IEEE 7012 Machine-Readable Personal Privacy Terms
/.well-known/myterms
Today, every website and app presents you with a "terms of service" that you must accept to use the service. You have no say in those terms. You click "I agree" because the alternative is "go away".
MyTerms inverts this. Instead of the service dictating terms to you, you proffer terms to the service — through your personal AI agent (Bob). The service can accept or decline your terms, just as you currently accept or decline theirs.
This is made possible by IEEE 7012-2025, the first standard for machine-readable personal privacy terms. Published in January 2026, it defines a protocol by which individuals and organisations can exchange, negotiate, and enforce data-sharing agreements — automatically.
The IEEE 7012 flow has four stages:
See Jon Udell's interactive demonstration of the IEEE 7012 workflow for a visual walkthrough.
IEEE 7012 defines five standard agreement types. Bob supports all five:
Standard Data — Baseline. The minimum terms for basic service delivery. The service may collect only what is strictly necessary to provide the service you requested. No tracking, no profiling, no secondary use.
Standard Data with Data Protection. Extends SD-BASE with explicit data protection commitments — encryption-at-rest, breach notification within 72 hours, right to deletion, and geographic data residency constraints.
Personal Data Commitment — AI. Prohibits the use of your data for AI model training. Your conversations, documents, and preferences must not be used to improve or train any machine learning model. Bob proffers this to AI providers by default.
Personal Data Commitment — Goods & Services. Your data may be used only to deliver the specific goods or services you purchased. No cross-selling, no partner sharing, no advertising based on purchase history.
Personal Data Commitment — Intent. Replaces cookies and tracking with declared intent. Instead of a service inferring what you want from your behaviour, you tell them. "I'm looking for a mortgage under 4.5%" is more useful to the service and less invasive for you.
Bob's MyTerms implementation has four layers:
/.well-known/myterms to learn what terms Bob supportsAll endpoints require authentication (API key or session token) unless noted.
| Method | Endpoint | Description |
|---|---|---|
GET | /.well-known/myterms | Public discovery — what terms this agent supports |
GET | /myterms/types | List all supported IEEE 7012 agreement types |
POST | /myterms/agreements | Create (proffer or record) a new agreement |
GET | /myterms/agreements | List agreements (filter by status, counterparty, type) |
GET | /myterms/agreements/{id} | Get a single agreement by ID |
POST | /myterms/agreements/{id}/accept | Accept a received agreement |
POST | /myterms/agreements/{id}/decline | Decline a received agreement |
POST | /myterms/agreements/{id}/revoke | Revoke an active agreement |
GET | /myterms/preferences | List all term-proffering preferences |
POST | /myterms/preferences | Set or update a preference for a context |
The current model of privacy is broken. You "consent" to terms you haven't read, written by lawyers whose job is to maximise data extraction. GDPR gave you rights, but enforcement is slow and the power imbalance remains.
IEEE 7012 changes the game because: