I was 22 and running an Airbnb management company in Amsterdam. Huurfix, we called it. We handled everything: keys, cleaning, and guest communication. Property owners could collect rent without lifting a finger, and in those days, everyone wanted in. Airbnb was booming. Everyone wanted to list their place. Nobody wanted to deal with the guests. We managed dozens of apartments across the city.

One day, a guest cancelled last-minute. Two full weeks, suddenly available. The property was a cosy townhouse in Amsterdam-West, owned by a young couple who were travelling. I listed it that same evening. Last-minute availability, middle of the week. Not expecting much.

That same night, a booking request came in. A Chinese name. No profile photo. Brand new account. Zero reviews. He wanted the full two weeks, paid upfront.

Red flags? Sure. But here’s the thing about running a startup at 22: you need money. And a two-week booking is easy money. No turnover. No back-to-back cleanings. Just one guest, one check-in, one check-out. Let’s do it. I accepted. He confirmed instantly. Deal done.

The day before check-in, I did what I should have done before accepting. I googled him.

The first results made my stomach drop. The same name. Amsterdam-based. Connected to organised crime. Convicted of human trafficking. Recently released. On probation. Linked to the Holleeder network, the kidnapping and extortion ring that dominated Dutch crime headlines for decades. I stared at my screen.

Then I did what any rational person would do: I convinced myself it couldn’t be him. “It’s probably a common name,” I told myself. “There are thousands of them. What are the odds?” I also noticed something I filed away for later: he owned a chain of hotels. One of them was around the corner from the apartment.

I called my lawyer.

“I think I’m about to check a human trafficker into a family home in Amsterdam-West,” I said. “What do I do?”

He didn’t skip a beat. “The police already know where he is and what he’s doing. He’s on probation. You don’t have to do anything. Just act normal. It’ll be fine.”

I decided to trust that.

Check-in day. I arrived early to prepare the place, tucking away the couple’s personal items, making the beds, the usual routine. A normal Dutch townhouse. IKEA furniture. Family photos on the walls. Cosy.

The doorbell rang. One hour early.

I walked to the window and looked down at the street. A black stretched Hummer was parked in front of the house. Tinted windows. A large Chinese man leaning against the hood, arms crossed. My stomach turned. I buzzed them in.

Footsteps on the stairs. My heart was pounding. The door opened.

It wasn’t the man from the car. A slight figure stepped in. Maybe 1.60 metres tall. Soft handshake. Polite. Almost deferential. “Hello,” he said, and introduced himself. The same name from the booking.

I gave him the tour. Kitchen, bathroom, bedroom. He nodded along. “Perfect, perfect.” I handed over the keys. “Thank you.” He walked back down the stairs, got into the Hummer, and drove off.

I stood there, alone in the townhouse. Was that really him?

Two weeks passed. I went back to the daily grind. Other apartments. Other guests. Other problems. I tried not to think about it.

Check-out day. I decided to handle this one myself. I wasn’t going to send a colleague into whatever was waiting in that apartment.

I rang the doorbell. Knocked. No answer. I took out my master key and turned the lock. The door swung open.

The floor was covered in packaging material. I bent down and picked something up. Dolce & Gabbana. Chanel. Louis Vuitton. Easily 10,000 euros worth of luxury brand packaging scattered across the living room. The dining table was buried under Chinese takeout containers. Grease everywhere.

I looked at the wall. Oil. Splashed vertically. Like someone had thrown an open bottle across the room.

I walked to the bedroom. Red liquid on the floor. My first thought: Is that blood? I stepped closer. Red wine. An overturned bottle. The white plaster wall was stained crimson. The floor was sticky with it.

The kitchen was worse. Every piece of dinnerware had been used. Pots, pans, plates. All coated in grease and grime. I stood in the middle of it all. What happened here? I didn’t want to think too hard about it.

I pulled out my phone and opened the Airbnb app. “Hey, I just arrived for check-out. Where are you?”

The reply came instantly. “Check-out? That’s today? Shit, I had no idea.”

I stared at the message. Then I started cleaning. The owners were coming back. I had no choice. This was going to take hours.

I was scrubbing the kitchen counter when the doorbell rang. I walked to the window. The Hummer was back.

My heart was in my throat. Someone ran up the stairs. He burst through the door.

Sorry, sorry, sorry.

“You need to pay for extra cleaning,” I said.

No. I’m not going to do that

He paused, looking around the apartment. At the oil on the walls. The wine stains. The mountain of dishes. His expression softened.

I’m very sorry. I will help you.

He wasn’t offering to pay because that would have been impersonal. Disrespectful, even. He wanted to fix what he’d broken himself. The honourable thing to do.

Fifteen minutes later, I was standing at the kitchen sink. He was next to me. Shoulder to shoulder. He did the soap. I did the towel. He mumbled apologies in broken English as we worked through the stack. “Sorry I left it like this.” “Very sorry.”

About an hour later, the apartment was presentable again.

A 22-year-old startup founder. Doing dishes with a kingpin. In a cosy townhouse in Amsterdam. Owned by a young couple who had no idea.

Why is it that most of us fill out our tax returns properly? Or scan every item at the self-checkout, even when no one is watching?

