Wholly Our Own
In New York the tripods stand in the middle of the pavement. People film themselves, film the people passing, and ask them questions; those who decline are filmed declining, and the refusal is posted with the rest. The cars that take you home record the cabin in picture and sound, for the driver’s safety, and the recording leaves with him at the end of the shift, on a card in his pocket or in an account under his name, retained for as long as he or his employer finds convenient. No passenger is asked, and no passenger could establish, a year later, where the record of that journey resides or who has watched it.
In the Emirates a valet bringing your car round dims the headlights before he stops, so that no one walking past the front of the car is lit.
Neither man is thinking about privacy. One operates on the assumption that a person in public is available to be recorded unless they object; the other on the assumption that they are not, and acts on it before the question can arise. The two cities do not differ in their technology, and the difference is not well described by law or by wealth. It is a difference in the default, and defaults, as the rest of this argument will show, are set by whoever operates a system rather than by the person inside it.
The argument rests on one claim. Of the things a person can be said to possess, the self is the only one that cannot be restored once it has been taken. Capital can be recovered, a reputation reconstructed over time, a house insured against its loss. A likeness, a voice, a pattern of movement, a record of where one has been and in whose company, behaves differently: once copied it exists in every copy, each copy is as complete as the original, and no remedy available to the person reaches them. Privacy, on this account, is neither a preference nor a sensibility. It is the condition of still owning the one asset whose loss is irreversible, and it should be reasoned about with the seriousness that irreversibility already commands in medicine, in structural engineering, and in the design of settlement systems, where a transaction that cannot be unwound is treated as a different class of event from one that can.
A second asymmetry bears on why such an argument should be published at all. Knowledge is the possession that grows by being divided; the more people hold a method, the more of it there is, and nothing is lost to the one who shared it. Identity is governed by the opposite arithmetic: each additional holder of a person’s likeness or record is a reduction in that person’s custody of themselves, with no corresponding gain. The two are not in conflict. They indicate that method should travel as widely as it will go and that identity should travel only by the deliberate act of its owner, and that any system which confuses the two, treating a person’s record as if it were a piece of knowledge to be propagated, has made a category error with consequences the person will bear alone.
How the self is given away
Most of what is lost is not taken but traded, in a bargain whose terms were written down and never read. A well-made service is offered without charge in exchange for a continuous record of attention, movement, relationship and face. The record is the product and the service is the cost of collecting it. The companies that operate the bargain are not acting from malice, and it matters to say so, because malice can be shamed and appetite cannot. Their systems are built on models that require more of the record than they have, so they ask for more, and when asking yields too little they build instruments that collect at the edge of what was agreed.
What was agreed is the part of the mechanism that deserves the closest attention, because it is where the law and the design meet. The terms under which the record is taken are legally binding and are, in every jurisdiction that matters, enforced. They are also written at a length no ordinary person reads. The terms governing one pair of recording glasses run to twenty pages, and incorporate by reference eighteen further documents that add another 168, as published on 9 October 2026; the legal instruments alone, leaving aside the help pages among them, come to 163 pages, presented behind a single control whose only convenient action is assent. The result is a contract that holds in court and was never, in any meaningful sense, entered into. That is not a failure of the companies, who are using an instrument the law provides, and it is not a failure of the people, who are responding rationally to a document designed to be skipped. It is a systemic flaw: the law treats an unread assent as consent, and the design is optimised to produce exactly that assent. The glasses exist because a company requires a large volume of data on how human beings move through rooms, handle objects and speak to one another, and the least expensive way to obtain it is to pay people to wear a camera and go about their lives. The people around the wearer are not party to the agreement, however many pages it runs to.
The same structure holds, less visibly, for anything published by others in which one appears. A photograph taken at a restaurant and posted by a guest records, behind the intended subject, the table beyond it: other people, at a particular place on a particular evening, now retained by the platform indefinitely, indexed by the faces it contains, and licensed under terms the people at that table never saw. They are not users of the service that holds them. They have no account through which to object, and no mechanism by which to be removed. For a person who takes the custody of their likeness seriously, the practical consequence is a narrowing of where they can comfortably go, since every public room now contains instruments whose owners have agreed, on their behalf, to terms they would not accept. Some rooms post a rule against it, in the changing room and beside the pool, and the rule is in the membership terms as well; nobody observes it and nobody enforces it, and a rule without governance is a sign.
