The EU’s new Digital Omnibus proposal aims to update and expand the GDPR, notably with Article 88b, which includes this:

A new Article 88b Regulation (EU) 2016/679 (General Data Protection Regulation), for automated and machine-readable indications of individual choices and respect of those indications by website providers once standards are available.

That was written in June 2025. (I’ve boldfaced the phrases that matter.) We now have a standard for exactly what the EU wants and needs: IEEE 7012-2025—Standard for Machine-Readable Personal Privacy Terms. It is nicknamed MyTerms (much as IEEE 802.11 is nicknamed Wi-Fi) and was published by the IEEE in January 2026 after nine years in the making. Here’s the PDF.

Article 6 of the GDPR lists six bases for the  Lawfulness of Processing:

1. the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
2. processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
3. processing is necessary for compliance with a legal obligation to which the controller is subject;
4. processing is necessary in order to protect the vital interests of the data subject or of another natural person;
5. processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
6. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

I’ve boldfaced the three that matter, and italicised their core distinctions.

The entire adtech business relies on the first and last of these, consent and legitimate interests, as their excuses for tracking people, allowing them to obey the letter of the GDPR while screwing its spirit.

We see consent at work with every cookie notice we click on or click past. And we have no faith that clicks on consent “choices” provide any privacy protection at all. Reasons:

1. Most sites ignore cookie choices.
2. Many sites set cookies even before a cookie choice is made.
3. It’s obvious that adtech is a personalised guesswork business that relies on surveillance, so most of these “choices” are misdirections away from corporate hunger for personal data.
4. We have no record of the “choices” we make (and in many cases, no choice is offered), or any way to audit or dispute compliance.
5. Uninvited and unwanted surveillance is by now so far out of control that cars, TVs, and AI chatbots are all in on the game (and hardly bother with consent notices).

The legitimate interests are advertising and surveillance, which Google, Facebook and the IAB say the world needs, because it funds so much of what happens online.

To the adtech business, personal privacy is a bug, not a feature. The whole business is incentivised to violate privacy, because violating privacy pays. No amount of regulatory oversight will fix that. To adtech, paying fines for privacy violations is just a cost of doing business.

The only fix that will work is what people—customers and citizens—bring to the market’s table. With MyTerms, they can do that.

MyTerms addresses the second of the GDPR’s six legal bases: contract. Put simply, here is what  the MyTerms standard says:

• The person (not a mere data subject) is the first party, and the site or service is the second party.
• The person proffers a contractual agreement chosen from a limited roster posted on the public website of a disinterested nonprofit, such as Customer Commons (which was created to do for personal contracts what Creative Commons does for personal copyrights—and which the IEEE approached with the idea for making MyTerms a standard).
• When the second party agrees, both parties keep an identical record, which supports compliance auditing and dispute resolution. (By preserving evidence, this also creates an infrastructure for dispute avoidance as well.)

The GDPR succeeded by recognising natural persons as holders of rights, but it left intact the industrial age convention in which organisations are the exclusive originators of terms at scale. That’s one reason why persons have remained mere data subjects rather than contractual parties.

Fortunately, the Internet’s base protocols are peer-to-peer. Treating people on the Net as mere “users” and “data subjects” limits their agency. With MyTerms, people acquire a status they yielded when industry won the industrial revolution. (Before the industrial age, surnames—Baker, Müller, Weaver,  Lefebvre, Smith, Marchand, Farmer—signified agency: what people did in the world. That’s just one thing we lost when we became workers, executives, consumers, and users.)

In the natural world, privacy is maintained mostly by tacit agreements. In the digital world there is no tacit, so agreements must become explicit and programmable. This is why contracts are the only way we’ll get real personal privacy in the digital world.

It should also be clear by now that polite requests also don’t work. We tried that with Do Not Track, and by the time it finished failing, the adtech lobby had turned it into Tracking Preference Expression—as if we wanted to be tracked all along.

That main pro-consent lobby is the Interactive Advertising Bureau, or IAB. Among its recommendations for the Digital Omnibus are deleting 88b and  improving consent in various ways, such as  “Revise the proposed stricter consent rules.”

