December 2025 - Wg-ancr - mailman.kantarainitiative.org

Introducing - ISO/IEC 27560-1 Universal Notice Receipt Profile — Submission & Holiday Greetings
by Mark Lizar 23 Dec '25

23 Dec '25

Dear W3C DPV, Kantara ANCR WG, and Consent Receipt Contributors (bcc’d) I'm delighted to contribute this back to these groups that we volunteer too and to support the many people who power them with this Convention 108+ Code of Conduct for International-Data Transfers with Consent. — ISO/IEC 27560-1 Please find linked herein the ISO/IEC 27560-1 Universal Notice Receipt <https://gitlab.com/gdta/standards/-/blob/7cc30b1414dbc2228eab14458fd0a6aa01…> (submitted via Canada tomorrow December 24th). With a companion submission for IETF Submission <https://gitlab.com/gdta/standards/-/blob/7cc30b1414dbc2228eab14458fd0a6aa01…> Well-Known Location for Transparency also under review. I hope this work is well received among working group participants who have followed the many years of notice and consent research (the consent receipt work) and witnessed the struggles to render this work clearly comprehensible and useful in common practice. Hopefully in time to support an alternative to the EU Omni-bus. It is clear that Immense value and benefit for our societies remains unrealised without practical pathways to implementation of this great work. This profile is transmitted in that spirit—as a hopeful contribution and expression of gratitude to the many contributors devoting time and expertise to advancing these groups' objectives and the parallel efforts striving for open publication of associated standards. This proposed ISO/IEC 27560-1 Profile (is from the consent receipt work, and is free and open to use as Public Digital Infrastructure under RF-RAND License) plugs into the 27560:2025 WD code of conduct field and is specified in two parts: Universal Notice Receipt (MVCR) ANCR Receipt Exchange This profile contribution delivers more than the sum of its parts. To explore just how true this may be, we're kicking off 2026 with renewed regulatory innovation research and invitations to discover together how we can scale data governance while recovering and renewing privacy transparency and control—aligning them with law, legal precedent, and generally accepted common views on basic human rights. No need to wait. If you feel this work addresses yet under-represented voices you're invited to get in touch directly. So it is with Holiday Cheer that we celebrate this and all the Digital Privacy Governance breakthroughs in 2025, and raise a glass to the W3C DPV CG, ISO/IEC JTC 1 WG5, Kantara ANCR, IEEE Digital Privacy, Sensorica-Labs and everyone ever involved in the development of this work! Happy Holidays from Canada! Mark Lizar Executive Director @ Transparency Lab <https://transparencylab.ca/> & Global Digital Transparency Alliance: GDTA.Online <http://gdta.online/> Special Thanks to: John Wunderlich, Mary Hodder, Reuben Binns, Renee Lloyd, Iain Henderson, Joe Andrieu, Tim Reiniger, Eve Maler, Joni Brennan, Joss Langford, Joel Geddes and Sal D'Agostino, More about the proposed 27560-1 Profile (which has been kept quite until now) It has a number of Appendices for its extension which DPV enables for interoperability, including GPC, & My Terms can be added as soon as it released in the new year - perfect timing for the Convention 108+ international privacy day) It is supported by the Kantara ANCR WG- Transparency Performance Indicator - Report (TPI-R) Benchmark <https://kantarainitiative.org/reports-recommendations/>. The tool that extends the MVCR (minimum viable consent receipt) and the ANCR (authC exchange protocol) used to research, develop and test with. Promoted for use as a collective action and multi-lateral enforcement tool, for l governing valid consent. The Case Study Research: Benchmarking Cookies in the Google Chrome Browser ends up revealing the surveillance laundering of the IAB, a Medical Clinic Website, and Google Chrome Browser itself. (TPI-Report Method <https://gdta.online/insights>) Insights presented at https://gdta.online/insights uncovers data protection policy gaps, Last but not least your are cordially invited to participate in this regulatory innovation survey i <https://gamma.app/docs/1sa6satylq4t5qi> for regulatory policy and standards community.

