To Google, Meta, the IAB, and the whole “interactive” advertising business, your privacy is a bug, not a feature. The less privacy you have, the more money they make. That’s why they lobbied section 88b out of the EU Digital Omnibus bill, and why they want to preserve the broken, hated ‘consent’ system behind every cookie notice.
The only fix for this is to put you in charge. Opening the online world to your personal agency online is the top challenge for the EU Parliament as they draft and redraft the Digital Omnibus. We submitted our case for exactly that in the 7200-word brief you’ll find here.
We can compress that case to two simple statements:
- Following people without their express invitation or a court order is wrong on its face. In civilized cultures, it is both morally wrong and illegal to secretly stalk people. But the digital world is still very new and not yet civilized. In today’s digital world, tracking people like marked animals is a €1 trillion+ business. But the size of that business does not make it right. Or civilized. It is also bad for every business other than tracking-based advertising. We will find many more and better ways to do business when we recognize that—
- Free customers are more valuable than captive ones—to themselves, to the companies they engage, and to society. We are now entering an age when agency on both the demand and supply sides of markets will be greatly expanded by ever-newer and better AI models. When we have truly personal AI (like we have personal computers and clothing), customers can take the lead in their dances with companies, and companies can get far better market intelligence than what they get today from surveillance-based guesswork.
Consider this statistic: 1.77 billion people block ads online. Ad blocking was already the largest boycott in human history when I wrote about it eleven years ago, and the number was only 200 million. In that same piece, I described how the rise in ad blocking correlated almost exactly with the rise in tracking-based “adtech.” This was the market speaking, loudly and clearly. People have been voting against adtech, at scale, for more than a decade. It is time for the European Parliament to listen to those unheard voices, and not just to lobbyists for Google, Meta, the IAB, and publishers addicted like vampires to the blood of personal data.
And listen to the GDPR, which in Article 6 gives companies six lawful bases for processing your personal data. Adtech uses two of them — consent and “legitimate interest” — because they let a company write the terms and hand you a button. There’s a third basis sitting right there in Article 6(1)(b): contract. Nobody uses it, because nobody imagined a person could set her own privacy terms and make them stick.
But now they can imagine real personal agency online, because we now have a standard for publishing personal privacy terms and making them machine-readable: IEEE 7012-2025—Standard for Machine-Readable Personal Privacy Terms. It was finished earlier this year and is available to read and download for free here. Its nickname is MyTerms (much as the IEEE standard called 802.11 is nicknamed Wi-Fi).
With MyTerms, you operate as the first party, offering your terms to sites and services that can agree to those terms as the second party. Those terms are chosen from a short roster published by a disinterested nonprofit, such as Customer Commons (which was created for this purpose) and MyData Global. If both sides agree, they keep an identical record, so compliance can be audited and disputes easily resolved, preferably using ODR (Online Dispute Resolution), which simplifies the process. If the other side doesn’t agree, the person’s own system can also record that fact. Here is a diagram showing the flow:
The first short collection of personal privacy terms is outlined at the MyTerms Alliance site. The one that matters most is also the simplest: SD-BASE, which means “services only.” This is what we have when we walk into a store or a restaurant. We don’t expect to walk out covered by invisible tracking beacons, which is what happens online, whether you say no to cookies or not. (In most cases, cookies are set anyway. That’s how broken the “consent” system is.)
Agreeing to “services only” is how genuine and trusting relationships can start, and business engagements can expand over time. For descriptions of how this can work, read what Nitin Badjatia, Don Marti and Iain Henderson have been writing. And my own work as well, both on my blog and at ProjectVRM. Also work by MyData, noyb, the EFF, and other organizations fighting for personal agency online.
And please urge your MEP to read our brief and share it.