We started at DTI with a two-fold mandate: build out and grow the Data Transfer Project, and work with policymakers and industry to help portability policy work in practice. To take the latter first, our policy research and engagement efforts are shaping the implementation of regulations to support an interoperable global data portability ecosystem that brings in all stakeholders and works without friction or duplication across borders. Emerging alignment between key UK and EU requirements are early signals of this vision in practice. You can read more on our new policy website page!

Our technology efforts have a similarly clear impact. Since we’ve been stewarding DTP, it has acquired several new contributors and several big wins. It’s now fully in the public domain with clearer contribution paths. DTP includes music playlist portability which was a huge data and semantic undertaking with many wrinkles to iron out. And finally, it now has a public API interface for even broader interoperability: small companies can now interoperate with DTP server instances without needing to run it. It’s more valuable than ever to join DTP and reduce network interoperability barriers.

And our portfolio has grown far beyond DTP: we’ve built a toolkit for data donations to research and a schema repository, and begun digging into portability of personal data in artificial intelligence. The biggest dimension of growth is our work on trust, notably our Data Trust Registry, entirely conceived, built and piloted in the last two years. DTR reduces unnecessary and onerous trust barriers by centering an ecosystem of shared trust criteria and verification processes. More organizations apply to join every week, connecting companies large and small to each other to unlock the trusted execution of user-initiated personal data transfers. Some use this access to deliver value for their users in customized digital experiences; others, like registry participants Supermarketer and Helmit, use it to protect people online.

There’s a running internet meme about how the real treasure is the friends we made along the way. That’s why all of the projects we’ve built or written have been intertwined with our network. Both DTP and DTR have brought us into regular contact with real companies solving real problems — and we help them share wins with each other, too. We work with other nonprofits, associations, academics, and businesses large and small. But the core of our community is DTI’s partners and affiliates. They are the most plugged into our policy and technology vision, and the biggest contributors to and champions of our impact.

What comes next for DTI? Continued success in our work means more tools, more trust, and smoother portability processes for the data ecosystem – and for individual people, more choice, more confidence, and more freedom. Our outputs, such as the Data Trust Registry, will be the foundation of many bridges – between companies large and small, between companies and agents, between agents and users, between companies and regulators. In particular, as I’ve written in other places, our work on data trust and transfers will shape key contours of the future of the AI landscape. We are at a key turning point on this, today.

The data portability party is heating up. And everyone is invited. The value proposition for user-initiated personal data transfers is more apparent and more diversified than ever before. While consumers become increasingly curious and assertive about who collects their data and how, AI agents emerge to remind us once again that access to personal data is the evergreen killer feature. Only data portability can prevent these two trends from coming into conflict. The technology infrastructure is changing constantly, as are policies and practices.

It won’t be this dynamic forever, though, and as normative and practical lines start to solidify, it’s crucial to be at the table and not left behind. DTI is now established as the table that matters when it comes to personal data. And yet, considering the value of personal data in artificial intelligence, and the significance of AI and data in evolving regulatory landscapes, I feel like DTI’s work is just beginning. Reach out if data is as central to your agenda as it is ours.

One theory for the value of blockchains and cryptocurrency technology was that they would eliminate the need for trust infrastructure, embedding trust in code rather than policy or promise; that didn’t work in practice. While immutable distributed ledgers have their time and place, there is no technosolution for trust problems of the form facing the agentic AI ecosystem today. Open source is similar, in that it can help contribute to trust by providing visibility into data policies and practices, but it is certainly no panacea here. Similarly, there’s value and security in creating sandbox environments where it is safe to run untrusted tech; but that doesn’t fit the many use cases where the value inherently requires connecting to the open internet and personal data.

So, what do we need? I’ll start with an assumption: trust is simultaneously both technical and sociopolitical. The technical side requires discovery, authorization, identity, and policy validation; the sociopolitical side first needs the entities performing the technical pieces to themselves be trusted, because “show your work” only goes so far when the stakes are so high; and second, needs tech that is scoped and applied correctly for the problem and context at hand.

Who’s tackling the technical pieces of trust? Here are some of the efforts we’re tracking, particularly in the identity and authorization direction where there is the most visible energy:

• The AAuth protocol allows an agent provider to self-publish per-agent per-instance cryptographic identity over HTTPS.
• Aria.bar, a nonprofit, operates a DNS-anchored agent identity registry.
• Agentic Resource Discovery, led by Google, claims to be “DNS and search engine for the agentic web”.
• Blockchain-based projects such as AgentDID and ERC-8004, like AAuth, offer decentralized self-certification options.
• In Estonia, the government allows agents to get official digital identities.
• The Agent Name Service recently announced by the Linux Foundation carries a big brand name.

Overall, the picture is complicated. In some cases, addressing and discovery issues are mixed up with identity; agents and services and users and providers can be conflated; and it’s often unclear who or what really needs identifying, who or what needs to be trusted (and by whom or what), and for what purpose. The umbrella label of “trust” often doesn’t keep the rain out, but rather just … leaks all the water through and spreads it around.

To make matters more complex, the critical target for establishing trust typically isn’t the agent, but rather the legal entity sitting behind it. Our use case for trust is personal data. If an agent is touching personal data, there is–hopefully!–a policy somewhere, adopted and enforced by an entity, that governs how it is using the data. At the very least, there is a person or company legally responsible for the compute that agent runs and the storage it lives on and uses. Find (and identify) the agent, find the entity, then find the policies and practices. Those can be reviewed to establish trust, and monitored for compliance to create accountability.