You could say we follow our moral compass as humans, but that is only half the truth. The other half is that we do these things because there are rules with consequences if we fail to comply. These rules exist because we collectively chose them through democratic processes. They, the elected representatives, create laws, and authorities enforce them.

When you walk through a supermarket, cameras record your movements. They create an audit trail. The footage follows you from aisle to aisle. But crucially, that footage alone cannot identify you. You remain pseudonymous. Your face is captured, but your identity is not known.

If you steal something, that footage becomes evidence. But to link you to your identity, you would need to identify yourself (show an ID), or authorities would need to obtain your identity through official channels. The audit trail exists. The ability to identify you exists. But the link between the two requires a deliberate step.

This is how accountability works offline. You are tracked, but not identified. Private, but accountable.

Privacy, Anonymity, and Pseudonymity

Before we move on to how this works online, there is an important distinction: privacy, anonymity, and pseudonymity are not the same.

Privacy means certain information about you is not publicly accessible. Your medical records, your bank statements, your conversations at home.

Anonymity means you cannot be recognised or identified at all. No trail exists. No link to any identity is possible.

Pseudonymity sits in the middle. You can be recognised. You have a reputation. Your actions are tracked and audited. But your identity remains private until you choose to reveal it, or until a legitimate process (like a court order) links your pseudonym to your real identity.

In our day-to-day offline life, we are pseudonymous. Your face acts as a pseudonym. People recognise you, but they do not know your name, address, or official identity unless you share it. A shop clerk sees your face every week but does not know who you are. You become identified when you choose to identify yourself, perhaps by showing ID or using a bank card.

The key point: a pseudonym is always tied to a fixed identity. You cannot create unlimited pseudonyms without accountability. Each pseudonym corresponds to a single real entity. This creates reputation, consequence, and responsibility.

Online: No Audit Trail, No Accountability

Creating fake content online was always easy. All anyone had to do was create an email address and social media accounts under a fake name, register a domain name that sounds official, and design a website that looks like a news outlet. Without any ability to trace who created the content, the creation and spread of misinformation was trivial.

But today’s synthetic content is far more sophisticated. AI can generate photorealistic deepfake videos in seconds. Large language models write convincing fake articles at scale, complete with citations, quotes from “experts,” and official-sounding language. Voice cloning technology can impersonate anyone with just a few seconds of audio. Synthetic media is now indistinguishable from reality.

We are not just dealing with fake articles anymore. We are dealing with fake people, fake videos, fake audio. Entire synthetic realities created by anonymous actors with zero accountability.

The problem is not just “fake news.” It is inauthentic content at scale: AI-generated, synthetic, fabricated. Content designed to mislead, manipulate, or deceive. And the creators face no consequences because they cannot be traced.

The Erosion of Online Accountability

When you publish content under your own name, there is more at stake. Your reputation. Your relationships. Your career. Both public accountability and legal accountability create consequences for behaviour. But neither works without the ability to identify the person responsible.

For a while, influencers seemed like a viable model. They are not anonymous. Their reputation is their business. Brand partnerships worth millions are at stake. Platforms can demonetise them. Audiences can turn them on instantly. If they break the law, authorities can pursue them.

But this model is eroding. Synthetic influencers are now emerging with realistic faces, voices, and video content. There is no real person behind them. No reputation at stake. No accountability. An army of AI-generated personas can push any agenda, and nobody can be held responsible. It is the next evolution of troll armies: faces that move, voices that speak, clips that look indistinguishable from real people.

The vast majority of content online is still created by anonymous accounts. A deepfake video can rack up 10 million views in two hours, spread across platforms, influence elections or stock markets. The creator? Unknown. The consequences? None.

Online, you can create chaos and walk away. Offline, you cannot steal a candy bar without an audit trail following you.

Current Approaches Are Not Working

Since misinformation became a mainstream concern, we have attempted to solve it in several ways.

Algorithms for detecting and removing fake content have improved. X (formerly Twitter) introduced Community Notes, a crowd-sourced fact-checking system where users collectively add context to posts. Meta partners with third-party fact-checkers. These efforts show promise.

But AI-generated content now outpaces detection. For every improvement in moderation algorithms, AI generation improves by 10x. Content moderation teams at major platforms remove millions of posts daily and still cannot keep up.

Regulations have advanced significantly. The EU Digital Services Act (DSA), enforced since 2024, requires platforms to moderate illegal content and be transparent about their algorithms. Platforms can be fined up to 6% of global revenue for non-compliance. The EU Digital Markets Act (DMA) designated platform gatekeepers. Multiple countries have passed content moderation laws.

This is real progress. But even with the DSA forcing platforms to moderate, they are playing whack-a-mole. The core issue remains: platforms moderate symptoms, not the source. Anonymous authors still face no accountability.

Financial sanctions against platforms have increased. The EU has issued multi-billion euro fines against Meta, Google, and others for various violations. But fines do not change behaviour fast enough, and wealthy tech companies can absorb them.

AI detection tools are the newest attempt. Services claim to detect AI-generated text, deepfakes, and synthetic media. But this is an arms race, and detection is losing. The same AI companies building detection tools are also building better generation tools.

A key reason these solutions are ineffective is that they do not address the underlying issue: creators of inauthentic content have no accountability because they can remain anonymous online.

A Protocol for Accountable Online Communication

What if we could create a system that, like offline activities, leaves an audit trail for all online activities, without endangering privacy or creating surveillance infrastructure?