The IAB is blind to the simple fact that people hate being spied on and do what they can to stop it—mainly by turning off ads. By 2015, ad blocking was already the biggest boycott in human history. That boycott rose in direct response to obvious tracking, especially with retargeting. (That’s how one ad or advertiser keeps following you from site to site and app to app.)  And the boycott is much bigger now:

• By Q2 2023, there were 912M active ad-blocking users worldwide, up 11% from Q4 2021. (Source: e/yeo, with more here)
•  1.77 billion people worldwide were blocking ads by Q2 of 2026. (Source: Backlinko, citing DataReportal and e/yeo).
• Privacy-focused browsers (like Brave, Safari, and Firefox) automatically block advertising elements and behavioural tracking scripts by default. This is in clear response to market demand.

The IAB earned all of that. Yet they still see ad blocking and tracking protection as problems to solve rather than clear and constructive signals from the marketplace.

So it should be clear by now that the old brownfield of consent has become a toxic wasteland of surveillance, lost privacy, and minimised human agency—led by an industry that has been hostile to privacy from the start.

In fact, consent is required for what Shoshana Zuboff calls Surveillance Capitalism. That form of capitalism is based on inferred or extracted consent. The only way we can defeat that regime is by re-basing e-commerce on contractual agreements in which customers take the lead. After all, it’s their privacy that needs protection.

The surveillance economy is limited entirely by its methods, which are built around grabbing attention, harvesting data, and guessing at people.

We can replace it with an intention economy that’s based on what customers actually want. The range of those wants far exceeds what companies and their systems can guess at. Far more business, and business improvement, opens up when market intelligence can flow both ways. In the consent/surveillance regime, it can’t, because all relationships are silo’d in sellers’ separate systems, all built to minimize customer interactions, by design. But relationships built on respectful contractual agreements can be far more capacious when those relationships start with forms of mutual trust that whole markets share. That’s what MyTerms makes possible.

Here is a quick outline of some additional benefits.

For customers, the most obvious one is getting rid of cookie notices, which are annoying and not worth the pixels they are printed on.  If a company really does care about personal privacy, it’ll respect personal privacy requirements. This is how things work in the natural world, where tracking people like marked animals has been morally wrong for millennia. In the digital world, however, agreements need to be explicit, so programming and services can be based on them. MyTerms does that.

For business, MyTerms has lots of advantages:

• Reduced or eliminated compliance risk
• Competitive differentiation
• Lower customer churn
• A basis for real rather than coerced relationships
• A basis for better signalling in both directions
• Reduced or eliminated guesswork about what customers want, how they use products and services, and  how both might be improved

Lawyers get a new market for services on both the buy and sell sides of the marketplace. Companies in the CMP (consent management platform) business (e.g. Admiral and OneTrust) have something new and better to sell to enterprises (and perhaps to people as well).

Lawmakers and Regulators can start looking at the Internet and the Web as places where freedom of contract prevails, and contracts of adhesion (such as what you “agree” to with cookie notices) are obsolete.

Developers can have a field day (or decade). Look for these categories to emerge

• Agreement Management Platforms — an evolutionary step forward from consent management platforms.
• Customer Relationship Management (CRM) – Make its middle name finally mean something.
• Customer Data Return (CDR) – Give, sell back, or share with customers the data you’ve been gathering without their permission since forever. Talking here to car companies, TV makers, app makers, and every other technology product with spyware onboard for reporting personal activity to parties unknown.
• Vendor Relationship Management (VRM) Tools and services — a customer hand for CRM to shake.
• Platform Relief –  Free customers from the walled gardens of Apple, Microsoft, Amazon, and every other maker of hardware and software that currently bears the full burden of providing personal privacy to customers and users. Those companies can also embrace and help implement MyTerms for both sides of the marketplace.
• Personal AI (pAI)– Till and plant a vast new greenfield for countless companies, old and new. This includes Apple (which can make Apple Intelligence truly “AI for the rest of us” rather than Siri in AI drag), Mozilla (with its Business Accelerator for personal AI) , Kwaai (for open source personal AI), and everyone else who wants to jump on the train.
• Big meshes of agents, such as what these developers are all working on.