1 0

Draft Charter
by Salvatore D'Agostino 17 Dec '25

17 Dec '25

For today's call Charter (draft) - WG - ANCR - Kantara Initiative<https://kantara.atlassian.net/wiki/spaces/WA/pages/1394933762/Charter+draft>

1 0

ANCR WG call reminder - tomorrow 23rd, April / 1.00pm EST
by Gigi Agassini 17 Dec '25

17 Dec '25

Dear ANCR WG. This is a friendly reminder about our meeting scheduled for tomorrow at 1:00 PM EST. Agenda: Please find the agenda here: Agenda Link<https://kantara.atlassian.net/wiki/x/DQBYOg> Call Link: Join the Meeting<https://us06web.zoom.us/j/87282263538?pwd=K0RwY1g1b3pKeHdBcXpjeExVZUFpQT09> I look forward to seeing you all tomorrow. Kindest Regards, Gigi Agassini

1 8

ANCR WG Attributions - TPI-R Suggestion for 27560 profile and finishing CIR spec .
by Mark Lizar 16 Dec '25

16 Dec '25

HI, As we discussed, I am pushing this wrt to work group work t the email list, 1. Nudge that there is a PII Controller Identification Record specification on the Wiki ? This is the missing reference for the 27560 Profile and needed for the TPI-R (imho) The Controller identification record specification (drafted here <https://kantara.atlassian.net/wiki/spaces/WA/pages/903479352/ANCR+PII+Contr…>) If anyone is up or taking a peak? 2. Also, Draft text wrt to adding informative appedendix for - TPI-R to 27560 Universal Receipt profile v1 (for Convention 108 + code of conduct) with how they relate to assurance levels, now called Transparency and Trust Assurance (TATA) Levels, (needed to clarify in relation to digit trust.) Would there be any objection to including this as an informative practice indicating that the profile I am submitting would be verifiable using existing Kantara TPI-R methodology ? And its presented as a regulatory utility in a transparency registry context. (Chances are I can update before its submitted but no guarantees) - Best, Mark **Status**: INFORMATIVE — This appendix does not affect conformance to the Universal Notice Receipt Profile v1.0 ### L.1 Purpose TPI-R (Transparency Performance Indicator Report) provides standardized methodology for verifying Universal Notice Receipt Profile implementation through four measurable indicators. ### L.2 Four Transparency Performance Indicators **TPI-1 (Timing)**: Controller-ID presented BEFORE processing - **Maps to**: Section 5.3 Anonymous-by-Default Architecture - **Verification**: CIR publication timestamp vs. first processing event **TPI-2 (Completeness)**: All mandatory CIR fields populated - **Maps to**: Section 7.1 Mandatory Conformance Requirements - **Verification**: ISO/IEC 27560:2025 field completeness check **TPI-3 (Accessibility)**: Rights access point operational - **Maps to**: Section 5.4 Controller Identification Record - **Verification**: rights_access_point endpoint response time, Notice Event Log queryability **TPI-4 (Security & Sovereignty)**: Scope of disclosure alignment with processing location - **Maps to**: Section 6.1.2 Cross-Border Transfer Fields - **Verification**: recipient_jurisdictions vs. actual processing locations, surveillance_risks disclosure accuracy ### L.3 TPI-R Scoring - Each indicator scores: -1 (non-compliant), 0 (partial), +1 (compliant) - Universal Notice Receipt Conformance requires: TPI-1 = +1, TPI-2 = +1, TPI-3 ≥ 0, TPI-4 ≥ 0 - Full compliance (all four +1) demonstrates transparency-by-default operational state ### L.4 Relationship to Conformance Levels - **TATA Level 1** (Self-Assertion): TPI-R optional - **TATA Level 2** (Registry Verification): TPI-R score ≥ 60% (3 of 4 indicators positive) - **TATA Level 3+**: TPI-R score ≥ 75%+ with third-party audit ### L.5 Reference Implementation See Kantara Initiative ANCR TPI-R Specification (Recommendation, August 2025) for complete assessment methodology.