The consequence of this has changed in kind rather than degree, because of what the fragments can now become. A few images and a minute of recorded voice are sufficient to produce a convincing moving likeness of a person saying and doing whatever its maker chooses, and the tools that produce it run on a desk and answer to no one. The person reconstructed need not have published anything. It is enough to have been seated near a lens held by someone who regarded capturing as ordinary. One can now be held, in a quite literal sense, in a stranger’s pocket, without knowing it.
The Danish register
On 5 October 2026 the Danish CPR Administration, which operates the national civil register, announced that unauthorised parties had obtained the names, addresses and personal numbers of approximately 8.8 million registered persons. Nothing had been broken: on the register’s own account, a Danish company’s lawful access to the system had been misused by persons outside it to run a very large number of automated lookups. Reporting since has put the period at ten days, and the activity is said to have come to light when the volume of lookups produced an unusually large invoice. The register had been designed on the assumption that whoever held a key was the key’s owner, which is the assumption every access-granting system makes until the day it is falsified.
One sentence in the announcement deserves more attention than the figure. The review, the Administration wrote, showed that the unauthorised access did not include the names and addresses of persons who had chosen to register with name and address protection. The protection had been available to every person in the register and had been elected by few. Those few had decided, in advance and without any particular event in view, that their record should not be readable by default; and when the event came, their decision was the only thing in the system that held. In matters of identity the decision has to precede the event, because the event leaves nothing to decide about.
The objection
The objection is familiar and deserves a direct answer: that most people do not mind; that participation has a price and the price is reasonable; that this is a concern for those with something to conceal. Three replies.
Consent to being seen is not consent to being reconstructed. A person who agreed to a photograph in 2010 did not agree to the uses that photograph has in 2026 and could not have, since the uses did not exist. A bargain whose terms are altered after it is struck is not a bargain but a disclosure made under a misapprehension, and the misapprehension was induced.
The people who do not mind are deciding on the basis of information they do not possess, and the people who do possess it hold the information of the present, not of the system’s capacity in ten years. The record is permanent; the uses are not fixed. In September 2024 the company that operates the largest social platforms confirmed, under questioning at an Australian parliamentary inquiry, that it had used the public posts and photographs of its adult users dating back to 2007 to train its generative models; in 2025 it began the same for adults in the European Union, with a right to object rather than a request for consent. No one who posted a photograph in 2007 was deciding about that, and could not have been. Indifference to a risk one cannot yet see is not evidence about the risk.
And the Danish case answers the charge of privilege directly. The protection was free, universal and elected by almost no one, so the determining variable was not means but the default, and the default was set by the operator of the register and not by anyone in it.
What follows
For the person: decide before the event. Where a protection exists, elect it now; the Danish exception is at once the proof that such protections work and the proof that they must be chosen in advance. Assume that in public you are being recorded by someone who regards recording as ordinary, and reduce the quantity of yourself that exists in places you did not put it deliberately. This is not withdrawal from the world. It is custody of the one thing in it that cannot be reissued.
For anyone who holds other people’s identities, which now includes every enterprise that has ever asked a customer to prove who they are, five principles, each a consequence of what has been argued.
Design for the stolen key rather than the broken door. Every lawful access you grant will one day be exercised by someone other than its grantee, so the question is not whether a key can be stolen but how much a stolen key can do. No single key should open the register. Bulk retrieval, export and privileged lookups should require the concurrence of more than one holder, as the custody of significant assets already does: a threshold of keys rather than a key, so that the compromise of one credential, or one company, is an event the system absorbs rather than one it reports after the invoice arrives. Limit the volume any key can draw in a period; measure each key’s behaviour against its own history and halt it when it departs; and retain each record only as long as its purpose requires, so that what a misused key can reach is a room and not the building.
