26 Sep 2026 Search

previously: paleoenshittification and a path to adoption for MyTerms

One of the big questions about MyTerms is, well, why should sites support it when they can already get “consent” to process people’s personal info using the existing industry standard—Global Privacy Protocol from IAB Tech Lab—and all the available “consent management” (annoying cookie banner) tools that support it?

But MyTerms has been in the pipe for quite a while. While MyTerms has been going through the IEEE process as “IEEE 7012-2025 Standard for Machine Readable Personal Privacy Terms” a lot of other news has happened, so there are now more reasons why a site would want to get a contract in place with a visitor.

MyTerms might have started out as a one-sided trade:

  • Visitor: I get to not be surveilled

  • Site: We have to do extra work to fix something we thought we already did when we set up GPP

But now it’s much more balanced. The top-level trade is:

  • Big companies are trying to surveil me. I want a contract where you promise not to participate in that.

  • Big companies are scraping my content. I need a contract where you promise not to participate in that.

Win-win. With the right contract, both sides get what they want. The visitor can get part way to what they want with an OOPS/UOOM (GPC), but there are already ways to work around that. And the site might be able to get part of what they want with an LLM training opt out, but the bewildering array of “agent” tool stacks has some workarounds for that too. Both sides are better off with a symmetrical deal: you don’t feed me to the oligarchy bots, I don’t feed you to the oligarchy bots.

Both problems could be addressed with the right contract—but it would be counterproductive for either sites and their service providers or for visitors and their privacy tools to try to get a contract with just “their” half.

And yes, the contract can say that the visitor doesn’t get to collect/infer personal data from the site, and the site doesn’t get to train LLMs on the visitor’s activity or UGC. Make it as close as possible to a mutual defense pact, fair to both sides.

Some contracts will include terms like

  • You can train if you pay into [training rights clearinghouse]

  • You can use this identifier for me because I get paid (the Rewarded Interest model)

and they’ll probably consolidate on a few big ones like open source licenses did.

This sounds like a big deal, and in the long run it will be, but if it’s built bottom-up by using and extending existing privacy tools, individuals can see a win before the big picture emerges. And if it’s easy to install on a site then small-time sites can start to see a contractual advantage over “AI” that the bigger sites stuck with a GPP-only approach are missing out on.

And yes, drafting the contracts will be tricky. Some exceptions will need to be in place in order to make it practical for sites and for individual users who both have to participate in society.

  • In order to get my web site hosted, I’m going to have to collect enough data, or allow my host to collect it, to detect and deal with abuse.

  • Consumer research groups are going to want to pull just enough data from a visit to detect surveillance pricing, and have the rights to feed that data to their data science stack.

Both sides will have to say something like, I’ll only collect enough info to verify that you’re holding up your end. And make those terms as mirror image as possible.

Some of the possible “legal payloads” for MyTerms will have to include permission to use data for personalizing ads, because some people prefer the ads they get to be personalized and will complain if that doesn’t work. The 51Degrees “Model Terms for Marketing is a good example of that kind of agreement.