◆ Semantic Web Catalogue

Problem thread

Who controls data about me?

Can people decide what happens to data about them, and can machines read and respect those decisions?

issue
governance
also trust, topology
status
open
steps
8, 2002–2026
threads
all problem threads

The Web's first answer was machine-readable notice: P3P let sites declare their practices and browsers compare them with users' preferences, but almost no one implemented it. Researchers then argued for accountability over access control, Solid proposed that people keep their data in stores they control, and the EU made the question law with the GDPR. Vocabularies for describing processing and consent followed; whether they change practice is still open.

Lineage

  1. 16 Apr 2002
    proposes standard
    Platform for Privacy Preferences

    Websites declare in machine-readable form what they do with visitors' data, and browsers compare it with the user's preferences. Few sites or browsers implemented it, and the W3C made it obsolete in 2018. [src1][src2]

  2. Jun 2008
    proposes writing ★ seminal
    Information Accountability

    Privacy and copyright debates have been dominated by access restriction, which an open information environment outpaces; systems should instead make the use of information transparent and accountable to rules. [src1][src2]

  3. Jun 2013
    poses writing
    NSA Prism program taps in to user data of Apple, Google and others

    The Snowden documents show that data people gave to large platforms was also collected by a state intelligence agency, through the companies, without their knowledge. [src]

  4. c. 2015
    proposes project ★ seminal
    Solid

    People keep their data in 'pods' they control, and applications read and write it through Linked Data standards with their permission, instead of each service keeping its own copy. [src]

  5. 14 Apr 2016
    proposes project
    General Data Protection Regulation

    The EU makes control over personal data a legal right: adopted in April 2016 and applied from May 2018, the regulation binds anyone processing personal data, with direct effect across the EU. [src]

  6. 17 Mar 2018
    measures writing
    Revealed: 50 million Facebook profiles harvested for Cambridge Analytica in major data breach

    A quiz app's access to friends' data let a political consultancy obtain profiles of tens of millions of Facebook users who never used the app; Facebook then cut back what apps could read. [src1][src2]

  7. 5 Dec 2022
    responds standard
    Data Privacy Vocabulary
    ↳ responds to General Data Protection Regulation

    A W3C community group publishes a vocabulary for describing what data is processed, why and on what legal basis, designed to support requirements such as the GDPR's. [src1][src2]

  8. 31 Mar 2026
    proposes standard
    Linked Web Storage Protocol

    The W3C drafts a protocol for giving applications secure, permissioned access to data stored outside the application, in an interoperable way. [src]

Recent signals

Dated events that show the problem moving, newest last.

  1. 19 Nov 2025

    The European Commission proposes a Digital Omnibus that would move cookie rules into the GDPR and require sites to accept consent signals sent by the browser.[src]

  2. 18 Jun 2026

    EU member states' compromise text drops the browser-signal article from the Digital Omnibus.[src]

Open now

Under each question, the answers people have put forward or built. The catalogue gives no odds on them.

  • Will machine-readable privacy statements be adopted this time? [src1][src2]
    P3P failed for lack of implementations; the president of TRUSTe put this down to difficulty and lack of value. DPV now describes processing in the GDPR's terms.
    • A browser signal that the law makes binding.
      Global Privacy Control is a W3C Privacy Working Group item since November 2024, and California's privacy law requires businesses to honour it.[src]
    • A shared vocabulary for recording processing and consent. Data Privacy Vocabulary
      The Data Privacy Vocabulary describes purposes, legal bases and consent in RDF.[src]
  • Will people hold their own data, or keep granting access to platforms? [src1][src2]
    Solid's pods put storage under the person's control; the W3C's Linked Web Storage working group is standardising the protocol.

Forces

Pressures that push this problem one way or another, as their sources argue them. All forces

Decision points

Dated moments when a decision or a deadline can change the outcome.

  1. 8 Jan 2027
    Linked Web Storage charter ends charter

    The W3C group standardizing Solid's storage protocol is chartered until this date.[src]

How to contribute