Looked at from this lens, the trust problem in data portability and the trust problem in agentic AI, at least with regard to the use of personal data, collapse to the same pair of factors: 1) make sure the user has authorized this action with the right level of insight; and 2) make sure the policies and practices that govern how personal data is handled are adequate. As I wrote in Tech Policy Press:

What, really, is different in the agentic AI context in terms of trust and the flow of personal data? Speed and reduced friction of development, deployment, and adoption is a clear change. But the abstract architectures and responsibilities are the same. Someone, person or entity, produces and ships a piece of software; that software communicates over the internet to a source of personal data; and a user authorizes the source of that data to make it available to the software, which uses it in some manner, including potentially passing it along to other software.

At DTI, we built the Data Trust Registry to help establish trust in data portability. When services apply to the registry, depending on the level of trust they are seeking, we verify the service provider’s identity, examine their privacy policy and security credentials, and review how they are communicating with users about their use of personal data. The resulting trust accreditation signals are reflected on the registry website, available for service providers to embed as a badge, and provided through the registry’s API for integration into other services’ verification processes. While built for our core use case of data portability, given the convergence of trust challenges between classic portability and agentic AI, we believe DTR has the potential to be a very effective starting point for the infrastructure and system necessary to promote trust in the agentic AI ecosystem.

Our mission statement at DTI is: “Empower people by building a vibrant ecosystem for simple and secure data transfers.” Agentic AI is full of data transfers, and they can seem simple, but helping them be secure requires trust. We build data transfer tools and infrastructure, but as with anything adjacent to technical standards, the impact isn’t maximized by shipping perfect technology, but rather by bringing a community together around a shared solution. As one example of that, we recently joined the Open Forum on AI and are looking forward to working with them more.

Building community around trust infrastructure is central to the journey we’re on now, and we invite you to join us on it.

As well as being mammals with a decent leap, they are all recognised logos – or trust marks – for successful certification schemes. Today DTI has launched a trust mark of our own.

Each of these schemes solves an informational asymmetry problem between buyers and sellers. Where consumers see these logos on products, they gain confidence that they meet certain standards with respect to animal welfare, environmental protection, or safety. They enable producers to differentiate themselves on grounds of quality that are otherwise difficult for consumers to observe at the point of purchase.

There are many other accreditation and certification schemes covering a wide range of sectors, from farming, to jewelry, to forestry, to electronics. Although these schemes all solve important market failures, most are not the result of government intervention. In fact, the most successful schemes are typically run by the industry themselves, through a trade association or dedicated independent body.

Participation by market participants is also rarely mandated by government or regulation of any form. Whether it is a supplier of tuna, coffee, or toys, suppliers sign up to these schemes and display the badges voluntarily, because they want to send a positive signal to their customer base.

Businesses operating in the data transfer community have a similar informational problem. They need to be able to signal to their users, their clients, and the businesses at the other end of the transfer pipeline that they are a legitimate service that takes their data protection responsibilities seriously. In other words, that you can trust them to take care of your personal data. Just like a supermarket shopper can’t tell if dolphins were harmed in the making of a can of tuna, a user online can’t tell whether an app developer will protect their data from malicious actors, or in fact if they are one themselves.

We have gone part way to addressing this informational challenge through our Data Trust Registry, by verifying services against our transparent requirements, and then listing them publicly on the Registry.

But that only spreads the word when someone looks at our website. Service providers have told us they want a louder signal. They want a trust mark to demonstrate their credibility. And they want it from an independent and respected body.

In response to this feedback, we are today launching the DTI Badge of Accreditation, which we will issue to all services listed on the Data Trust Registry. Where approved services display it is up to them, so long as it links back to their individual listing on the Registry.

Get in touch if you would like to know more.

That’s where I believe DTI has an important role to play that arguably no other organisation is capable of. Our advice and global perspective can help shape the pieces so that they fit together and form a single vision, so that the ‘tabs’ from one intervention slot into the ‘blanks’ of another. Or in other words, we can help to promote international interoperability. To do that, we need to keep up to date with global developments.

This newsletter sets out some of the main regulatory developments for the technology sector most relevant for our audience, including highlighting the ones we are engaging with directly.

United Kingdom

I would of course list the UK first because I am biased. But in any case, it deserves headline billing this time around as authorities prepare to deploy the powers granted by two new Acts of Parliament: The Data (Use and Access) Act (aka “the DUAA”) and the Digital Markets, Competition and Consumers Act (aka “the DMCCA”).

• The DUAA gave the UK Government enabling powers to introduce Smart Data Schemes like Open Banking in other sectors of its choosing. The Department of Business and Trade has since published a Smart Data Strategy in March 2026, which lists digital markets as one of the priority sectors to be pursued. In parallel, following a call for evidence on the Smart Data opportunities in digital markets last summer (to which we responded), the Department for Science Innovation and Technology (DSIT) published in May 2026 a summary and decision on next steps. DSIT indicated that the Government will consult “shortly” on the overall design of a digital markets scheme.
• Through the DMCCA, Parliament handed the Competition and Markets Authority (CMA) strong new powers to regulate large digital services where they are judged by the CMA to have Strategic Market Status (SMS). The CMA has investigations open, at different stages of development, in relation to various parts of Google’s, Apple’s, and Microsoft’s businesses. Within its investigation into Google’s General Search and Search Advertising services, which is the furthest forward, the CMA has consulted on Conduct Requirements that would oblige Google to maintain availability for its Data Portability API in the UK, and effectively peg the UK to any further advancements in the API resulting from the EU’s implementation of the Digital Markets Act (DMA). The CMA hinted in a recent press release that this Conduct Requirement will come into force in the “coming weeks”.

