[cimm]

I like the idea, but I wonder how this works in practice. If I grant ACME Inc. access to my “profile picture,” for example, won't they just copy the file and store it on their own servers (be it for performance reasons, tracking, ease of development, whatever)? How does this keep me in control?

[armchairhacker]

I don’t see how you can prevent others from collecting your data without laws and enforcement, which seem to be hard to pass and maintain (see: GDPR and right to be forgotten. Sometimes they work, but sometimes they don’t, and they have their own issues).

The technology is already here for people to collect and publish their own data. Most people in the US can purchase their own VPS, host their own website, use federated media and self-hosted services. Lots of sites and institutions let you request your data, though sometimes the process is obscure, and you can scrape any data about you that is visible to you. The main obstacle here is that it seems the vast majority of people aren’t interested, I wouldn’t expect a layman to even know what “self-hosted” means.

[tekchip]

It only works when the majority of good actors adopt it as a standard. Effectively an agreement to abide by it. Or, as the article notes, it's enforced as a part of policy. In Europe it's being pitched as a method to help assure GDPR compliance. Of course that likely falls apart if what would be good actors don't agree to utilize or adhere to the standard. It probably needs to be picked up as a W3C standard or something to see broad use.