# Progress — Who Writes the Terms? A History of Privacy **Repository:** `fritzhand/history-of-privacy` **Branches:** `main` (GitHub Pages) and `claude/privacy-history-research-z9ozcn`, kept identical **Last updated:** 2026-09-23 A domain fork of `fritzhand/history-of-indigo`, built in one pass: a research sweep in fifteen slices, an adversarial verification of every record, a check of the IEEE 7012 claims against the standard's own text, and a fact-check of the site's authored prose. --- ## Where the project stands The site runs end to end. Every section renders from the cited data layer in both themes and at phone width, with no console errors and no horizontal scroll; the validator reports no errors, and the share card and metadata are current. The remaining work is evidentiary: the gaps are listed in `ARCHIVAL_RESEARCH_PROMPT_PRIVACY.md`. To publish: **Settings → Pages → Deploy from a branch → `main`, `/ (root)`**. The site will then be at . | Layer | Status | Notes | |---|---|---| | Research pass | **done** | 15 slices in `research/`: early, let alone, data protection, internet, surveillance, numbers, MyTerms, agents, concepts, global, three personas slices, essay, media. 949 records, each with source objects carrying the supporting quote | | Verification | **done** | 128 verdict files in `research/verify/`. Every displayed record was re-fetched and challenged: 372 OK, 563 corrected, 11 downgraded, 1 dropped (kept with its reasons). The only unchecked records are two MyTerms milestones the page does not show | | IEEE 7012 against its text | **done** | The standard's full text (free through the IEEE GET Program) was read and every claim the site makes about it checked clause by clause; see below | | Prose fact-check | **done** | Four agents checked every authored headline, chip, essay sentence, figure label, chart description and static paragraph against its sources; 53 fixes applied | | Data build | **done** | `tools/build-data.mjs` + `tools/editorial.mjs` → `js/data.js`. One source object per document; Wikipedia never shown as a source; images whose licence was not confirmed at source are left out | | Essay | **done** | "A Short History of an Idea": every sentence numbered to its notes | | Narrative map | **done** | 242 mapped events, 45 scrollytelling steps from c. 400 BCE to 2026 | | Spread chart & scrubber | **done** | Compressed time axis shared by the chart and the slider | | Data protection & world | **done** | Greenleaf's count, FIPPs side by side, 93 first laws on a map, 15 cross-border instruments, 6 policy models | | Consent & surveillance | **done** | Figure cards and charts, each cited | | People | **done** | 48 people in three groups (cryptographers & code, hackers & advocates, researchers & identity), each quoting their own words | | Machine-readable privacy | **done** | 14 mechanisms from the HEW code to IEEE 7012: who proffers, legal force, who keeps the record, fate | | IEEE 7012 / agents | **done** | The standard, its principles, the five launch agreements, the case in the age of agents, an illustrative errand, counterpoints, 18 jurisdictions | | Myths | **done** | 32 popular claims that did not survive checking | | Picture archive | **done** | 85 images (40 CC BY, 24 CC BY-SA, 16 public domain, 5 CC0); every licence read on its record page and quoted in `rightsEvidence` | | Share card & metadata | **done** | `tools/og-card.html` → `assets/og-image.png`; `tools/check-meta.mjs` passes | ## Citation status Counted by `node tools/validate-data.mjs` (and live in the page's source audit): | Verification status | Source objects | |---|---| | CONFIRMED | 1,642 | | PENDING | 36 | | DERIVED | 0 | Source objects are merged per document within a record: two clauses of one standard, or two sentences of one paper, count once, with each part named. Most PENDING sources are Internet Archive snapshots that could not be re-fetched during verification (web.archive.org reset every connection); in nearly every case the same record also cites a CONFIRMED copy of the text. ## IEEE 7012-2025, checked against the standard The first pass read only the IEEE abstract and the MyTerms, Customer Commons and ProjectVRM pages. The full text was then read and the site corrected: - **No fixed number of agreements.** The normative clauses name no agreement and set no number (cl. 4.1: "as few agreements as possible"). Informative Annex A lists 13 sample agreements; five is MyTerms' launch roster. The hero figure now says so. - **Acceptance is conditional.** The organisation's agent may accept, reject, or answer once with one alternative from the same roster (cl. 5.3.1); a refusal must be recorded (cl. 5.2.4). The page no longer says the site "agrees". - **The record is specified.** Its minimum contents (terms, date, time stamp, identifiers, a unique contract ID) and identical, immutable copies on both sides are normative (cl. 5.2.4, 5.4.4); only the format, storage medium and protocol are open, and interoperability "is not a requirement of this standard" (cl. 5.5). - **The person proffers; they do not write.** Terms come from a roster kept by a neutral non-business entity (cl. 4.2), which the normative text does not name; Customer Commons appears only in informative text. - **SD-BASE.** The MyTerms FAQ's gloss (the site "may observe you while you are there") is looser than the standard's own sample, which rules out analytics, tracking and profiling by the site itself (Annex A). ## Corrections the verification made to the popular story - McDonald and Cranor's "201 hours" is in their conclusion; their own Table 7 gives 244 hours a year, and the $781 billion total is computed from 244. - Warren and Brandeis did not coin the phrase "to be let alone": they credited it to Judge Thomas Cooley's treatise on torts, first published in 1879. - Microsoft's 2012 P3P disclosure named only Google; Facebook's bypass was made public by Nik Cubrilovic the next day. - The Malabo Convention's fifteenth party was Angola, not Benin (a signatory only). - The first non-European state to ratify Convention 108+ was Mauritius (2020), not Uruguay. - Only four privacy commissioners' conferences were held outside Europe before 1999, not five. - The Wall Street Journal's "What They Know" series was a Pulitzer finalist in 2012, not 2011. - Sephora's $1.2 million CCPA settlement covered three allegations, not only ignoring Global Privacy Control. - The New York Times reported that Clearview *claimed* to have scraped more than three billion images; Twitter was not among the sites it named. - The CCC's 1984 Btx demonstration moved DM 134,694.70 by the Bundespost's own statement, and nothing was stolen. - The Council presidency's Digital Omnibus text of 18 June 2026 dropped the proposed GDPR Article 88b on machine-readable privacy signals. ## Link audit (2026-09-23) `tools/check-links.mjs` over `js/data.js`. The first run: 1,190 URLs, 1,018 answer, 98 rate-limited or bot-gated (Council of Europe, EUR-Lex, Légifrance, the New York Times, SSRN, the Library of Congress, Flickr and similar; they resolve in a browser). The one genuinely dead link, NSF's deleted Flickr page for the Cranor portrait, was retired; the Commons record and its licence review remain. The site's own URL answers 404 until GitHub Pages is enabled. ## Next 1. Work through the research brief: Tier 1 first (the MyTerms launch agreements' full texts, the first-laws table beyond DLA Piper, Greenleaf's year-by-year count, US breach figures). 2. Re-fetch the PENDING Internet Archive snapshots, or drop those that sit beside a CONFIRMED copy. 3. Images still wanted: Lou Montulli, the MyTerms launch, the 1950 ECHR signing.