Also, published this week, is a consultation from DSIT on empowering people through data intermediaries. This follows a call for evidence last year that DTI responded to. In addition to consideration of legislative options for removing barriers to data intermediaries, the consultation seeks views on a non-statutory authorisation scheme, with an industry run certification process. The consultation notes that “Authorised intermediaries could be listed on a public register or permitted to display a recognised trust mark, providing a visible signal to individuals and data controllers that they meet agreed standards.”

DTI is engaging extensively with each of these developments, where we are pressing the importance of our Data Trust Registry as a key component for achieving international interoperability of smart data schemes, while also acting as a signal of credibility for listed services, which includes many data intermediaries.

For any UK-based readers, I encourage you to attend the Smart Data Forum next week, where these developments will be a key topic, with DTI’s Data Trust Registry shortlisted for the Trust, Consent and Governance Award. Hopefully I will see some of you there!

European Union

Although the EU is further along this regulatory journey than the UK, the implementation of targeted data portability regulations is still relatively early. There have been several developments over the past year that have moved the regulatory dialogue forwards:

• The DMA one year review: in 2025, the European Commission ran a consultation as part of its one year review of the DMA. Here is our response. In its follow up Report, the Commission rightly sought to highlight the data portability provisions in the DMA as one of its success stories, where visible progress has been made and innovative new services are starting to reach consumers. Also noteworthy was the Commission’s signal in its Staff Working Document that it will be, as a matter of priority, “monitoring whether certain AI services should be designated as virtual assistants” and therefore brought within the scope of the DMA.
• Joint guidelines on the interplay between the DMA and the GDPR: in Q4 2025, the European Data Protection Board and the European Commission consulted on draft joint guidelines on the interplay between these two regulations. With respect to data portability, the document sought to clarify the complementary nature of DMA Article 6(9) and the GDPR Article 20, as well as setting out some more granular expectations regarding compliance with DMA Article 6(9), such as appropriate third-party onboarding procedures.
• The Data Act: this legislation came into application in September 2025, bringing in direct transfer data portability provisions for suppliers of Internet of Things connected devices and for cloud storage providers. Despite being new, it is already facing changes through the Digital Omnibus package. Aimed at simplifying and consolidating parts of the EU’s digital regulatory framework, the package contains some tweaks to regulations that could affect existing data portability rules at the margins. For example, targeted exemptions to the Data Act’s cloud switching requirements for smaller businesses, and removing the requirement (currently in the Data Governance Act) for mandatory reporting and labelling of data intermediation services. Some concerns have been raised over the Omnibus, including by researchers over potential limits to data donations.

DTI has been frequently engaged with the European Commission on all of these topics, including responding to the consultations. We are now watching closely to see whether the DMA will be the catalyst for portability of AI ‘virtual assistant’ conversation histories, and whether the Data Act encourages more IOT companies to participate proactively in the data portability community.

US State-level Legislation

In the United States, progress on data portability seems most likely to be steered by legislation at the State level. Utah and South Dakota have led the way, each enacting into law a “Digital Choice Act”, effective from July 2026 and July 2027 respectively. They require social media platforms to support direct data transfers to other services of all user data including the social graph. Several other States are following with similar Acts, including New York, Minnesota, South Carolina, Virginia, and California.

Although the legislative process still has some way to run, California’s version of the Digital Choice Act may turn out to be the most impactful. Aside from the mere fact it is California, which tends to suggest national application for tech regulation, it also includes new requirements for portability of AI contextual data such as conversation histories (as does Virginia’s). We view this as a high priority moving target, and while DTI as an organization does not engage in advocacy for or against legislation, we seek to contribute our expertise where it will help facilitate collective understanding, and are monitoring this closely.

South Korea

South Korea is one of the most advanced jurisdictions for empowering citizens to access and utilise their personal data, with its Personal Information Protection Commission (PIPC) announcing in April 2026 that citizens’ data portability rights would be extended to all major sectors of the economy.

Under the announced rollout timeline, individuals will be able to access their data directly from public institution websites starting in August 2026, with application to the private sector next year. As well as sectors for healthcare, telecommunications, and energy, South Korea’s MyData framework will also apply to various online platforms (above set quantitative thresholds) such as taxi-hailing services, e-commerce platforms, streaming platforms, and holiday lodging services.

Japan

On December 18, 2025, Japan’s long-awaited Mobile Software Competition Act (MSCA) – also known as the Smartphone Act – officially entered into force. Enforced by the Japan Fair Trade Commission (JFTC), this ex-ante regulatory framework is focused on supporting competition within and between Apple’s and Google’s mobile ecosystems.

With some similarities to aspects of the EU’s DMA, the MSCA establishes explicit data portability mandates. This has prompted an expansion in the geographic availability of some existing data portability tooling, such as Apple’s Account Data Transfer API, which now lists availability for users in the EU, UK and Japan.

We have recently held conversations with the JFTC to discuss these developments, as well as to share updates on our relevant projects such as our Data Trust Registry.

Australia

With some parallels to the UK, Australia has two routes that may eventually lead to data portability initiatives in the digital economy:

• Most immediately, there is the ongoing expansion of its Consumer Data Right (CDR) which, like the UK’s Smart Data programme, has its origins in the banking sector. It has subsequently rolled out to the energy sector, and is now expanding to non-bank lending services in July 2026. We spoke recently to the Australian Competition and Consumer Commission (ACCC) about its implementation of the CDR, highlighting some potential future overlap between our Data Trust Registry and the ACCC’s register of accredited data recipients.
• Australia is also expected to introduce legislation to establish a new ex ante digital markets competition regime, leading to codes of conduct for designated digital platforms. Described by some as a hybrid between the EU’s and UK’s approaches to digital markets regulation, the requirements may well include provisions for supporting data portability.