Not a platform. A protocol. One that can be embedded in any type of online communication: social media like Instagram and TikTok, messaging apps like WhatsApp and Telegram, email services, forums, any digital platform where content is created and shared. A universal layer for accountability and trustworthiness.

The technical foundations already exist. The W3C Verifiable Credentials standard, published in 2025, provides cryptographically secure, privacy-respecting credentials that can be verified by anyone without contacting the issuer. These credentials support selective disclosure: you can prove you are over 18 without revealing your birthdate, or prove you are a resident of a country without revealing your address. You share only what is necessary, nothing more.

Here is how it works:

Every action you take online (posting, commenting, sharing, messaging) is logged in a way that maintains your pseudonymity. You remain unidentifiable to the public and to platforms. The audit trail exists, but it is not connected to your identity by default.

When content becomes the subject of a criminal investigation, a structured process begins. Authorities obtain a court order for that specific piece of content. The audit trail is then queried across an index of KYC (Know Your Customer) providers, whether in a single country or globally. One of these providers can respond: “I have that audit trail on file, which means I have the identity documents connected to this content.” With the court order in hand, that specific provider discloses the identity.

No single entity holds all the data. No platform knows who you are. The identity information is distributed across independent KYC providers, and only the provider that onboarded you can make the connection. And they can only do so with judicial authorisation for a specific piece of content.

Critically, this requires separate authorisation for each piece of content. Authorities cannot ask, “Who is this person and what have they posted in the last five years?” They must specify: “This particular post is under investigation. We need the identity of the author.”

This process can be automated with appropriate safeguards. When certain thresholds are met (verified harm, scale of distribution, legal complaint), the system can trigger a data release order through judicial oversight. Human judges, accountable to democratic institutions, make these decisions. Not Big Tech content moderators with commercial incentives.

This is not proactive surveillance. It is a retroactive investigation with democratic oversight. Decentralised identity storage. Division of powers. Checks and balances.

Compare this to a thief being caught in a supermarket: the police can obtain the thief's identity for that specific incident, but they cannot ask which supermarkets the thief has been in over the last five years, what items they bought, or who they spoke to. Each investigation requires a separate, specific authorisation.

This is Trias Politica in the digital age. Separation of powers. Checks and balances. Judicial oversight. The same principles that protect us offline apply online. Accountability flows from democratically elected institutions, not from private company policies.

In an age of AI-generated everything, the question is not “is this content real?” but “who created it?” Accountability does not stop synthetic content from being created. But it makes creators think twice before hitting publish.

Who manages this system?

Now the key question: who manages this system?

Currently, Big Tech companies like Google, Meta, and X manage our digital identities and activities. They have commercial motives: advertising, engagement, growth. This is problematic because information can be manipulated, deleted, or used for purposes we never agreed to. Their content moderation decisions are not accountable to any democratic process.

The answer is a distributed protocol that nobody owns but everybody can verify. A shared, public, immutable audit trail maintained by many independent parties. No single company can manipulate it for profit. No single government can censor it unilaterally. The architecture itself prevents the concentration of power.

The identity layer can be provided by existing infrastructure: the EUDI Wallet and the network of KYC providers across Europe. The audit trail layer requires a separate, immutable ledger where all online actions are recorded pseudonymously.

This is not hypothetical. The technology exists. At mintBlue, we facilitate the integration of platforms and applications into this distributed protocol. We provide the infrastructure layer that enables any online service to connect to a shared audit trail without building it themselves. The EUDI Wallet handles identity. The distributed ledger handles accountability. Together, they create the architecture for trustworthy online communication.

The protocol creates the accountability we need without creating the surveillance infrastructure we fear.

Europe’s Digitalisation Opportunity

Europe is uniquely positioned to lead this transition. And it is already building the infrastructure.

The EU has already built the regulatory foundation. The Digital Services Act and Digital Markets Act establish accountability requirements for platforms. The Digital Product Passport mandates traceability for physical goods. EUDR requires supply chain auditability. The AI Act demands transparency for AI systems. Traceability, auditability, and accountability are already mandated across multiple domains.

More importantly, the EU is deploying the technical infrastructure. The European Digital Identity Wallet (EUDI Wallet), mandated by eIDAS 2.0, launches across all Member States by the end of 2026. Every EU citizen will have access to a digital wallet that stores verifiable credentials: identity documents, diplomas, professional licenses, and age verification. The wallet is built on W3C Verifiable Credentials and supports pseudonymous authentication by design.

The EUDI Wallet is a puzzle piece to what this article proposes. Users can authenticate to platforms using pseudonyms unique to each service, preventing cross-platform tracking. They can prove attributes selectively, sharing only what is necessary. And, when legally required, their identity can be verified by the KYC providers that issued their credentials, with appropriate judicial oversight.

By November 2027, large online platforms must accept the EUDI Wallet for authentication upon user request. The infrastructure for accountable, pseudonymous online identity is not hypothetical. It is being built right now.

A protocol for accountable online communication fits naturally into this regulatory landscape. The infrastructure requirements for sustainable supply chains and for trustworthy online content are fundamentally the same: immutable audit trails with privacy-preserving verification.