In the marketplace, we can start to see all these things:

• VRM + CRM will flourish, as described by Iain Henderson (one of MyTerms’ authors) in Towards Network-Based Ecosystems.
• We should expect improvements to digital public infrastructure, as relationships move out of Big Tech’s silos and into distributed relationship frameworks based on the Internet’s base peer-to-peer protocols.
• Predictions I made in The Intention Economy: When Customers Take Charge (Harvard Business Review Press, 2012) and Tim Berners-Lee made in the Attention vs. Intention chapter of This Is for Everyone: The Unfinished Story of the World Wide Web (Farrar, Straus and Giroux, 2025) will finally come true.
• There will be new dances between customers and companies. (“The Dance” is a closing chapter of The Intention Economy.)
• New commercial ecosystems can grow around a richer flow of useful information in both directions, based on shared interest and trust between customers and companies.
• Surveillance capitalism will be obsolesced — and replaced by an economy aligned with personal agency and mutual respect from contractual partners.

And much more.

So it would be helpful for the European Commission to expand its scope from protecting data subjects to empowering first parties. They can do that by welcoming MyTerms in the Omnibus Directive, expanding human agency into a new greenfield where boundless positive outcomes can flourish.

---

Drafts of myterms agreements are currently posted at MyTerms.info, which is a project of Customer Commons and MyData Global. You can also read more about MyTerms in writings by Iain Henderson, Nitin Badjatia, and me.

We also invite you to join the ProjectVRM list, where we can converse and collaborate on moving MyTerms forward.

Rendez-vous majeur, la Conférence nationale du handicap (CNH), à laquelle la CNAPE, fédération des associations de protection de l’enfant, a participé, a eu lieu il ...

Lire la suite

L’article Enfants protégés en situation de handicap : « un continent oublié » est apparu en premier sur Santé Mentale.

Cannes va être de nouveau sous les feux des projecteurs du 14 au 25 mai prochain lors de son Festival International du Film. Sa mairie annonce qu’elle va expérimenter à cette occasion l’usage de caméras de vidéoprotection augmentées par l’IA aux abords du Palais des festivals et des congrès.

La loi du 19 mai 2023 relative aux jeux Olympiques et Paralympiques de 2024 a été promulguée suite aux incidents survenus au Stade de France lors de la finale de la ligue des champions en mai 2022. Elle autorise l’expérimentation de la vidéosurveillance intelligente afin de renforcer la sécurité lors d’événements sportifs, récréatifs ou culturels exposés à des risques. Toutefois, s’il est possible d’utiliser les caméras augmentées par l’IA pour détecter en temps réel les mouvements de foule, les sacs abandonnés ou les comportements suspects, la reconnaissance faciale et l’identification biométrique sont, quant à elles, exclues.

La ville de Cannes, pionnière dans le domaine de la vidéoprotection avec 884 caméras déployées sur son territoire (soit une caméra pour 84 habitants), s’est portée volontaire auprès du ministère de l’Intérieur pour expérimenter la vidéoprotection algorithmique lors de son prochain Festival du cinéma.

Dix-sept caméras augmentées vont ainsi être installées aux abords du Palais des festivals et des congrès, pour détecter des colis abandonnés, la présence ou l’utilisation d’armes, le non-respect du sens de circulation, le franchissement ou la présence dans une zone sensible ou interdite, une personne au sol, un mouvement de foule, une densité trop importante de personnes ou un départ d’incendie. Les opérateurs du Centre de Protection Urbain municipal (CPU) pourront alors déclencher des interventions plus rapides.

Un retour d’expérience sera communiqué au ministère de l’Intérieur dans les 15 jours suivant l’évènement.

David Lisnard, le maire de Cannes, commente :

“La municipalité a sollicité dès 2019 l’usage de moyens technologiques de surveillance supplémentaires pour lutter au mieux contre le terrorisme et le banditisme, dans un cadre judiciarisé et protecteur des libertés individuelles. Avec la loi relative aux Jeux Olympiques et Paralympiques de 2024, nous allons enfin pouvoir déployer, à titre expérimental, des caméras équipées d’Intelligence Artificielle reliées à notre CPU pour identifier des situations à risque. Couplé à l’efficacité de notre réseau de vidéoprotection, le plus dense de France, l’objectif est de gagner du temps pour déclencher au plus tôt la chaîne d’alerte et rendre le dispositif de sécurité plus efficace. Je salue la décision du ministère de l’Intérieur d’avoir choisi Cannes et le premier festival culturel au monde pour tester cet outil”.

