Learn · The big picture
The Personal Data Ecosystem
Where We’ve Been. Where We Are. Where We’re Going.
The personal data ecosystem is evolving from systems largely organized around institutional control toward the possibility of more balanced relationships, in which people exercise meaningful agency over their identities, information, knowledge and digital interactions. Here is how we got here, where we are, and where we could go.
Before you start
A map of this page
This page tells one story in three stages, then adds two ideas that tie it together. Skim it in about five minutes by reading each part’s key takeaway, read it all in about ten, or jump to the part you need.
- 1Stage 1 · Up to 2000The organization-centric approachData treated as a tool of social engineering and an enterprise asset.
- 2Stage 2 · 2000 to 2025An ecosystem in transitionThe emergence of human agency.
- 3Stage 3 · 2025 onwardThe rise of empowerment techHumans and AI with a seat at the table, and a choice of path.
- 4Human agencyThe Relational Nexus™: what agency means, and why it is the goal.
- 5In practicePraxamark™: one tool built for this, what it does today and what is planned.
How to read the diagrams
Stages 1 to 3 use the same diagram, drawn three times, with the same parts in the same places. Watch what changes.
- Organizations companies, platforms and public bodies
- People you, and the tools you hold
- Arrows what flows between them; thicker is stronger, dashed is weak, ⇄ is two-way
- Protocols the shared standards that let the parts work together
- Established Emerging Experimental Aspirational how far along each piece is
Key terms
- Personal data ecosystem
- Everyone and everything involved in how information about people is created, held, shared and used.
- Organization-centric
- Organizations issue the accounts, keep the data and make the decisions.
- People-centric
- People hold their own identifiers, data and knowledge, and take part on their own terms. Not anti-organization.
- Human agency
- Your ability to act, on your own judgment, in your own interest and in your relationships.
- The Relational Nexus™
- The web of relationships every decision sits in, now including AI agents and twins.
- The Identity Nexus™
- The balance point where each party’s value is in proportion to its risk.
Stage 1 · Up to 2000 · What Was
The organization-centric approach
Data treated as a tool of social engineering and an enterprise asset.
The web, then mobile phones, then social platforms made it possible to connect almost anyone to almost anything. To pay for it, much of the industry turned to advertising, and advertising turned to data: what people searched, bought, read, watched, where they went and who they knew.
Organizations built the infrastructure that carried that information, wrote the terms that governed it and kept the records. Accounts were issued by the organization; the data lived in its systems; decisions about it were made on the person’s behalf. Shoshana Zuboff named the economic logic that grew from this surveillance capitalism: claiming human experience as raw material for predicting, and shaping, behaviour (Zuboff, 2015, 2019).
These systems also created enormous value: free services, connection across distance, convenience, personalization, and much of the innovation of the last 30 years.
Stage 1 · Up to 2000 · The organization-centric approach
Organizations, at the centre
- Issue the accounts
- Collect and keep the data
- Write the terms
- Make the decisions
Data: searches, clicks, location, purchases, contacts
Free services, ads
One way, mostly
People
You
An account at each organization, and terms to accept. Little that is your own.
Between organizations: data brokers, ad networks and trackers, buying, selling and combining profiles.
Key takeaway: organizations built, and largely controlled, the infrastructure and relationships through which personal information flowed.
Go deeper: how it works, and the argument
The machinery. Tracking codes and cookies follow people across sites; profiles are built from what they do; data brokers combine those profiles with records from many other sources and sell them on. The U.S. Federal Trade Commission opened a study of the data broker industry in 2012 (see the References).
The argument. Zuboff (2015) first set out surveillance capitalism in an academic article, then in a book (2019). Her account is influential and contested: critics question how well behaviour can really be predicted and shaped, and how new the logic is. Here it names one powerful economic logic within the ecosystem, not the whole of it.
The ideas that pushed back are as old as the problem: the glossary traces them from 1890, and the ecosystem map shows who tried to build alternatives.
Stage 2 · 2000 to 2025 · What Is
An ecosystem in transition
The emergence of human agency.
That logic hasn’t gone away. Platforms, data brokers, advertising technology, tracking and profiling are still central to the digital economy, and AI adds a new appetite for data, and new ways to use it.