Europe can pioneer an accountable, level-playing-field online. Tools for legislators to govern digital spaces. Enforcement of the rule of law online without infringing on privacy.

Unifying the Online with the Offline World

The offline world has accountability built in. Your face is your pseudonym. Your movements create audit trails. You can be traced if you break the law. Privacy exists: your medical records, your conversations, and your home life remain private. But pseudonymity, not anonymity, is the default.

Distributed protocols enable the same model to run online. Your actions are traceable yet pseudonymous. Authorities accountable to democratic institutions can link your online identity to your real identity when authorised by a court order. Just like they can identify you from security footage offline.

We do not need to choose between privacy and surveillance. We need the same balance online that we have offline.

Five years ago, I wrote the first version of this piece. The problem has only gotten worse. AI made synthetic content exponentially easier to create and harder to detect. Regulations tried to catch up, but they are still chasing symptoms.

The solution has not changed. We need accountability. And accountability requires identity: not surveillance, but pseudonymous identity with judicial oversight, accountable to the democratic process.

The question is: do we build it before the next deepfake election? Or after?

Originally published January 2021. Updated January 2026.

This ruling made sense in 1979. If you reported a suspicious transaction to your bank, the bank could share it with authorities. If you wrote a letter to a friend, you couldn’t claim privacy once they had it. You chose to share. You accepted the consequences.

But in 2026, this principle has become the legal foundation for the largest transfer of wealth and power in human history.

In this article, we’ll explore:

• Why data companies had no alternative to trading data

• How micropayments could offer an alternative

• The effects of a public data commodity ledger

• The impact of making the user a data controller

The World’s Most Valuable Resource

The Economist put it simply:

And yet, we don’t own it…

1.8 billion people use Gmail. Every email you write, every search you make, every attachment you send - it all belongs to Google. You’re not the customer. You’re the product. The actual customers are advertisers buying access to your attention, your behaviour, your life.

Facebook’s Cambridge Analytica scandal revealed how 87 million user profiles were harvested and weaponised for political manipulation. Mark Zuckerberg stood before Congress and promised change. At the 2019 F8 Conference, he declared: “The future is private.”

Seven years later, Meta’s business model hasn’t fundamentally changed. Privacy remained a marketing slogan, not a product feature.

We’re Not Choosing This. We Have No Choice.

“In today’s digital economy, we have little choice but to use services at the expense of privacy.”

Want to apply for a job? You need a LinkedIn profile.

Want to communicate with colleagues? You need Slack, Teams, or email.

Want to run a business? You need cloud services, CRM tools, payment processors.

Want to participate in modern society? You need to hand over your data to third parties.

The 1979 Supreme Court ruling assumed voluntary exchange. But when every service requires you to “voluntarily” surrender your data just to function in society, is it really voluntary?

We’re not choosing between privacy and convenience. We’re choosing between privacy and participation.

The Economic Trap That Made This Inevitable

Here’s what most people don’t understand: This wasn’t always inevitable.

In the early 1990s, Tim Berners-Lee envisioned a different internet. One where users could make tiny payments for services - micropayments - instead of trading their privacy for “free” access.

He even reserved HTTP error code 402: “Payment Required.” It’s been sitting there, unused, for over 30 years.

Why didn’t micropayments happen?

Transaction fees destroyed the economics.

• Stripe charges 2.9% + €0.30 per transaction.

• PayPal charges 3.4% + €0.35.

• Adyen charges similar rates.

If you want to charge €0.05 per article, the payment processor charges €0.35 in fees. You lose money on every transaction.

So companies had two choices:

1. Charge enough to cover fees (minimum €5-10 transactions)

2. Make it “free” and sell user data instead

They chose #2. Not because they’re evil. Because the economics of payment processing made micropayments impossible.

And once they chose data-selling as the business model, the incentives changed forever. The more data they collect, the more valuable they become. The longer they keep you on the platform, the more they know. The harder it is to leave, the more locked-in you are.

Winner takes all. And the winners are the platforms, not the users.

The Lock-In Effect

Switching costs are massive when platforms own your data.

Try leaving Facebook. Your photos, your connections, your memories - locked in their system. Sure, you can “download your data,” but good luck importing it anywhere useful.

Try leaving Google. Your emails, your calendar, your documents, your entire digital life - built on their infrastructure.

Try leaving Apple’s ecosystem. Your photos, your messages, your purchases - designed to make leaving painful.

This isn’t by accident. Data ownership creates a competitive advantage. Not through better service, but through higher switching costs.

The platform that owns your data owns your lock-in.

Error 402: The Internet’s Most Forgotten Standard

Everyone knows Error 404: Page Not Found.

But Tim Berners-Lee predicted we would see Error 402: Payment Required just as often.

In 1992, when he designed the HTTP protocol that powers the web, he reserved error code 402 for your future digital payments. He envisioned an internet where users could pay tiny amounts - micropayments - for individual services, articles, videos, or features.

Pay €0.05 to read an article. Pay €0.50 to skip YouTube ads. Pay €0.0001 to send a message.

Instead of building your entire business on advertising and data collection, you could charge users directly. Tiny amounts. Friction-free. Voluntary.

It was a beautiful vision.

It never happened.

For 34 years, Error 402 has sat there, unused, waiting for technology to catch up to Tim’s vision.

What Micropayments Would Enable

Let’s be specific about what becomes possible when transaction fees drop to nearly zero.