La société française Yousign propose une option gratuite d'utilisation de la signature électronique pour les particuliers.
— Permalien

I’ve owned a lot of bad cars in my decades.  But some I’ve loved, at least when they were on the road. One was the 1965 Peugeot 404 wagon whose interior you see above, occupied by family dog Christy, guarding the infant seat next to her. You’ll note that the hood is open, because I was working on it at the time, which was constantly while I owned it.

I shot that photo in early 1974, not long after arriving at our new home in Graham, North Carolina. The trip down from our old home in far northern New Jersey was one of the most arduous I’ve ever taken, with frequent stops to fix whatever went wrong along the way, which was plenty.

Trouble started when a big hunk of rusted floor fell away beneath my feet, so I could see the New Jersey Turnpike whizzing by down there, while worrying that the driver’s seat itself might fall to the moving pavement, and my ass with it.

The floor had rusted because rainwater would gather in the air vents between the far side of the windshield and the dashboard, and suddenly splat down on one’s feet, and the floor, soon as the car began to move.  (The floor was prepared for this with a drainage system of tubes laminated between layers of metal, meant to carry downward whatever water fell on top. Great foresight, I suppose. But less prepared was the metal itself, which was determined to rust.)

Later a can attached to the exhaust manifold blew to pieces so sound and exhaust straight from the engine sounded like a machine gun and could be heard to the horizons in all directions, and echoed into the cabin off the pavement through the new hole in the floor. I am sure that the hearing loss I have now began right then.

I replaced the lost metal with an emptied V8 juice can that I filled with steel wool for percussive exhaust damping, and fastened into place with baling wire that I carried just in case of, well, anything. I also always carried a large toolbox, because you never know. If you owned a cheap used car back in those days, you had to be ready for anything.

The car did have its appeals, some of which were detailed by coincidence a month ago by Raphael Orlove in Jalopnik, calling this very model the best wagon he’s ever driven. His reasons were correct—for a working car. The best feature was a cargo area was so far beyond capacious that I once loaded a large office desk into it with room to spare. It also had double shocks on the rear axle, to help handle the load, plus other arcane graces meant for heavy use, such as a device in the brake fluid line to the rear axle that kept the brakes from locking up when both rear wheels were spinning but off the ground. This, I was told, was for drivers on rough dirt roads in Africa.

While the Peugeot 404 was not as weird in its time as the Citroën DS or 2CV (both of which my friend Julius called “triumphs of French genius over French engineering”), it was still weird as shit in some remarkably impractical ways.

For example, screw-on hubcaps. These meant no tire machine could handle changing a tire, and you had to do the job by hand with tire irons and a sledgehammer. I carried those too. For unknown reasons, Peugeot also also hid spark plugs way down inside the valve cover, and fed them electricity through a spring inside a bakelite sleeve that was easy to break and would malfunction even if they weren’t broken.

I could go on, but all that stuff is beside my point, which is that this car was, while I had it, mine. I could fix it myself, or take it to a mechanic friendly to the car’s oddities. While some design features were odd or crazy, there were no mysteries about how the car worked, or how to fix or replace its parts. More importantly, it contained no means for reporting its behavior or use back to Peugeot, or to anybody.

It’s very different today. That difference is nicely unpacked in A Fight Over the Right to Repair Cars Turns Ugly, by @Aarian Marshall in Wired. At issue are right-to-repair laws, such as the one currently raising a fuss in Massachusetts.

See, all of us and our mechanics had a right to repair our own cars for most of the time since automobiles first hit the road. But cars in recent years have become digital as well as mechanical beings. One good thing about this is that lots of helpful diagnostics can be revealed. One bad thing is that many of those diagnostics are highly proprietary to the carmakers, as the cars themselves become so vertically integrated that only dealers can repair them.