At the same time, another way of working has grown up beside it: the people-centric approach. It isn’t one product or one idea. It is many, at very different stages:
| Approach | What it does | Where it stands |
|---|---|---|
| Personal data stores and PIMS | Keep your information where you control it | Emerging products exist; most early ones have closed |
| Self-sovereign identity (Allen, 2016), identifiers and credentials | Identifiers and proofs you hold and present | Established standards W3C DIDs (W3C, 2022) and Verifiable Credentials (W3C, 2025) |
| Digital wallets | Carry credentials, from boarding passes to driving licences | In use mobile ID is arriving |
| Data portability and interoperability | Take your data with you; let systems work together | In law GDPR Article 20; uneven in practice |
| Terms, consent and authorization | You set the terms; both sides keep a record | Established standard IEEE 7012-2025; adoption is early |
| Privacy-enhancing technologies | Prove or compute without revealing, such as a zero-knowledge proof | Mixed some established, some experimental |
| Personal knowledge management | Keep your knowledge in formats you own | Mature tools changing fast with AI |
| Personal AI agents and twins | Act for you, with context you choose | Experimental standards are only now emerging |
| Regulation and governance | Rights, duties and the shape of data sharing | Growing GDPR (European Parliament & Council of the European Union, 2016); OECD Recommendation (OECD, 2021) |
Established a published standard, law or tool in wide use · Emerging specified or built, not yet widespread · Experimental drafts and early builds · Aspirational an idea not yet built. Each protocol’s status was checked on 8 November 2026: see Protocols and standards.
Stage 2 · 2000 to 2025 · An ecosystem in transition
Organizations
Private
Companies, shops, platforms, banks, employers, AI providers
Public
Governments, agencies, schools, health services
The traditional exchange, still dominant
Data: searches, clicks, location, purchases, contacts
Free services, ads
The new exchange, emerging
Consent and your own terms
Services, credentials and receipts
They meet here: value exchange
People
You, with tools of your own
- A personal data store Emergingwhere your data lives under your control
- A wallet In useyour identifiers and credentials
- Your AI agents Experimentalwith context you choose to share
- Your knowledge Maturein formats you own
Still between organizations: data brokers, ad networks and trackers.
The two approaches now run side by side, like the dark Rio Negro and the sediment-rich Rio Solimões near Manaus, in Brazil: in the same channel for kilometres, distinct, influencing each other, not yet mixed.
| Organization-centric | People-centric | |
|---|---|---|
| Identity | Accounts the organization issues: who you are is what it says | Identifiers and credentials you hold and present, on your own terms |
| Data | Collected, stored and used by the organization | Held, shared, restricted and revoked by the person; organizations are guests |
| Knowledge | Kept in the organization’s systems and vendors’ clouds | Kept in formats the person controls, so any tool or AI can use it and none can lock it in |
| Agency | Exercised on the person’s behalf | Exercised by the person, increasingly through their own AI agents and twins |
Key takeaway: organization-centric systems remain dominant, but people-centric alternatives are increasingly viable. The transition is neither complete nor inevitable.
Go deeper: the original sketch, the river, and who has tried
Who has tried. The ecosystem map lists 105 organizations and initiatives since the 1990s: 49 are active today, 35 have shut down, 7 were acquired and 14 we can’t confirm. Many people-centric ventures failed for want of a business model, or of organizations willing to meet them halfway.
The standards behind each approach, with their status, are on Protocols and standards.
Stage 3 · 2025 onward · What Comes Next
The rise of empowerment tech
Humans and AI with a seat at the table.
Picture an ecosystem in which you can see who holds what about you, set your own terms, prove what you need to without revealing more, take your information and knowledge with you, and let an AI agent act for you only within limits you set, and withdraw them.
That doesn’t mean organizations disappear, or that you must keep all your data yourself. Much of it will stay with the organizations that use it. What changes is the relationship: your authority reaches across the systems that hold your information, through standards that let your identifiers, credentials, terms and agents work everywhere. Bodies such as the W3C and IEEE are writing those standards, and MyData Global’s Declaration 2.0 (MyData Global, 2026) sets out the aim: a world where people have ability, agency, safety and protection, and understanding and control.
Stage 3 · 2025 onward · The rise of empowerment tech
Organizations
- Hold what they need, under terms you can see
- Ask, and record the answer
- Send receipts and credentials back
- Earn trust, and keep creating value
- Many keep their old methods too, in parallel, for some time
The traditional exchange, still running
Data: collected, kept and used
Services, ads and offers
The new exchange, alongside it
Agreements: terms, consent, credentials, receipts
Your AI agents, within limits you set
Both run in parallel for some time, moving toward balance.
People
Your authority
GrantLimitRevokeDelegate
Your data stays where it is useful: with the organizations that use it, in a pod, or in your own vault. What moves is your say over it.
The traditional approach still exists, and will. We are where the two rivers meet. The work now is to find the equilibrium in which organization-centric and people-centric approaches co-exist. The aim isn’t to remove organizations or commercial value. It is relationships that are more transparent, accountable, voluntary and good for both sides. The Identity Nexus™ is a test of that: individuals, private organizations and public organizations each want value, insight, efficiency and effectiveness, and safety and security. Is each party’s value in proportion to the risk it carries, and does the exchange add to the commons rather than draw it down?