The Free Washing Machine

A washing machine vendor offers you a deal: Take the machine for free. Pay €0.50 every time you press start.

Why would they do this?

• Upfront cost barrier gone: You don’t need €800 to buy a machine

• Predictable revenue: They earn money every wash cycle

• Maintenance included: If the machine breaks, they fix it (it’s their revenue source)

• Alignment of incentives: They want it to last forever, not break after warranty

This only works if charging €0.50 per use costs them nothing in fees.

The Journalist’s Tip Jar

You read an article that changed your thinking. You want to thank the author.

Pay €0.05 directly to the journalist.

Not to the platform. Not split with advertisers. Directly to the writer.

Multiply that by 10,000 readers, and a single article earns €500. Not from ads. Not from subscriptions. From readers who found value.

Website Uptime Monitoring

Your website needs to be monitored every 5 minutes. That’s 288 checks per day.

Pay €0.01 per check. €2.88 per day. €87 per month.

Or bundle it: subscribe to unlimited checks for €100/month.

The point isn’t which option is better. The point is, you have a choice when micropayments work.

Messaging Without Surveillance

WhatsApp is “free.” How does Facebook make money?

Your data.

But what if messaging worked differently? Pay €0.0001 per message. That’s €0.10 for 1,000 messages - maybe €1-2 per month for most users.

Split the revenue: half to the app developer, half to data centres covering infrastructure costs.

No ads. No tracking. No data mining. Just messaging.

The Creator Economy That Could Have Been

In 2026, the creator economy is massive. Billions flow through Patreon, Substack, YouTube memberships, OnlyFans, and TikTok creator funds.

But it’s built on platforms that take 30-50% cuts and control access to your audience.

Micropayments would have changed everything:

YouTube ad-free: Pay €0.10 per video to skip ads

• User pays €3-5/month for typical viewing

• Creator earns 10x more than ad revenue

• No tracking needed

Spotify without ads: Pay €0.005 per song

• User pays €5-10/month

• Artists earn directly per play

• No algorithmic gatekeepers

Newsletter tips: Pay €0.25 per post you love

• Readers reward value directly

• Writers aren’t forced into paywalls

• Quality content earns more

A McGuffin survey suggested YouTube could generate 2000% more revenue through subscription-based micropayment models compared to advertising.

But none of this works when transaction fees eat 30-40% of every payment.

What changed? Distributed infrastructure matured

For 30 years, Error 402 collected dust because payment processors made micropayments economically impossible.

So what changed?

Distributed infrastructure reduced transaction fees to near zero.

Not through traditional payment rails (Visa, Mastercard, PayPal).

Through a different architecture entirely. One where:

• No single company controls the payment network

• Transaction fees are fractions of a cent

• Micropayments finally make economic sense

• Data ownership can shift back to users

This is what Tim Berners-Lee envisioned in 1992. Technology finally caught up.

This infrastructure is a unique type of blockchain architecture. And it’s already running and ready to be used by my company mintBlue.

How It Works (Without the Jargon)

Here’s what most people don’t understand:

To be clear: this isn’t a cryptocurrency project. No tokens. No speculation. Just infrastructure. The underlying technology is decentralised, but the approach is engineering-first, not ideology-first.

The current internet is built on a client-server model:

• You (client) connect to Facebook’s servers

• Your data lives on their infrastructure

• They control access, rules, and pricing

• You have to trust them not to misuse it

This architecture creates power centralisation. Whoever owns the servers owns the data. Whoever owns the data owns the lock-in.

This compliance infrastructure flips this model:

• Distributed infrastructure where your data isn’t stored on a company’s servers - it’s stored on a network of independent data centers that compete to verify and host information.

Think of it like this:

• Current model: Your photos are on Google’s servers. Google controls them.

• New model: Your photos are stored across a group of independent data centres, free to participate. You control them. Companies can request access. You decide.

• No single company owns the infrastructure. No single company can manipulate, delete, or lock you in.

The Three Layers of Security

“But if my data is distributed across hundreds of places, isn’t that less secure?”

Actually, more secure. Here’s why:

Layer 1: Economic Competition Prevents Fraud

Data centres compete economically to verify uploads and store data.

If one data centre tries to upload false information or manipulate records, the others reject it. There’s an economic incentive to maintain integrity - data centres that cheat lose revenue.

This isn’t trust-based. It’s incentive-based. The architecture makes honesty more profitable than fraud, and their business model is completely separate from what they store/process, unlike with major cloud providers like Google.

Layer 2: Encryption Protects Storage

Standard database encryption protects your stored data. Cryptographic functions enable (multi-party) access control and blind verification, like zero-knowledge proofs, allowing you to prove certain information without revealing the raw data.

For example: ‘I paid for the potatoes I bought, without revealing how many potatoes I bought and what the price was’.

Layer 3: Data Fragmentation Makes Breaches Useless

Here’s the clever part:

Your data isn’t stored in a single file on a single server. It’s fragmented into hundreds of pieces, scattered across different data centres.

Even if a data centre is breached and attackers steal data, they get random fragments. Useless without the other 99 pieces stored elsewhere.

You need access credentials to reconstruct the complete file. Attackers don’t have that.

