating the authority on which it acts.
[End of submission.]

Notes

  1. IEEE Std 7012-2025, Standard for Machine Readable Personal Privacy Terms (IEEE, January 2026). See also myterms.info. MyTerms is a registered trademark of Customer Commons.↩︎
  2. ProjectVRM, “About,” https://projectvrm.org/about/.↩︎
  3. Internet Identity Workshop, https://iiworkshop.org/.↩︎
  4. GDPR Privacy Monitor, “Research: We Scanned 97,000 EU Websites for GDPR Compliance. Here’s What We Found,” 10 April 2026, https://gdprprivacymonitor.eu/en/blog/eu-gdpr-compliance-97000-websites.↩︎
  5. Regulation (EU) 2016/679 (General Data Protection Regulation), Article 4(11).↩︎
  6. Artificial Intelligence Access, Gatekeeper Exchange, and Nondiscriminatory Transfer Act of 2026 (“AI AGENT Act”), discussion draft released by U.S. Senator Mark R. Warner, 29 June 2026, https://www.warner.senate.gov/newsroom/press-releases/warner-unveils-discussion-draft-of-legislation-to-create-innovative-market-for-secure-artificial-intelligence-agents/.↩︎
  7. European Data Protection Board and European Data Protection Supervisor, Joint Opinion 2/2026 on the Proposal for a Regulation as regards the simplification of the digital legislative framework (Digital Omnibus), 11 February 2026.↩︎
  8. IAB Polska, “Digital Omnibus – Alternative for the browser-level consent management (Art. 88a and 88b),” May 2026.↩︎
  9. Council of the European Union, Presidency working document WK 8070/2026 INIT, 11 June 2026 (stating that proposed Article 8a, originally Article 88b in the Commission proposal, and corresponding recitals were deleted after the 8 June Coreper discussion), https://data.consilium.europa.eu/doc/document/WK-8070-2026-INIT/en/pdf.↩︎
  10. Backlinko, citing DataReportal and eyeo, ad-blocking user estimates through Q2 2026. Figures of this kind vary by methodology and should be treated as order-of-magnitude indicators rather than precise counts. Note also that privacy-protective browsers (e.g. Safari, Firefox, DuckDuckGo) also block tracking by default.↩︎
  11. Aleecia M. McDonald and Lorrie Faith Cranor, “The Cost of Reading Privacy Policies,” 4 I/S: A Journal of Law and Policy for the Information Society 543 (2008).↩︎
  12. Helen Nissenbaum, “A Contextual Approach to Privacy Online,” 140 Daedalus 32 (2011); see also Omri Ben-Shahar and Carl E. Schneider, More Than You Wanted to Know: The Failure of Mandated Disclosure (Princeton University Press, 2014).↩︎
  13. Daniel J. Solove, “Privacy Self-Management and the Consent Dilemma,” 126 Harvard Law Review 1880 (2013); Daniel J. Solove, “Murky Consent: An Approach to the Fictions of Consent in Privacy Law,” 104 Boston University Law Review 593 (2024).↩︎
  14. Neil Richards and Woodrow Hartzog, “The Pathologies of Digital Consent,” 96 Washington University Law Review 1461 (2019).↩︎
  15. Alessandro Acquisti and Jens Grossklags, “Privacy and Rationality in Individual Decision Making,” 3 IEEE Security & Privacy 26 (2005); Alessandro Acquisti, Laura Brandimarte and George Loewenstein, “Privacy and Human Behavior in the Age of Information,” 347 Science 509 (2015).↩︎
  16. Alessandro Acquisti, Idris Adjerid and Laura Brandimarte, “Gone in 15 Seconds: The Limits of Privacy Transparency and Control,” 11 IEEE Security & Privacy 72 (2013).↩︎
  17. Laura Brandimarte, Alessandro Acquisti and George Loewenstein, “Misplaced Confidences: Privacy and the Control Paradox,” 4 Social Psychological and Personality Science 340 (2013).↩︎
  18. Herbert A. Simon, “A Behavioral Model of Rational Choice,” 69 Quarterly Journal of Economics 99 (1955).↩︎
  19. Friedrich Kessler, “Contracts of Adhesion—Some Thoughts About Freedom of Contract,” 43 Columbia Law Review 629 (1943).↩︎
  20. Margaret Jane Radin, Boilerplate: The Fine Print, Vanishing Rights, and the Rule of Law (Princeton University Press, 2013).↩︎
  21. European Data Protection Board, Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms, 17 April 2024. See also Case C-673/17, Planet49, EU:C:2019:801, and Case C-61/19, Orange România, EU:C:2020:901.↩︎
  22. Arunesh Mathur et al., “Dark Patterns at Scale: Findings from a Crawl of 11K Shopping Websites,” 3 Proceedings of the ACM on Human-Computer Interaction (CSCW), art. 81 (2019).↩︎
  23. Midas Nouwens et al., “Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence,” Proceedings of CHI 2020; see also Christine Utz et al., “(Un)informed Consent: Studying GDPR Consent Notices in the Field,” Proceedings of ACM CCS 2019.↩︎
  24. European Data Protection Board, Guidelines 03/2022 on Deceptive Design Patterns in Social Media Platform Interfaces, version 2.0, February 2023.↩︎
  25. Jon D. Hanson and Douglas A. Kysar, “Taking Behavioralism Seriously: The Problem of Market Manipulation,” 74 New York University Law Review 630 (1998); Ryan Calo, “Digital Market Manipulation,” 82 George Washington Law Review 995 (2014); Daniel Susser, Beate Roessler and Helen Nissenbaum, “Online Manipulation: Hidden Influences in a Digital World,” 4 Georgetown Law Technology Review 1 (2019); Oren Bar-Gill, Seduction by Contract (Oxford University Press, 2012).↩︎
  26. Shoshana Zuboff, The Age of Surveillance Capitalism (PublicAffairs, 2019).↩︎
  27. Regulation (EU) 2022/1925 (Digital Markets Act), in particular Articles 5(2), 6(5) and 6(7); Regulation (EU) 2023/2854 (Data Act), Article 5. In the United States, compare 47 U.S.C. §§ 201–202.↩︎
  28. Regulation (EU) 2016/679 (General Data Protection Regulation), Article 4(7).↩︎
  29. Doc Searls, The Intention Economy: When Customers Take Charge (Harvard Business Review Press, 2012); see also Iain Henderson, Towards Network-Based Ecosystems (MyData Global, 2023).↩︎
  30. Christian Bjørnskov, “How Does Social Trust Affect Economic Growth?,” 78 Southern Economic Journal 1346 (2012).↩︎
  31. Christopher W. Savage, “Managing the Ambient Trust Commons: The Economics of Online Consumer Information Privacy,” 22 Stanford Technology Law Review 95 (2019), and works cited therein.↩︎