What happened when Vana met the world stage at Geneva
On Thursday 3 September, in Room G at Palexpo in Geneva, the Personal Data Portability Protocol (PDPP) opened for public review. The setting was the Global Digital Collaboration Conference, one of the largest gatherings of the organisations that write the rules the internet runs on. The Swiss Confederation co-hosts it with the ITU, ISO, IEC, W3C, the European Commission and the World Health Organization, and its programme is where identity, payments, health data and AI standards are argued over by the bodies that will ratify them.
Most of what makes the internet work was settled in rooms like this one. The web itself is a W3C standard. The encryption behind every padlock in your browser is an IETF one. Wi-Fi and Ethernet are IEEE, and the ISO and IEC standards underneath payments and identity are why a card issued in one country works in another. None of it shipped on a product timeline. Each was argued into existence by the bodies that meet here, and adopted because they signed off. A specification for how personal data moves belongs in that room, so that is where we took it.
The session, "The Wild West of Personal Data: Building AI's Missing Primitive", was co-organised with Linux Foundation Decentralized Trust (LFDT) and the IEEE Standards Association. Tim Nunamaker opened with the technical introduction to the specification. Art Abal set out the governance and opened the review, then moderated the panel: Karen Mulberry of the IEEE Standards Association, Professor Antonino Rotolo of the University of Bologna and the EUSAiR regulatory sandbox programme, Tricia Wang of the Advanced AI Society, Justin Slaughter of Paradigm, and Anna Kazlauskas.
Who was in the room
The room was full. Regulators from many countries sat alongside people from the standards bodies, and alongside commercial teams already trying to put personal data to work in AI products and meeting the same problem from the other side. That mix is why a specification like this goes to Geneva rather than to a developer conference. A standard for how personal data moves has to hold for all three at once, and this was the first time all three had it in front of them in the same hour.
The question that ran through the session
The sharpest question from the floor was the simplest. Data portability has been written into law for years, in Europe and elsewhere, and the right to one's own data is not a new idea. So why has it taken this long for a technical standard to exist?
The answer that emerged over the hour was that the impetus was never there. The obligation sat with the platforms, and the platforms had no reason to build a common method for letting data leave. Policy people wrote the right. Engineers built for their own products. Nobody sat between the two with a reason to carry a method from one side to the other.
AI changed that. Every AI system now depends on what it knows about the person it is answering, and that knowledge is held across the services where the person created it. At the same time, people increasingly feel they have a great deal of data and no control over any of it. Demand for context and demand for control arrived together, and together they supplied the impetus that regulation alone never did.
Vana's part in that is convening, and it earned the seat by running the thing. The protocol started at the MIT Media Lab, and the team has always put policy people and engineers in the same room, which is the combination this problem had been missing. Vana is the first implementation of personal data portability at this scale and the one carrying the volume: more than 1.5 million contributors and over 20 million data points served under the person's permission on the network. PDPP came out of several years of that research and out of running that network. Geneva was the first time it was put in front of the people who would have to adopt it.
What PDPP is
PDPP defines how a person permits an application's access to specific personal data: which records, under what scope, for how long, revocable at any time, with a record the server enforces. It profiles OAuth 2.0 and RFC 9396, the authorisation rails the internet already runs on, so a team that has implemented OAuth already knows most of it. The specification, governance document and reference implementation are at pdpp.dev.
PDPP is one component of the Vana network, the part that governs how a person's data moves. Around it sit the components that make that movement worth anything: Data Collectives that pool consented data into datasets AI could not otherwise obtain, verification and an on-chain record of every transaction, self-sovereign compute, and the applications built on user-owned data. Portability was in the network's original design, and it is what let the rest get built. The standard is open on purpose. The network, the verification, the record and the apps around it are the harder part, and that is what Vana runs.
Why it lives at LFDT
A standard owned by one company is not a standard. Vana contributed PDPP to LFDT as a Community Specification so that it is developed in the open and governed independently of Vana and Open Data Labs. The technical committee has a majority independent of both, decisions are published, and Vana serves as interim steward only until the Partners elect a steering committee.
Adoption is the point. When governments and industry adopt an open standard for how personal data moves, that is evidence the thesis this network was built on was right.
Four public working sessions through August went through the document section by section, and the version now under review is better than the one the working group first read. The recordings and notes for all four are on the PDP-Connect repository.
Where it goes from here
Public review is open until 1 October. Every comment gets a numbered ticket and a published disposition when the review closes, and the route in is on the participate page.
If you could not be in Geneva, the next session is online. On Thursday 10 September at 9am Pacific (16:00 UTC), LFDT San Francisco hosts "Introducing PDP-Connect: Building an Open Standard for Personal Data Portability", with Tim and Art walking through the specification and taking questions. Register on the LFDT San Francisco meetup page.