Given these developments, Australia appears to be a strong candidate for implementing data portability requirements for online platforms in the near future, though it is unclear at this stage whether it will adopt a sector wide approach via the CDR, or a more targeted approach through its planned ex ante digital competition regime.

Canada

Following many years of policy debate, Canada formally codified its Open Banking framework through Bill C-15, which received Royal Assent in March 2026. Critically, the Bill also amended Canada’s federal privacy law (PIPEDA) with the introduction of a new section on “Mobility of Personal Information”. This lays the foundations for Canadian authorities to introduce new data sharing frameworks in other sectors beyond banking.

Alongside these legislative developments, the Competition Bureau Canada published a comprehensive report in January 2026 entitled Your Data, Your Control, with extensive references to data portability in the digital economy. It was a pleasure to chat to the team behind the report in March this year about ongoing developments in Canada and how they connect with DTI’s mission.

India

I highlight India in this update for two significant non-developments on data portability.

First, the Digital Personal Data Protection Act (DPDPA) has been proceeding through a phased rollout, with full enforcement by May 2027. It is particularly noteworthy that the DPDPA, as India’s comprehensive data protection framework, does not include a GDPR-like right to data portability.

Second, India’s equivalent of the DMA - the Digital Competition Bill - has continued to stall, with focus shifting to further evidence gathering through a market study.

In contrast to some jurisdictions where data portability is a feature of privacy and competition legislation in parallel, India is not prioritising either regulatory route.

Brazil

Brazil has been progressing its Digital Markets Bill designed to tackle competition challenges in digital markets, as written about by Laís Martins and Megan Kirkwood for Tech Policy Press in February this year. In March, lawmakers approved an “urgency motion” enabling the Bill to skip some of the slower committee stages of review.

If passed, the Bill will give new powers to Brazil’s competition regulator, CADE, to designate platforms as an “economic agent with systemic relevance”, with a menu of interventions then available to it including imposing requirements for continuous and real-time data portability.

The Bill still has several legislative hurdles to clear, so we’ll keep a watching brief.

Chile

The new Data Protection Act In Chile, which brings in substantial alignment with the GDPR, will officially come into full effect in December 2026. Like the GDPR, the Act includes a right to data portability, which gives the data subject “the right to have their personal data transmitted directly from controller to controller where technically possible.” As has been the case in Europe, the final three words of that quote are likely to be impactful.

Get in touch if there are some developments in your part of the world that deserve to be on the next update.

A social account can be used to maintain friendships, collaborate professionally, pursue hobbies, share information, promote one’s preferred policies or politicians, and so much more. All of the posts and replies in a social account build a very personal history, holding years of images, messages, memories, relationships, and a sense of evolving identity and purpose.

Although the Fediverse offers choice of where to create an account (like email does) and still connect, every account must live on a server, and that server is not permanent. Often hosted by a friend or former colleague, one’s Fediverse server can be shut down in an orderly way, change policies, defederate from other servers, be defederated, or simply suddenly disappear. If these server changes prompt a user to move their account, they face the difficult reality that their posts, followers, and entire digital social life may not move with them.

For the Fediverse’s freedom from centralized control to continue to work in a constantly moving world, Fediverse account portability cannot be an afterthought; it must be a first-class, foundational capability. Users need a reliable, non-workaround solution to move their content, accounts, and relationships from one server to another.

Fortunately, this isn’t hard, at least technically. Since in the Fediverse servers request data from each other, most of the data requests to move an account to another server are already supported. This interoperability is defined mostly by ActivityPub, an open standard developed by the World Wide Web Consortium (W3C). ActivityPub acts as the shared language, defining common structures for users (actors), content publication (outboxes), notifications and messages (inboxes), and social actions like following and sharing.

The few missing pieces for safe and reliable server-to-server account transfer require a bit of agreement on specifics:

• How can the requesting server use OAuth to gain full access to private account information? What exactly is the OAuth URL and what data access scope can be requested?
• How is private information conveyed? What ActivityStream collections hold private information and what are their URLs?
• How are references across servers handled when the object referred to moves?

Answering these questions is why the LOLA Portability (Live, On-Line Account Portability ) draft specification was developed. LOLA defines a process where a destination server can request and copy account data directly from a source server, with the user’s authorization, while both systems remain online. The specification is being developed within the W3C’s Social Web Working Group.

LOLA organizes account portability into three structured phases:

1. Discovery and Authorization
   The destination server confirms the source server supports portability and what its URLs are. The user is redirected to the source server to authenticate and explicitly approve the data transfer using OAuth 2.0 and an appropriate scope that grants just the right permissions.

2. Fetching and Saving Data
   Once authorized, the destination server requests and recreates the user’s key collections, such as posts, following lists, liked content, and block lists. Crucially, this is designed as a copy, not a destructive move, allowing the user to verify the result before making further decisions.

3. Testing and Finalizing Phase
   After the copy is successful, the user can choose to notify followers of the move, redirect links to old content, and close down their old account, when they are ready.

The Data Transfer Initiative supports this work by contributing to the authoring of LOLA and of a testbed for LOLA implementers to test against. This supports our overall mission of improving the availability and functionality of data portability generally, by showcasing an architecture that works well even under the difficulties of federation, linked content, and private as well as public information. For a deeper dive, I have written the start of a series of articles on the testbed and the technical pieces of LOLA – check it out.