But there is hope. Reports Aarian,

…today anyone can buy a tool that will plug into a car’s port, accessing diagnostic codes that clue them in to what’s wrong. Mechanics are able to purchase tools and subscriptions to manuals that guide them through repairs.

So for years, the right-to-repair movement has held up the automotive industry as the rare place where things were going right. Independent mechanics remain competitive: 70 percent of auto repairs happen at independent shops, according to the US trade association that represents them. Backyard tinkerers abound.

But new vehicles are now computers on wheels, gathering an estimated 25 gigabytes per hour of driving data—the equivalent of five HD movies. Automakers say that lots of this information isn’t useful to them and is discarded. But some—a vehicle’s location, how specific components are operating at a given moment—is anonymized and sent to the manufacturers; sensitive, personally identifying information like vehicle identification numbers are handled, automakers say, according to strict privacy principles.

These days, much of the data is transmitted wirelessly. So independent mechanics and right-to-repair proponents worry that automakers will stop sending vital repair information to the diagnostic ports. That would hamper the independents and lock customers into relationships with dealerships. Independent mechanics fear that automakers could potentially “block what they want” when an independent repairer tries to access a car’s technified guts, Glenn Wilder, the owner of an auto and tire repair shop in Scituate, Massachusetts, told lawmakers in 2020.

The fight could have national implications for not only the automotive industry but any gadget that transmits data to its manufacturer after a customer has paid money and walked away from the sales desk. “I think of it as ‘right to repair 2.0,’” says Kyle Wiens, a longtime right-to-repair advocate and the founder of iFixit, a website that offers tools and repair guides. “The auto world is farther along than the rest of the world is,” Wiens says. Independents “already have access to information and parts. Now they’re talking about data streams. But that doesn’t make the fight any less important.”

As Cory Doctorow put it two days ago in Agricultural right to repair law is a no-brainer, this issue is an extremely broad one that basically puts Big Car and Big Tech on one side and all the world’s gear owners and fixers on the other:

Now, there’s new federal agricultural Right to Repair bill, courtesy of Montana Senator Jon Tester, which will require Big Ag to supply manuals, spare parts and software access codes:

https://s3.documentcloud.org/documents/21194562/tester-bill.pdf

The legislation is very similar to the Massachusetts automotive Right to Repair ballot initiative that passed with a huge margin in 2020:

https://pluralistic.net/2020/09/03/rip-david-graeber/#rolling-surveillance-platforms

Both initiatives try to break the otherwise indomitable coalition of anti-repair companies, led by Apple, which destroyed dozens of R2R initiatives at the state level in 2018:

https://pluralistic.net/2021/02/02/euthanize-rentiers/#r2r

It’s a bet that there is more solidarity among tinkerers, fixers, makers and users of gadgets than there is among the different industries who depend on repair price-gouging. That is, it’s a bet that drivers will back farmers’ right to repair and vice-versa, but that Big Car won’t defend Big Ag.

The opposing side in the repair wars is on the ropes. Their position is getting harder and harder to maintain with a straight face. It helps that the Biden administration is incredibly hostile to that position:

https://pluralistic.net/2021/07/07/instrumentalism/#r2r

It’s no coincidence that this legislation dropped the same week as Aaron Perzanowski’s outstanding book “The Right to Repair” — R2R is an idea whose time has come to pass.

https://pluralistic.net/2022/01/29/planned-obsolescence/#r2r

[The next day…]

Cory just added this in a follow-up newsletter and post:

…remember computers are intrinsically universal. Even if manufacturers don’t cooperate with interop, we can still make new services and products that plug into their existing ones. We can do it with reverse-engineering, scraping, bots – a suite of tactics we call Adversarial Interoperability or Competitive Compatibility (AKA “comcom”):

https://www.eff.org/deeplinks/2019/10/adversarial-interoperability

These tactics have a long and honorable history, and have been a part of every tech giant’s own growth…

Read all three of those pieces. There is much to be optimistic about, especially once the fighting is mostly done, and companies have proven knowledge that free customers—and truly free markets—are more valuable than captive ones. That has been our position at ProjectVRM from the start. Perhaps, once #R2R and #comcom start paying off, we’ll finally have one of the proofs we’ve wanted all along.