Internet Era vs. Data Sovereignty Era

Let’s make the comparison explicit:

The fundamental shift: Users become data controllers. Companies become service providers.

What This Enables

The Metanet makes three things possible that were impossible before:

1. Private Data Storage Under User Control

Your data lives on a distributed infrastructure you control. Companies request access. You decide permissions. You can revoke anytime.

This isn’t a privacy policy promise. It’s an architectural reality.

2. Digital Identity Without Surveillance

Prove who you are without revealing unnecessary information.

Need to prove you’re over 18? Share that fact—not your birthdate, address, or ID number.

Need to prove creditworthiness? Share your score—not your purchase history.

Biometric encryption makes this possible. You prove attributes without exposing the underlying data.

3. Business Models That Were Previously Impossible

When transaction fees drop to near-zero, business models that made no sense suddenly become viable:

• Pay-per-use washing machines

• Micropayment journalism

• Ad-free subscriptions at €0.10/video

• Direct creator payments at €0.05/post

Companies that couldn’t exist in a high-fee world can now compete.

Why Companies Would Participate

At the moment, organisations struggle with data controller issues. Privacy laws and technical standards make it hard for organisations to exchange data easily. Another significant problem is fraud due to operating with multiple unverified accounting books.

Free Flow of Data

The proposed solution: make the creator the data controller, not the organisation. This way, organisations can request access to read consumer data and data from other companies without actually owning it.

New Business Models

The main benefit of this open standard would be the creation of new business models. Innovative services we currently only see within ecosystem companies—like Alphabet’s integration of Android, YouTube, and Google—could become standard as data moves more freely between organisations (with user permission).

Reduce Fraud

Research shows organisations allocate around 2% of total revenue to fraud prevention. The Metanet solves this by enabling stakeholders to work in the same accounting system while maintaining privacy. You can’t falsify a record that hundreds of independent parties verify simultaneously.

Enterprise and Government Implications

For government and enterprise organisations, the implications go further. Immutable audit trails that satisfy regulators. Data sharing between agencies without surrendering control. Compliance-ready infrastructure where every action is verifiable, every record is timestamped, and every permission is logged.

Banks, regulators, and financial institutions can operate in shared accounting systems while each maintains sovereignty over their own data. Government agencies can collaborate across jurisdictions without creating new data silos or privacy risks. Supply chains can prove provenance without exposing competitive information.

This isn’t about replacing existing systems. It’s about adding a layer that enables multi-stakeholder collaboration without the trust issues that currently make it impractical.

The Vision Forward

Seven years ago, when I first wrote about data ownership and micropayments, it felt like a technical curiosity. An interesting idea for the future.

In 2026, it’s a geopolitical imperative.

Europe depends on US cloud infrastructure for 90% of its digital operations. Every European email, every business document, every government file, hosted on servers subject to the US CLOUD Act. No American company can guarantee that the US government won’t access your data. That’s not a conspiracy theory. It’s the law.

Think of distributed infrastructure like HTTPS didn’t replace HTTP, it added security. This technology adds data ownership. A sovereignty layer for the internet.

The question is no longer whether this technology works. It does. The question is whether Europe will build on it before the current crisis forces its hand.

The Choice Ahead

We’re at a crossroads, and for Europe, the stakes have never been higher.

In December 2025, the Trump administration threatened “every tool at its disposal” against EU tech regulation. Named European companies - Spotify, SAP, Siemens - as potential retaliation targets. Banned EU regulators from entering the United States.

The message is clear: digital dependence is political vulnerability.

Europe has two paths forward.

• Path one: Continue building on American platforms. Accept that 90% of your cloud infrastructure is subject to foreign law. Accept that trade negotiations can be weaponised against your digital economy. Accept that your citizens’ data is one executive order away from compromise.

• Path two: Build sovereign digital infrastructure. Not autarky, but sovereignty. As Gaia-X’s CTO puts it: “Sovereignty doesn’t mean you do everything yourself. It means for critical things, you have strategic options.”

Distributed infrastructure gives Europe those options. Data ownership enforced by architecture, not by policy promises that can be revoked. Micropayments that don’t flow through American payment processors. Digital identity that doesn’t depend on foreign gatekeepers.

For over 30 years, Error 402 sat unused in the HTTP protocol, waiting for technology to catch up to Tim Berners-Lee’s vision of an internet where users could pay directly rather than pay with their data.

Technology caught up.

The infrastructure exists. The economics work. The incentives finally align.

For Europe, this is no longer a theoretical debate about privacy or a technical discussion about transaction fees. It’s a question of strategic autonomy in an increasingly hostile digital landscape.

The 1979 Supreme Court ruling that opened this article was American law, applied to American citizens. But through the architecture of the internet we built, it became the de facto standard worldwide.

We can build a different architecture. We can choose different defaults.

The question for Europe is simple: Will you own your digital future, or will someone else?

FAQ

What is a distributed data infrastructure?

An architecture layer for the internet that enables tracking, monetizing, and controlling data in a peer-to-peer manner. Think of it as adding data ownership to the internet, the same way HTTPS added security.

Is this a cryptocurrency or blockchain project?

No. This uses distributed ledger technology, but it’s not a cryptocurrency project. No tokens, no speculation, no ideology. Just engineering-focused infrastructure for data ownership and micropayments.

How is this different from other decentralised projects?