DTI’s 2023 Annual Report mentioned an early example of our work on researcher access: my service on the steering committee of a project run by AcademyHealth. The effort supported medical researchers using Internet activity data, received through data portability, to look for evidence that might facilitate early diagnosis. Data tells many stories, in different contexts and to different audiences.

We continued this work through conversations and collaborations over the subsequent months and years. And our 2025 Annual Report provided a brief window to this in a bullet point: “Building on extensive collaborations with medical and sociotechnical researchers in the US, UK, and Europe, we developed and shared a prototype toolkit to facilitate user data donations.” That toolkit lives now as an open-source repository, Pardner.

The landscape for data access for researchers is incredibly rich. Substantial work on tools and frameworks for the whole pipeline, from user participation and education to data collection and secure analysis setups, is happening in the United States and in Europe, across university research environments and nonprofit organizations. Focusing specifically on the data transfer piece, our wheelhouse at DTI, methodologies range from user download and upload pathways – guided by researcher platforms – to specific-purpose applications and browser extensions. Regulation is adding to this conversation as well, particularly in Europe, where Article 40 of the Digital Services Act requires the creation of researcher-specific data access tools, under certain circumstances.

Technology and infrastructure development isn’t useful without effective deployment. So as we were building the Pardner toolkit, I found myself in conversations with a few key organizations in this space, and together we set out to host two workshops focused on researcher data access technologies: one in London in March, with the Open Data Institute, and last week’s in Princeton, with the Accelerator.

To these conversations, DTI brought two things: first, our Pardner toolkit and other DTI infrastructure including the Data Trust Registry; and second, humility and an open mind, recognizing that we bring a specific perspective to these issues, and we do not want to determine that everything we see is a nail just because we hold in our hands a hammer.

The context for data portability and researcher access is changing, as well, for the same reason as so many other technology changes right now: artificial intelligence is uprooting assumptions, overcoming prior limitations, and introducing new areas of concern and question. Here, AI provides new opportunities to build easier access, transfer, and translation tools – and new ways to understand data and learn more from it, including for research purposes. AI also represents a shift in the way people use technology, and the way technology impacts society, both significant questions for social and political scientists. Even for medical contexts, many people who once asked a search engine first about their symptoms will now instead check with their AI chatbot of choice.

The need for data portability – including tools, trust, and infrastructure – is much richer today than is widely known. Its original use cases are still fully present and critical: helping people have a copy of their data, and helping them use their data in different services, whether for switching or multihoming. As new needs for data transfers arise, we at DTI are always thinking about how to fulfill our mission in the expanding horizon. Expect more on the researcher access side after we and our collaborators fully digest and report out on the workshops.

Portability isn’t something that normal users care about for its own sake, as much as what it can help them do. And DTR participants are helping their users accomplish a diverse range of things. DTI Affiliates Fabric and Koodos, among our very first participants, are building tools to help people manage their digital contexts and put AI to use in new and creative ways, tailored for them. MyLize is building new ways for us to connect with our friends online. Supermarketer is fighting fraud and abuse, and protecting real people in a range of online spaces. Helmit works to keep children safe.

And DTI’s partners are helping to make this all a reality. Meta, one of our founding members, directly applies DTR signals to unlock access to its portability APIs. Matt King, Global Product Management Lead for Access and Portability at Meta, says:

The DTI Trust Registry pilot demonstrates how data portability works best when the ecosystem works together. The pilot program tested a unified approach to onboarding developers for access to multiple platforms - streamlining compliance reviews and ensuring consistent privacy and security standards, while allowing developers to focus on building great products. We support the kind of interoperable ecosystem that maintains high standards for protecting people’s data and makes data portability practical at scale.

DTI began this effort because, in our ongoing work to develop and deploy data transfer tools, we learned that the barriers aren’t always technical. Businesses seeking to help their users access and use personal data face a bevy of disparate review processes, repeatedly answering many of the same questions (and some frustratingly different ones!), often without any support or guidance. Platforms, meanwhile, build bespoke mechanisms to respect and empower the user’s decision to exercise their fundamental rights, while also seeking to protect them and ensure that the basis of information motivating their action is legitimate. The result of this redundancy of slightly inconsistent efforts is frustration, wasted resource expenditure, and, ultimately, fewer users empowered to move their data and fewer developers able to help them find new value in it.

The Data Trust Registry aligns closely with DTI’s Data Transfer Project – our suite of secure and simple end-to-end transfer tools – and our ongoing work as an expert resource on data portability, offered to industry and to policymakers alike. DTR thus directly facilitates DTI’s institutional mission: “Empower people by building a vibrant ecosystem for simple and secure data transfers.”

Jessie “Chuy” Chavez, Technical Lead - Privacy, Safety, and Security at Google, says:

At Google, we’ve been supporting both the Data Transfer Initiative and the Data Transfer Project from the very beginning, and we are working with DTI to help shape the Trust Registry to be a long-term component of the data portability ecosystem. We’re excited to see the Registry progress beyond pilot stage, and are eager to continue collaborating with DTI on trust and data portability going forward.

Now that DTR is out of pilot, the DTI team will develop and execute next steps. The registry is in full availability, and we encourage all businesses working with personal data to apply. You can find more information on the DTR website.

In the weeks to come, we will continue to bring onboard new platforms, large and small, who allow users to transfer data to third parties and who will benefit from incorporating DTR trust signals into their processes. And we will take feedback from all stakeholders on our policies, processes, and mechanisms, and look to refine where we can improve the experience and effectiveness of the registry.