1 0

NIST NCCoE mDL update
by Salvatore D'Agostino 15 Dec '25

15 Dec '25

This is tomorrow. Mobile Driver's License Project Update Webinar Registration here if interested. https://nist.zoomgov.com/webinar/register/WN_8lw8qrPrQTCdaedOrKrCjQ IDmachines 4 Lamson Place Cambridge, MA 02139-2612 +1 617.201.4809 @idmachines https://idmachines.com Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. If you have received this email in error, please delete it and advise the sender.

2 1

Can the GPC standard eliminate consent banners in the EU?
by Salvatore D'Agostino 10 Dec '25

10 Dec '25

0 *H÷ 010 `He0 *H÷ $eContent-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Working draft TPIs call much of this out and map it to 27560 and other frameworks, I am working now to show mappings to this and will share with the group. https://arxiv.org/pdf/2512.08856 IDmachines 4 Lamson Place Cambridge, MA 02139-2612 +1 617.201.4809 @idmachines https://idmachines.com Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. If you have received this email in error, please delete it and advise the sender. ü0`0H BE#ÈDµ0 *H÷ 0J10 UUS10U IdenTrust1'0%UIdenTrust Commercial Root CA 10 140116181223Z 340116181223Z0J10 UUS10U IdenTrust1'0%UIdenTrust Commercial Root CA 10"0 *H÷ 0 §PÞ?=Ô3FñoQa²©Og]ÙSÝ(Ù×ðÿ®Crùµ]|ÁBá1PtÑ |Í!«Câ¬^nó Z2œ¢ëùè\ ìÿÒ¯q³ŽSNïŒœìO20K^WÄSÂöÙb+¿$bßÃž)KIx<`"üÚ6ÈÂ¢Ô,Tg5ns¿Xð€Ýå°¢&zÊà6¥õý·ï®?@õmZýÎ4Ê$Üt#]3]Ä%ö0Ý]àÕGœŽë¡»IIØ[óä$äbOOÁ¯tšÑrjzIÌŽFyÆ±ÚYúu!eÝVÎû«¥`ÄùR°œù+# #v;÷3áÉóiùK¢àNŒ~9÷Dp~þZå±¬ÑÌò5åIIÊVÉ=û};ÁÂMÉO7é¡jßb.Ë5Qy,È%8ôúK§\Òã 9Jt|ÕYÂ?N\Rô=÷Rñê£¬ýI4(óA:îèÞÿ_ºËèò¹P`À1ÓsåïŸ í3tŸ ÄglðzUFN§ô>áöØ á3d+c×2^ùÀ{xoŒùxz×rtUtx±ºánpºO ºhÃ{ÿ1ðs==*±A þMeky3Ž×£B0@0Uÿ0Uÿ0ÿ0UíDÀÓðî€{ŸBç&TÈ6v0 *H÷ ®2öŠK|Dva'(Í^Tï%Œãù)×®háXï..