Most decentralised projects focus on tokens and speculation. This approach focuses on practical infrastructure: micropayments that actually work, data ownership that’s architecturally enforced, and business models that don’t require surveillance.

What about European alternatives like Gaia-X?

Gaia-X is a governance framework. Important for setting standards and rules. But frameworks need infrastructure to run on. A distributed data infrastructure provides the technical layer that makes sovereignty architecturally enforceable, rather than policy-dependent.

How do micropayments work?

Transaction fees on distributed infrastructure are fractions of a cent, making it economically viable to charge tiny amounts (€0.01, €0.001, even smaller). This enables business models that were impossible when payment processors took €0.30+ per transaction.

Originally published December 2019. Updated January 2026.

Since this original post, I decided to help drive this change and built mintBlue, a data collaboration infrastructure. While we are still early, our technology is currently in use in the Enterprise and Government context, and we have not been able to truly drive adoption for consumer data ownership applications, but we won’t give up; this is too important.

Niels van den Bergh

The EU mandated Digital Product Passports. Simple enough on paper: every product needs lifecycle data aggregated from multiple suppliers across the value chain. Battery manufacturers, recyclers, logistics providers, retailers — all contributing to one unified record.

By 2027, this will affect an estimated 30+ product categories across the EU market. Batteries first. Then textiles. Then electronics. The list keeps growing.

There’s just one problem.

There’s no infrastructure to do this.

The Omnibus delays happened because vendors couldn’t deliver. Not because they lacked ambition or funding. Because the underlying infrastructure doesn’t exist, multiple organisations can’t easily write to shared registries that regulators can access.

Who’s going to fill this gap? And on whose terms?

Who controls the data of Product Passports?

This isn’t a DPP problem. It’s a systemic gap that shows up across every central compliance mandate:

ViDA (VAT in the Digital Age): Real-time invoice data from multiple processors, accessible to tax authorities across borders. What happens when your French supplier’s invoice system can’t talk to German tax authorities? Someone has to bridge that gap.

CSRD/CSDD: Sustainability data aggregated across entire supply chains — not just your operations, but your suppliers’ suppliers. Your Scope 3 emissions require verified data from dozens of partners, each running different systems. Good luck with that spreadsheet.

Real-time taxation: Transaction data flows to authorities in real time. The Dutch Tax Office is already piloting this—point-of-sale systems that calculate and transfer VAT in real time. It works. But it requires infrastructure that doesn’t exist at scale.

The common thread: multi-party data aggregation with auditability. Multiple organisations contribute data to shared registries that regulators (and sometimes consumers) can access.

Current infrastructure can’t do this. It wasn’t designed for cross-organisational data flows. And if we wait for the gap to become painful enough, we know who will fill it.

Your supply chain data is locked up in a platform

What do consultancies sell today for compliance?

SAP. Oracle. Microsoft Dynamics: platform solutions.

For single-company operations, platforms work fine. Your ERP handles your invoices. Your sustainability software tracks your emissions. Your product management system logs your inventory.

But DPP, ViDA, and CSRD don’t stay inside your walls. They require cross-organisational data flows - multiple suppliers, multiple systems, one coherent record.

Here’s where platforms break down:

Vendor lock-in. Your data lives in their system. Their database, schema, and access rules.

Single point of control. One vendor, one failure point, one set of terms that can change with their next board meeting.

Interoperability nightmare. Connecting Platform A to Platform B requires expensive custom integrations. Every new supply chain partner means another integration project.

Dependency. Switch costs are enormous once you’re in. They know this. Their business model depends on it.

Platforms weren’t designed for multi-party compliance. They were designed to keep you inside.

And here’s the risk nobody’s talking about: if Big Tech builds the compliance infrastructure, and they will try, platform lock-in will occur at the regulatory level. Your compliance data, supply chain records, tax information, and sustainability reporting are trapped in another walled garden.

Not because of technical necessity. Because of business models.

Platform vs. Protocol: The Difference That Matters

The distinction isn’t technical pedantry. It determines who controls your compliance infrastructure for the next decade.

• Platform Infrastructure

  • Data ownership: Vendor’s database

  • Switching cost: Expensive migration project

  • Interoperability: Custom integrations per partner

  • Who controls rules: Vendor/shareholders

  • New partner onboarding: Integration project

  • Regulator access: Negotiate with vendor

• Protocol Infrastructure:

  • Data ownership: Public registry you can access from anywhere

  • Switching cost: Change provider, keep your data

  • Interoperability: Built in by design

  • Who controls rules: Locked protocol — nobody

  • New partner onboarding: Already compatible

  • Regulator access: Direct registry access

The Protocol Alternative

What if the data layer were a shared protocol instead of a proprietary platform?

Think about email. Gmail, Outlook, and ProtonMail all use the same underlying protocol: SMTP. You can switch providers without losing your contacts. They compete on user experience, security features, and storage —not on holding your data hostage.

That’s possible because email is built on an open protocol that anyone can access.

Applied to compliance infrastructure:

• Shared registries for product data (DPP), invoice data (ViDA), and sustainability data (CSRD)

• - Multiple service providers can read and write to these registries

• - Data is portable by design

• - No single vendor controls the infrastructure

How it works in practice: a shared coordination layer acts as the registry — notarised, auditable, tamper-proof. Multiple providers can index and access the same data. The organisation retains ownership of its contributions.