Thank you to all of the organizations who have partnered with us thus far on this journey.

Although not perfect, browser data portability is a compelling case study for busting all of these myths.

Browsers are digital wallets

Browser users – basically everyone – are not a homogenous group.

For many users, the choice and setup of the browser is a deeply personal and personalised experience. Their tabs, bookmarks, favourites, reading lists, extensions and search histories are core to their experience of browsing and consuming online. But for others, the default browser will always do, straight out the box.

Privacy protection is another issue that can elicit a wide range of reactions, including anger and fear, general mistrust, apathy, and more positive value recognition.

Wherever a user sits on these overlapping spectrums, ongoing operational access to sensitive data by the browser can be critical to users’ experience online. For example, even the least engaged browser user may be relieved when their browser recalls their password for their Amazon shopping account. And a privacy conscious user may still be grateful to be offered up their payment card details at the checkout.

This is because browsers are not just a window to the web, with personalisation as an add on. Browsers now also double up as digital wallets, storing critical information that makes our online browsing and shopping experiences more efficient and convenient.

So when people choose to switch browsers – yep, you aren’t reading this on Netscape or Internet Explorer are you – it is important they have the option to take their useful data with them. Engaged users don’t want to start from scratch re-setting all of their bookmarks and personal touches. Nor does the average user want to start searching for their physical wallet every time they need to make a purchase, or resetting complex passwords for each website they return to.

A patchwork of solutions

Browser users don’t need to be aware of the concept of data portability, or be excited by their personal data rights. They just make a few extra clicks as they install and onboard with a new browser. This is how data portability works best: when it blends into the background, serving a higher purpose.

And browser switching is certainly not niche. On desktop devices, the market has tipped to a new winner several times over the last quarter of a century, meaning most people have changed the browser they use on their laptop or desktop computer at some stage. Switching rates have historically been lower for mobile browsers for a host of reasons, but even if just 16% have switched (according to a CMA survey of UK mobile browser users) then we could be talking about a billion people worldwide. And the introduction of choice screens, such as those imposed by the EU’s Digital Markets Act (DMA), are driving up consumer engagement, with browsers such as Opera, Brave and Vivaldi all reporting growth in user numbers since DMA implementation in 2024.

Although browser switching works relatively well, the browser data portability landscape could affectionately be described as a scruffy patchwork: it just about does the job; new patches keep getting added; but some gaps remain and each patch is different from the one before. But that variation doesn’t necessarily seem to matter a great deal. For a given user looking to switch – possibly every few years or less – it just needs to work for them, there, in that context. The fact that a different user switching between two other browsers on a different platform may be getting a completely different experience doesn’t really matter at all.

Desktop vs mobile

Browser data portability has worked pretty well on desktop for some time. The majority of browsers support the direct passive transfer of browser data without the user needing to handle any files themselves. This means that each browser on desktop is generally able to include a data import feature in their installation setup wizard. This all tends to work pretty seamlessly.

To illustrate, if someone wants to install Firefox on their laptop, they can import their data from Chrome as part of the set up process. After a few clicks (see screenshots below), Firefox is essentially able to reach into your local files and extract the data it needs.

On mobile devices, the desktop method for direct transfers isn’t possible due to browser sandboxing. But the options for moving data between browsers are increasing and improving on mobile, with very little fanfare.

For example, on the iPhone, users can export a zip file of their Safari data to their files, through a relatively quick and seamless UX accessed via the device settings. But as I have written before, data portability takes two. And we are now starting to see alternative browsers on iOS develop the necessary import functionality, including Chrome in January 2026, and Vivaldi last month.

The user journeys for the Safari exports and the alternative browser guided imports are pretty slick if you know where to look, and the transfer includes (subject to user choice) the full spectrum of useful data including bookmarks, history, passwords and credit card details.

There are further developments to suggest direct transfers will be supported on mobile in time. Google’s Data Portability API – yet to be fully explored by rival browsers to my knowledge – enables one off and ongoing direct transfers of a user’s Chrome data to third-party services, including history, bookmarks, reading lists and more. Apple has also recently announced a tool that will facilitate direct transfers of similar data scopes from Safari.

Security vs usefulness

Passwords and credit card details may just be up there with the most sensitive and dangerous data to expose to security threats. It also happens to be up there as some of the most practically useful information to share with your web browser. So there is an inherent tradeoff between the usefulness and security of browser data portability.

The market seems to have naturally converged towards a tiered approach that supports the direct browser-to-browser transfer of less sensitive data such as bookmarks and histories, then with some additional user action to move more sensitive data such as passwords and credit card information. Whether it is the user needing to export data to files before manually importing, or interacting with a separate password management service, these added steps create friction for the user and affect the user experience. But this friction is also a positive trigger for users to think carefully about their choices and be certain that they know and trust the destination.

A tiered approach appears logical to me, and is consistent with the approach we have taken to our Data Trust Registry, which has different requirements depending on data sensitivity.

A patchwork that works

Browser vendors have done a decent job at enabling their users to take their data with them, pulling together this patchwork of transfer solutions without sector wide requirements or an overarching coordination body. It may not be perfect or standardised, and there will continue to be some tensions between security and user experience to work through, but that doesn’t seem to matter too much.

The fact is, data portability really does support browser switching in its purest form, and it works pretty well.

I’m looking forward to continuing down this rabbit hole I recently stumbled into, to see what role DTI might play in helping the industry tackle any future challenges as they arise.