~SR¶\êºP×ßa æÎÁò7x°_³¢sž8Í>°žûÀÏ±òì--Ììª³ª`-;Ã=WužÓ0Í`ÓTñMfÀ]t@£î~ÂwèÁ§]RíÉÝ%mú©í£:4ÐY{ÚíPó5¿íëM1Ç`ôÚñâHâÆÅ7ûúuYf1G)Úvé®ï¹Q÷#ib<åU6×Tÿñ¹]ÎÔ#oØEJ[eïÝ§ Ë¥%Ž ùð¢ÒôÈt¡*HeÛÄâ%}ëŸ[ TQJSì]Ê3íbýEÇ/[ÜX 9æú×þŠí=JBtÔÃwYsÍFŸU8ïúè2êX"Þ8ÃÌŒmÉ3:j i? Èêrc#œm<àILª¢¹*6xíÃèFâ&YDuÙuQÍa`Ë]ù"Mæãö[»®ÍÊJk^óQát+é~'§ÙINø¥Û%cbÉ3gk<ÆÞšÍð7qò«üAõÁì7] åNïú±\8¥JáÜ8-<Ü«ÕJîÑplÌîôWøºn00 @žáê<zÌ>BO0 *H÷ 0:10 UUS10U IdenTrust10UTrustID CA A140 240425192606Z 260426192506Z0M1!0 *H÷ sal(a)idmachines.com1(0&UA01410C0000018F16B8E1DC00130CBB0"0 *H÷ 0 êPV_FŒÞÇYÞ»1w@ ÿÈÈr/näœ»uoBŠZ@^üÈ »wýVá!ó}gk° >:¥4:ütÅe"°³XÉº&XºðpÓ²>ºEÍ?z ¬b^5á¯ôRiÓïVOgLaèÕ².úrÑF~ÃöÕ?ô5,ËÅú2¯áâœú"EÆšŽ5õ4Åk~CP*ÒfnTnhÄÈ*£}ÞIºÝ€VÛÄTÞÄEh\8ºº ù]BÊÑÈQi1¢/vNþŠÆk'5²;6ÿËènë®0 |=£00Uÿ00Uÿ 0+x0v00+0$http://commercial.ocsp.identrust.com0B+…U#0ÂÔD qÏHVŸh8\§·÷EŒ0#U 00 g0 `Hù/0EU>0<0: 8 64http://validation.identrust.com/crl/trustidcaa14.crl0U0sal(a)idmachines.com0U6(Óqï/ØD@Ø;lmXæSE~0U%0 +0 *H÷ °`ó0Äùê2`'3V-ŠÔý.ÛvéñNF$~L/2A2õþèC(á£Ãüûdï\×î ;!)GùÓ¬NÍÏÐÖ®êòrš¥%]TaË#ÑQ÷²Ö/ªÆÛä$]IÙNØCÓ*Yµ°ôHàî+ÈŠå£ªaóòœyJl[RU*wœZºé%¹v9N6¬N}íà³so4=µ#Ü)}MÅQWãQüÊoHÖþÿ©ðMoÃŠÌ^ªê,®j³± Li;I)¡Øâ&È:÷€ôÿÕç<fëñA±°ßÙm°x~š-Çu<Îý>>U±5íkªmÀÇÏë|Ô`îMEa³©)&sGriûi=Ñïfhµîuø$ÐqÃ 6ÅÆ<A<šÄÞAr7À¢dŒÀ£0ŠbZÍ»ÄÏž.î£ú§Bì)! Ûª¬Éã#jÕäbßúätâV\1èÑÄN ÓÝÝ ^ÐGÜ]šb¹ÜÞFûn}Ácô2ŽÅ]OÝ 1ö)ÉË ."La\W!!ìRj[Ø@ðÒ{ìKÆ+ÜZ3Ù%¯Áf{"ÀË7WF¯\¬1vyÓŽÄ0ô0Ü @ÿÒiÚwÂéÕMM0 *H÷ 0J10 UUS10U IdenTrust1'0%UIdenTrust Commercial Root CA 10 230816192846Z 330812192845Z0:10 UUS10U IdenTrust10UTrustID CA A140"0 *H÷ 0 è©õŒ±éäÙËíX€ËF`eð¬ûÃA`kX»0DÙ9bÜrÁñRñÕ×«²3È÷6u/!²Öa§? Œ§8lxn×î%ûf¬<²Ñ»X$=-Ÿà§ÆÍ£EðiùëžÅFÖ{ePH»òÒßqEK tG%£¹yP2`A6ìL[Nä\ÍÒ§»Ó À[:«CQR ãL|70ídj¢Et«¹}Ì u÷@ òxb× Æ°K=°1dªØØWÐ.ïvkª r Xý(bšFr|qG Ôñ³ÿ£|\3òÚtÈ:ÒXTßŒôBp`¡Â`@±[xoÄR^.W°ö@ÁÃé7¯Ì;Œ=Us¯Ø$YÂîníºË*tÅùÛò\ oþåê'Y. xp,¬\¿åù!³I.EÛË7ï¢±ßÔh[P:4£ÿ]|×2`vZXtZ+cÒŒ~ÚÖP!!4Ó3aózG]wËí=.DÜ"X¯jë]êq?å§â!»aææVBJFQCj)(ñ" êÀÈ"©&?