We just marked a significant milestone in the development of the Data Rights Protocol: the release of v0.9. This is the first stable version of the protocol, equipped with security and identity features that enable its deployment in production systems.
For years, Consumer Reports has led the way in advocating for consumer data rights. Despite Congress’ inability to enact a national privacy law, several states have implemented their own privacy rules. These state privacy laws empower consumers with the ability to access, delete, and opt out of the sale of their data.
While data rights now exist in many states, they can be challenging for consumers to use and for companies to honor—particularly when dealing with a large volume of requests. Many individuals have chosen to enroll an intermediary or “authorized agent” to help manage their data, while companies have been seeking guidance on how to process data rights requests sent via these agents.
The Data Rights Protocol answers this call: it provides a standard for the various industry actors involved in handling data rights requests involving authorized agents. By combining technical APIs with governance practices and operating agreements, the protocol facilitates smoother processing of consumer data rights requests.
The protocol was co-developed by eleven major players in digital privacy and has been tested by a handful of these implementers. Credit is due to OneTrust, Transcend, Incogni, and Ethyca, each of whom have successfully tested the protocol and are on-track to implement it in their production systems.
To ensure transparency and accessibility, the Data Rights Protocol consortium has also launched a user-friendly website that offers comprehensive information about the protocol and regular updates.
We’re looking forward to moving this crucial work into production and finally unlocking machine-readable request exchange across the privacy ecosystem. If you’re interested in learning more, reach out via datarightsprotocol@cr.consumer.org.
Acknowledgements to Ryan Rix who developed Data Rights Protocol v0.9, and to Daniella Raposo and the team at Ocupop for their collaboration on the Data Rights Protocol website.