“For four months, Marianne, I have had all this hanging on my mind, without being at liberty to speak of it to a single creature; knowing that it would make you and my mother most unhappy whenever it were explained to you, yet unable to prepare you for it in the least. It was told me,—it was in a manner forced on me by the very person herself, whose prior engagement ruined all my prospects…” 

Elinor’s torment only makes sense if the reader absorbs the sensitivity of a secret engagement. Many readers bounce off Regency novels due to having little engagement with sensibilities like these.

I use this example not just for the pun in the title of this piece (ok, 80% for the pun) but to illustrate that all personal data can be sensitive. We can’t decide that an engagement, just because it’s usually announced happily, is a non-sensitive piece of data. The history of startups and tech platforms shows that we’re terrible at recognizing this. Many companies have blithely revealed information about women to their stalkers. My first pregnancy, though a secret to everybody I knew due to miscarriage, was not a secret to advertisers online because my search terms were shared. Companies cannot make these decisions for people.

We’ve accepted privacy principles of “protect all data” well in some areas. It’s nearly required for personal data in transit, as we’ve built the expectation for TLS everywhere. “There is no such thing as non-sensitive web traffic”, says https://https.cio.gov/everything/ , and thus all Web traffic should be encrypted.

—

When we make the case for data portability, it is tempting to forget all this. When we ask companies to make data portability a user right, yet companies have very short lists of allowed destinations due to security barriers, it’s tempting to ask them to dismantle those barriers entirely.

Companies have legal and reputational liability when they let users share personal data via platform features. Companies are well aware of the many opportunities for fraud. For example, users convinced they’re sharing data with a reliable company may be fooled by an impersonation attack. And so companies do what companies do, and build complex protective systems of service identification, data protections, security reviews, OAuth scopes and sensitivity levels.

Those systems are:

• Very expensive to companies for both platforms and companies applying for access,
• Significant barriers to users actually porting their data,
• Often wrong about sensitivity level,
• Inconsistent internal to a platform,
• VERY inconsistent across the industry

Sensitivity levels are a data classification framework - broad groupings of kinds of data, linked to protection levels. It’s understandable that companies would try this approach for personal data, as companies already use this kind of framework for corporate data. A company can decide that its customer prospect list is “restricted” and its employee foosball chat is merely “private”. A company can decide that vendor X is secure enough to work with restricted data and vendor Y is secure enough to serve employee chat rooms. But does the same model work when companies apply it to personal data?

First, it’s much harder for companies to apply sensitivity levels to all personal data. A major recording artist’s music listening activity is more sensitive than my photos of my kids. My photos are more sensitive than my friend Jamie’s blood-glucose data (because he’s already donated it as a public research dataset). Any reasonable sensitivity classification of listen history, photos and medical data would reverse this ordering. Second, it always seems safer to put data in a more secure category. If some photo albums contain images of passports and drivers’ licenses, then all albums are considered the most sensitive. If some email folders contain password reset links, then all email folders are the most sensitive.

As a result, users are burdened by high protections. When a company forces users to protect their data too carefully, they take away choice and incentivize workarounds.

The workarounds are part of why a platform can have inconsistent security protections. Many photo sites, for example, have short lists of trusted partners who can access personal data APIs and do data transfers. On the big platforms, those partners are formally and consistently vetted to make sure they are trustworthy. However, because people do want to share their photos (to photo book printers, to family, to alternate services), the photo album interfaces typically have something like this:

Now I can share my photos with an unvetted startup by creating an insecure link. Even if my judgement is sound and the startup is trustworthy, others can still use that link if it leaks.

The situation is even worse with email data access. The only common workaround for email is for users to share their email passwords with 3rd party software. If I realize that’s terribly risky, I am left with almost no safe choices for 3rd party email management services.

Protecting users by taking away choice, while also allowing insecure alternatives, is the worst compromise. It’s time to help users make choices with their own data and also to protect them.

The UX for helping users safely make their own choices is yet to be designed. What would it look like? The user could be shown ratings and offered highly trusted destinations before making a riskier choice. The user could be allowed to decide if their own data is public, private but not very sensitive, or of the highest sensitivity. Companies hosting personal data could offer to filter content objects to help the user choose which content goes where.

Defaults are still important, but after being offered sensible defaults, users could apply their deeper knowledge and trade-off weights.

Let’s improve this whole situation. Over the last 20 years we’ve developed extensive systems and UX allowing users to make their own purchasing decisions online (verified brands, number of buyers, ratings and reviews). Modern online retail shows that this could be an empowering and smooth experience. We can make a lot of progress empowering users with their own data too.

Personal data is immensely valuable. And much of that value has not yet been unlocked. It’s great to be able to get a copy of your data for your own archives and reference, and for switching services. But the real magic happens downstream, with vertical innovation: building tools and services that can create new value from that data, including in integration across its origins.

The tide is turning. Awareness of digital footprints has been growing for years, and now, everyday people are learning more about what that means and how it can help them do things with their data. And the fundamental creativity of technology builders is awakening. And in parallel, people are generating more and more personal data, and consequently more potential downstream value. A huge factor amplifying these effects is AI.