The Identity Nexus™ in full, with its equation, at identitypraxis.com.
We are at a crossroads
Which path will you choose?
- Further the organization-centric approachToward a dystopia, where Orwell was an optimist (Orwell, 1949).
- Lean only to the people-centric approachToward a utopia that won’t scale.
- Take the middle pathThe two come together, and we strive for The Identity Nexus™.
Key takeaway: people should have meaningful agency, organizations should earn trust, and value should flow through relationships that benefit both.
Go deeper: the standards, and the case for sharing well
Established: W3C Decentralized Identifiers (DIDs) v1.0 (W3C, 2022) and Verifiable Credentials Data Model v2.0 (W3C, 2025); IEEE 7012-2025 (IEEE, 2025), machine-readable personal privacy terms. Emerging: did:webvh, Solid, Portable Web Spaces, the Model Context Protocol and Agent2Agent. Experimental: the Human Context Protocol, at draft 3. Each is on Protocols and standards, with its maintainer and status.
Sharing, with rights protected. The OECD’s 2021 Recommendation on enhancing access to and sharing of data (OECD, 2021) sets out principles for getting the benefits of data while protecting the rights of people and organizations: the people-centric approach is about how data is shared, not whether.
4 · The Relational Nexus™
Human agency at the center
Every piece of information, product and decision sits in a web of relationships: with people, organizations, technology, regulation, society and culture, and now with non-human intelligences, the AI agents and twins that act for us and for others. We call that web the Relational Nexus™. The Identity Nexus is one part of it: the part concerned with the value and the risk of sharing information.
At its centre is human agency: your ability to act, on your own judgment, in your own interest and in your relationships.
The Relational Nexus™PeopleOrganizationsTechnologyAI agents and twinsRegulationSociety and culture
Human agency: you can
- Understand your environment and your choices
- Make informed decisions
- Manage your identity and information
- Create, organize and apply knowledge
- Build and keep relationships
- Grant, delegate, limit and revoke authority
- Take part in exchanges, and gain value
- Act yourself, or through AI agents you authorize
Human agency in the Relational Nexus™. Identity Praxis, Inc. © 2026.
Agency is not the same as…
| What it means | How it relates to agency | |
|---|---|---|
| Control | Directing what happens to something | A means to agency. You can control data and still have no real choice. |
| Privacy | Appropriate flows of information about you | A condition for agency. Agency includes choosing to share. |
| Ownership | A property claim over something | Often unclear for data. Agency doesn’t depend on it. |
| Sovereignty | Ultimate authority over yourself | The principle. Agency is its exercise, day to day. |
Agency doesn’t come automatically with new technology. A wallet you don’t understand, or an agent you can’t limit, gives you none. It has to be a design objective, for every system and every relationship.
Key takeaway: human agency is the point. Technology, standards and law are how we get there, if we design for it.
Go deeper: the frameworks
The Relational Nexus™, and its four areas of focus in Relational Technology Architecture™: AI; personal and organizational knowledge management; self-sovereign identity and data principles; and engagement. The Agency Line asks where AI does your work, and where you keep your agency and critical thinking.
5 · In practice
Praxamark: putting people-centric principles into practice
Praxamark™ is one practical tool for this transition, made by Identity Praxis, Inc. on standards others created, from the W3C, IEEE, Customer Commons and more. It helps you keep, understand and act on your own information, knowledge, identity and digital relationships. Own your knowledge. Rent the rest.™
| Built | Planned |
|---|---|
| Mark and cite what you read, watch and listen to: Praxamark creates the citation, which you can edit, and keeps whose words are whose | More signatures: a work one, a pen name |
| Your Praxamark Data Vault on your computer, sealed under your own key from the start | Verified Human and Identity Verified |
| My Digital Exhaust: what you gave each site, the terms you agreed, dated copies of policies | Sync across your Apple devices |
| MyTerms (IEEE 7012-2025, beta): offer your own terms; both sides keep a record | Storage in a hosted web space |
| Signed receipts from organizations, checked and kept | |
| Signing what you publish, under a hosted identity or your own domain | |
| The Human Context Protocol (draft 3, experimental): context you choose to give AI agents |
It’s in development and coming soon as a browser extension (Chrome first, then Chromium browsers, Firefox and Safari) and as apps for macOS, iOS, Windows and Android.
Explore
Go deeper
The rest of Learn turns this story into things you can use: a practice article, the glossary, the ecosystem map and the standards. See what each one is for.
Sources cited here are on References.
Help build the map
Missing something?
This is a living map of the personal data ecosystem. Suggest a term or an example, or correct one, with a source if you have it, and we’ll add it with credit if you’d like.