Standardising transparency: where the work stands

A privacy policy tells you what an organisation says about itself. It does not give you anything you can check. Two services can publish policies with the same words and do completely different things, and neither the person reading them nor the regulator overseeing them has a common record to compare.

That is the problem standardisation solves. When transparency is standard, the same disclosure carries the same meaning for the person, the organisation and the regulator, and it leaves the same kind of evidence behind. Transparency stops being a statement and becomes a record.

The work to get there is not carried in one place. It runs through several bodies, each holding a different piece. This post sets out where it stands.

The model: the Operational Transparency Stack

We describe the work as a stack, read from the bottom up. Each level makes the one above it possible.

1. Foundation: the OECD guidelines and Council of Europe Convention 108, which established notice and awareness as requirements in 1980 and 1981.
2. Framework: ISO/IEC 29100, the privacy principles and vocabulary every level above it uses.
3. Presentation: ISO/IEC 29184, online privacy notices and consent.
4. Record: ISO/IEC TS 27560:2023, the consent record information structure.
5. Evidence: the ANCR extension to ISO/IEC TS 27560:2023, which anchors the record to the controller and the exact notice version.
6. Treaty: Convention 108+, the modernised Convention, which has not yet entered into force.
7. Practice: the Internet Transparency Code of Practice, proposed.

Levels 2 to 5 exist as published documents. Level 7 is the piece still being built, and it is the one that turns the rest into something an organisation can adopt and a regulator can inspect. We wrote about where the stack sits against the OSI model here.

Where each piece is carried

The evidence: Kantara ANCR Working Group

The Kantara Initiative's Anchored Notice and Consent Receipt (ANCR) Working Group has published Release 1 of the ANCR Extension for ISO/IEC TS 27560:2023, as a v1.0 Release Candidate. It specifies a notice receipt: a record of who was accountable for a notice, which version was shown and when, held by the person and checkable without identifying them. It is progressing through Working Group review toward a Kantara Recommendation. We set out what the receipt records in an earlier post.

The record: ISO/IEC JTC 1/SC 27/WG 5

ISO/IEC TS 27560:2023 is the published Technical Specification for consent records, and it is under revision in the same working group. Alongside it, SC 27 registered a preliminary work item by Resolution 2026/32: Gap analysis for standards on privacy notices and consent and ways to address potential gaps. Its question is where today's notice and consent standards meet the need for records people and regulators can rely on, and where they fall short.

The practice: ISO/IEC JTC 1/SC 44/WG 1

At its fifth plenary, on 3 September 2026, SC 44 established a preliminary work item: Internet Transparency Code of Practice Profile through privacy by design. It aligns with ISO/IEC 29100, ISO/IEC 29184 and ISO/IEC TS 27560:2023.

The code: the Internet Transparency Code of Practice

The code was introduced at CPDP Brussels in May 2026, and its requirements are being shaped through expert input. A code of practice is what makes a standard usable by an organisation that is not a standards body: it says what to publish, how, and what evidence to keep. We set out where the code stands and published a white paper on it.

The treaty: Council of Europe Convention 108+

Convention 108+ sets transparency obligations that apply across borders. Once it is in force, a standard that shows those obligations being met, in advance and in a form anyone can check, is what lets data move between jurisdictions on evidence rather than on assurances.

Why it takes several bodies

No single body can do this alone, and that is by design. A standards committee can define a record but cannot make anyone adopt it. A code of practice can set expectations but needs a standard to point to. A treaty can set obligations but needs evidence to test them against. Each piece is necessary, and none is sufficient.

The connection between them is the point. An organisation can hold a conformant consent record while a regulator holds a treaty obligation, and today neither can test the other. Standardising transparency closes that distance.

What we do

TCIEG supports the development of the Internet Transparency Code of Practice and makes the case for connecting the pieces above. We do not speak for any of the bodies named here: each carries its own work through its own members and procedures.

If you are a regulator, an implementer or a standards contributor, there are two ways to take part. Read ANCR Release 1 and test it against a real notice and consent flow, through the Kantara Working Group. And tell us what a transparency record needs to show for you to rely on it: info@tcieg.org.