Regular readers of this outlet know that DTI has been pushing for the importance of personal data portability in the context of AI for quite some time. These have been predictions of what’s to come and guidance on how to shape the future, drawn largely from my work and experience in the global tech sector, and my understanding of the possibilities of technology and how it can be both used and controlled. Three dynamics are emerging to validate this dynamic:

1. Developers are building tools to get value out of personal data – including developers and builders, not just large corporations – both with and through AI. Check out the reception for the world’s first AI portability hackathon, which DTI recently helped organize.
2. For better or worse, people are freely adopting tools like OpenClaw and giving it access to all of the personal data they possess, including their local files and access credentials to remove services. This is a wildly insecure path, but it is being widely pursued nevertheless, because the value is there.
3. People are making choices about which AI service to use not based on performance but values, including flash reactions to news developments. And when they decide to switch, service providers and internet commenters are walking them through the best currently available pathways to transfer their data over.

My colleague Tom offered a prediction this year as well: “Data portability use cases will be proven as commercially viable.” At the hackathon in late February, there was at least one angel investor present to look for opportunities. I think Tom’s right, and alongside that, there will be rapid acceleration on the growth curve of demand for and adoption of data portability and personal data use, in and with AI.

Why is AI accelerating portability? First, it helps people prototype technologies based on little more than a concept, reducing technical knowledge and experience barriers. Opinions vary on whether “vibe coding” and similar AI-assisted development can substitute for production-quality or long-term maintainable software. However, it’s hard to deny that it makes it easier to test out ideas and hypotheses.

Second, it unlocks new recommendation and suggestion power based on user tastes. While this is perhaps fairly basic functionality, it’s incredibly valuable to help someone identify new music they might want to listen to, restaurants they might want to try, or products they might want to purchase – both to the individual and to the enterprise. If, as posed by Eric Seufert, “everything is an ad network”, then everything must also be a potential data portability use case.

Finally, AI interactions are themselves a new source of interesting and valuable data. People talk with their chatbots about lots of things. While some of this data can be extremely personal and sensitive, lots of it also can be extremely valuable, as we know from the ways in which it is used in fine tuning and improvements to the AI service itself. These same learnings and personalizations are of use in many other contexts as well.

But, how much is this last part true in practice? What form is portability of personal AI data taking today? Are the current tools and methods making the right data available? Will there be trust mechanisms in place, or will users be encouraged (or misled) to transfer potentially sensitive chat histories to new services without safeguards?

DTI has articulated our principles for how it should work in practice. TL;DR: We aren’t there yet. Portability demand is growing. Can the supply keep up?

It’s great to see experimentations with memory transfers, as Anthropic is doing. I appreciate as well that you can still export your raw personal data from Claude as well – as you can from ChatGPT and other AI services. I hope, but cannot be certain, this will continue. And the direct transfer of such data, as articulated in GDPR Article 20, typically remains a work in progress, with few exceptions. In the age of possibility brought about by modern AI, I struggle to imagine that technical feasibility could be a plausible barrier.

Trust is missing here as well. Our trust registry project, nearing the end of its pilot phase, vets third-party recipients of direct transfers of personal data to help protect people – checking that their data will not be stored insecurely or abused, and that relevant consent mechanisms meaningfully reflect what the company will do with the data.

Contrast DTI’s trust work with the realities of OpenClaw, which Simon Willison has described as the technical development most likely to result in a “Challenger disaster.” People are wantonly opening their local drives and connecting their access credentials to AI agents they not only do not actively control, but in many cases do not understand.

I have confidence in DTI’s partners and affiliates, who together lead on data portability in all its implementations. Joining us in our work means supporting our mission: “Empower people by building a vibrant ecosystem for simple and secure data transfers.” These companies make personal data available through many methodologies, including downloads, Data Transfer Project-powered direct transfers, and APIs. With our affiliate Inflection, we shipped a data model for conversation histories designed to maximize effective reuse. And our affiliates Fabric and koodos are building new tools and open ecosystems around personal context portability in AI, including this brand new context-use tool from Fabric. Context-use is a local, open source tool that converts user archives like full ChatGPT conversations and Instagram stories into personal context for agents like OpenClaw. In this way, agents are able to use full personal context safely without accessing primary user accounts.

But I am worried about a reversion to historical patterns of trapping users in online services by their own data. Where there is money to be made, there is incentive to capture as much of it as possible. The question I asked in November 2023 has not been fully answered: “whether the future of generative AI will lock users into new technology silos, or empower them by ensuring portability.”

I’m also worried about privacy and security problems that could arise from an ecosystem of data movement that develops without collaboration and considerations of trust. In other portability contexts, great care is taken in scoping the data made available and in user understanding of the transfer and its safety. Without substantial investment in and coordination of portability, more problems – avoidable problems – will occur.

I’m not the only one thinking about the risks of consolidation and security in data flows. Regulation is on the horizon. In the EU’s recent DMA review process, Open Markets Institute and other commentators explicitly called on the European Commission to designate virtual assistants and chatbots. Megan Kirkwood at Tech Policy Press wrote an overview of the issue.

In the United States, at the state level at least, there is ample regulatory appetite. In 2025 alone, more than 1100 AI-related bills were introduced in U.S. states. The Digital Choice Act in Utah, although it is not without controversy and challenge in implementation, includes substantial data portability obligations for social media services; and similar laws have been proposed in several other states. It’s not hard to imagine these two forces coming together.

DTI doesn’t take a position on regulatory matters, and we recognize that these are complex issues and regulation inherently involves tradeoffs. But we also recognize that regulation in some form is inevitable, regardless of one’s views on the merits.

Now is the time to get a head start on building portability infrastructure in AI the right way – together. We can, and should, collaborate on shared tools and methodologies to export and import personal data in AI, including both conversation histories as well as higher-level memories and contexts. It won’t take radical new engineering. Just the space and collective will to coordinate. And we at DTI exist to facilitate precisely this.

We invite you to join us on this journey.