Make the data unreadable to yourself wherever the service permits it. A record the holder cannot decrypt cannot be extracted from the holder, by an intruder or by lawful process. One Swiss provider of mail and storage is built on this principle: content is encrypted on the user’s device and stored in a form the company cannot read, so what it can produce when compelled is limited by design to what it holds in the clear; and since 2024 its principal shareholder has been a foundation, which constrains the one event that most reliably changes a company’s conduct: its sale. The ordinary architecture differs by design rather than by virtue. A messaging service whose standard conversations are stored on its servers in readable form is able to produce their content under valid process, and does; one whose conversations are encrypted end to end cannot produce content, but can and does produce the surrounding record of who spoke to whom, when and from where, and that surrounding record is the raw material of an advertising business. In each case the lawful request reveals exactly what the design left readable. A holder who does not wish to be the point of failure should build so that there is nothing at the point to fail.
Write terms that are entered into rather than passed through. The single control that assents to everything is a design choice and can be unmade: terms that govern a person’s data should be signed, as any other instrument of that consequence is signed, with the material provisions presented in the language the person speaks and short enough to be read in the time it takes to sign. Beside the legal text, the operator should state in plain language what its business is and where its revenue comes from, since a person who knows that the service is the cost of collecting the record is in a position to consent to the bargain and a person who does not is not. The terms should be queryable: a person should be able to ask what is held about them, by whom, for how long, and receive an answer from the document rather than from a lawyer. Where the system’s conduct can be made checkable, by publishing its design or its code, it should be, because a claim about how data is handled is worth exactly as much as a stranger’s ability to verify it.
Choose the law you answer to. Where the servers sit, and under which jurisdiction the company is constituted, determines what can be compelled from it and by whom. This is a design decision like any other and should be taken as one, early, with the same care as the choice of a database.
Hold records as governed rather than public. Well kept, inspectable by those with a right to inspect, verifiable by those with a reason to verify, and visible to no one else. A register that is open is not transparent; it is unguarded. Transparency is a property of the governance of a record, not of its exposure. The systems I am responsible for are built on these five principles, including the last: a participant signs terms rather than clicking through them, can remove their own record, and decides, item by item, what is visible to whom.
For the state: make protection the default and exposure the election. Denmark offered the right protection to everyone and allowed the default to determine the outcome; invert the default and the same breach reaches the few who opted out rather than the many who never opted in. Treat an unread assent as what it is, which is not consent, and require of operators the form of agreement described above before a record may be taken. Then attach to the operators of registers a consequence proportionate to the exposure. A register that discovers its own breach from its billing department has, at present, no stronger reason to look.
The room
Montaigne, in the essay on solitude, wrote that we must reserve a back shop, wholly our own and entirely free, wherein to settle our true liberty, our principal solitude and retreat. He was writing of the mind, in a century when the only lens was an eye. The room he describes is the one thing in this piece that cannot be designed, legislated or signed for, because it is not a system; it is what the systems are for. Everything above is in its service. Method should travel as widely as it will go, and this piece is an instance of that. The self should travel only by its owner’s deliberate act, and the room is where the owner decides. A person without it has nothing left that is theirs to share.
Sources
- Danish CPR Administration, announcement of 5 October 2026; Datatilsynet, notice of 5 October 2026.
- Parliament of Australia, Senate Select Committee on Adopting Artificial Intelligence, public hearing of 11 September 2024, Canberra.
- Data Protection Commission (Ireland), statement on the training of AI models on the public posts of adult users in the European Union, 21 May 2025.
- Page count of the glasses' terms and their eighteen incorporated documents made by the author on 9 October 2026.
- Michel de Montaigne, Essays, I.38, translated by Charles Cotton, 1685 · /commonplace/montaigne
- Version
- 1
- Date
- 2026-10-13
- sha256
- e7809b1e9487dbf0c000d96d397689e1aeb117ff4e541ddaabd336587e21cab8