žR§gßû--Ùùt=µK7w¬eÀ#×k%ã3Ö)ŠÁåwsšxh:ÂÝ 8Ÿmí&Û5®i"\OŽEÝ£ä0à0Uÿ0ÿ0Uÿ0+}0{00+0$http://commercial.ocsp.identrust.com0G+0;http://validation.identrust.com/roots/commercialrootca1.p7c0U#0íDÀÓðî€{ŸBç&TÈ6v0_U X0V0TU 0L0J+>https://secure.identrust.com/certificates/policy/ts/index.html0JUC0A0? = ;9http://validation.identrust.com/crl/commercialrootca1.crl0UÂÔD qÏHVŸh8\§·÷EŒ0AU%:08++ +7 +7 +7 0 *H÷ ò][i]ãR®hÝE#+ 9q7%,Lya`VRÐÛ|ìAs«ÊœkYPÄÜdw S_ÇS¡Šá°èö(1Ü@ žæŒ&tš-B9Ì§åÚTt³Ý¿xQ¿0_¬óã°lÏ>Çc@±]NDì[£]ùb9"fkj¬ØçÀÉ¬Å»µû]5O®šªJ}ø@/Sä":MÄ ¥ÜIpÎ-'- WÌ»/MNÎŸaŒ@,µtí ¿ÛøÎxÒ]ªK'Eh2»ëô¬EØÍìÁjìñK³Ô g£JGÌüž«b]aÕ6ì·»m>Ë¡Ér"HA)ãÔ®r"Dë$\4Áìwš"0ØëQ%DœÐgëZÏ]\×¹IŽ¶l#@0â èÜ;£_àº,÷íèjA=UéOÆ0üôÈÖAg!Y6 ô*s!YTÉŒ¿é©J^íxàÝN}ý+Š°L%Rmü?â/[ìs$ßÃÿeZ((ôjdÓ±x*EB;2SšDåêìÄXyÈÍÏ3ké/ÒysáÎZªf²žÍ~º£±}EÐ*)K]b8NU¢f1<080N0:10 UUS10U IdenTrust10UTrustID CA A14@žáê<zÌ>BO0 `He ¿0 *H÷ 1 *H÷ 0 *H÷ 1 251210194349Z0/ *H÷ 1" 1ÎDæ|cÀžÎ,'áµÌëÊ>ÕüB/Î©÷CZ0] +71P0N0:10 UUS10U IdenTrust10UTrustID CA A14@žáê<zÌ>BO0_*H÷ 1P N0:10 UUS10U IdenTrust10UTrustID CA A14@žáê<zÌ>BO0 *H÷ 100 `He*0 `He0 *H÷ 0 `He0*H÷ 0 *H÷ @0 `He0 `He0 `He0+0 *H÷ ka=©ÿ 9Yi=tãf÷ú6?ë}êíî.]hXø(³ö7óôHÏoÒô4Kt.4ü<Š3CËóÙZh]8Êðg<®Ë)/Ê&>¶bÇ{Þt|·SÜ<V³ÆÆCë*C\¬yÜH*kL_6³y[²YQ-ðØ·ìúâŒÒ<ì2^âÙµ~ÆØíîv³jG{àpÉjwëéŽÎóúØ(ø'tëÔ}ÈeucÓB çŒÿ\å-Ná ¥Õqýú"ëU<(+€.÷Êô-æõ©Õ®î6£_<èy

1 1

IEEE Digital Privacy Presentation today at 4pm
by Mark Lizar 04 Dec '25

04 Dec '25

Hello All, Just a heads up there is a IEEE Digital Privacy presentation today which i am presenting on the update to ANCR WG, and the 27560 MVCR-ANCR Digital Privacy Profile due for submission on Dec 24, which has extensions for ISO security and privacy of genAI, and a security and privacy of digital twins use case using the 27560/ANCR PII controller identity record, which is also used for the ANCR Transparency Performance Indicator - Benchmark Conformance and Compliance Report. Everyone is welcome, Executive Director Digital Transparency Lab Mark 4pm today IEEE Digital Privacy cheduled Zoom meeting. Join Zoom Meeting https://us06web.zoom.us/j/85629922168?pwd=TQxdjivkqH5wMi9gVOC4gdL5savz3k.1 Meeting ID: 856 2992 2168 Passcode: 178595

1 0