Interoperability isn’t bolted on. It’s built in.

The result: switch providers without migration headaches. Regulators get the access they need without relying on a single vendor’s cooperation. Supply chain partners can collaborate without all using the same platform. Competition is driven by service quality, not data lock-in.

The protocol doesn’t care who you use to access it. It just works.

How to interface with this protocol?

Building on protocol infrastructure requires specialised knowledge that most enterprises don’t have — and shouldn’t need.

UTXO architecture and cryptographic primitives. Digital identity standards like eIDAS and GLEI. Data mapping and protocol standards. Stablecoin integration for value transfer. Compliance-specific data models that regulators actually accept.

The reality is simple: enterprises want to connect their supply and demand data to the registries required by regulators. They don’t want to become protocol engineers.

That’s where abstraction layers matter.

Think of how Stripe handles payments. You don’t integrate with Visa, Mastercard, or any individual bank. You integrate with Stripe once, and they hold the complexity. The payment network exists underneath. Stripe makes it accessible.

That’s what we’ve built at mintBlue. The protocol infrastructure exists. The complexity is objective. But enterprises need a layer that abstracts it—integrate once and access shared compliance registries.

Protocol infrastructure at scale isn’t theoretical. We’ve processed 50 million transactions in a single day on a decentralised infrastructure. The technology works.

The key difference from platforms: no lock-in. The protocol is public. You could build your own stack and still interoperate with everyone using the same registry. We make it easier.

Think of it like an ISP. We provide access to the network. We don’t own the network.

Auditability Without Surveillance

One underappreciated advantage of protocol infrastructure: built-in audit trails.

Every transaction and every data contribution is notarised in the shared registry. This enables:

Supply chain traceability. Trace faulty batches back to origin — critical for DPP compliance and recalls.

Compliance verification. Regulators can verify claims without needing full data access.

Accountability. Every claim can be traced to its source. No more “the data was lost in translation.”

Here’s the part that matters for competitive businesses: you can prove something happened without revealing everything. Verify a product’s journey without exposing supplier pricing. Confirm compliance without opening your books.

Privacy for businesses, transparency for oversight — not the other way around.

Platforms can’t offer this. They either share everything or nothing. Protocol infrastructure gives you granular control over what you prove versus what you disclose.

Independence, Not Sovereignty

This isn’t about Europe vs. America. It’s about independent infrastructure vs. dependent infrastructure.

Dependent:

• Your compliance data lives in a vendor’s cloud

• - Their terms, their jurisdiction, their business model

• - Switch costs keep you trapped

• - When they change, you change

Independent:

• Your compliance data lives on a public protocol

• - You choose your access provider

• - You can switch, you can self-host

• - The protocol doesn’t change based on shareholder meetings

For enterprises: resilience, optionality, negotiating power. You’re never stuck because the protocol doesn’t care about retention metrics.

For regulators: access without depending on a single vendor’s cooperation. No need to negotiate with Big Tech for visibility into your own economy.

For the ecosystem, innovation can happen at the application layer without permission from the infrastructure owner. Anyone can build. Anyone can compete.

The compliance mandates are coming regardless. The question is whether we build independent infrastructure now or accept dependent infrastructure later.

What’s Your Compliance Data Architecture?

If you’re facing DPP, ViDA, or CSRD compliance and wondering how to aggregate data across your supply chain without locking into a single vendor, this is worth a conversation.

Protocol-based infrastructure is a new territory for most consultancies. We’ve been building it for years.

What compliance mandate is forcing you to rethink your data architecture?

The challenge posed by the Dutch government

In late 2025, the Dutch Ministry of Justice and Security posed a simple question to innovators:

The scenario being, you are a police officer on the street and encounter someone without a passport or ID. How would you verify their identity?

Most teams relied on facial recognition, fingerprint scanning, and centralised databases. We asked ourselves a different question:

The answer is yes. But first: why does this matter?

Why biometrics is a problem

Minister Yesilgöz wrote in early 2023, in response to parliamentary questions:

“There are no legal possibilities to compel someone to disclose their identity.”

You are required to show your ID when asked by the police. But you cannot be compelled to disclose your identity. A fundamental distinction.

Biometrics breaks that principle. You can say “no” to a question. You cannot say “no” to your own face. Ella Jakubowska of EDRi warned that the new AI Act “could become a blueprint for mass biometric surveillance.”

The question became: can you identify someone in a way they can actually refuse?

Blind identity verification as a lightweight and flexible solution

The principle mintBlue proposes is simple: use existing data from existing systems, and validate only that someone is telling the truth, without ever seeing the data itself.

Hashing makes this possible. Every value, every word, every name, every address, is translated into a unique code of 64 characters. Change one letter? Completely different code. And crucially, you cannot reverse-engineer the original value from the code.

In practice, this means you can verify that someone said “Niels” without ever seeing the word “Niels”. A computer matches codes; no heavy computing required.

This, for example, is the hash of ‘Niels’ using SHA-256:
3717208d4b067d2644265f24225337e69d72a71f78e4761045a507a7593c6607

Any computer in the world can independently verify mathematically that this is the hash of Niels! Pretty cool!

How blind identity verification works in practice

Imagine: a police officer stops someone who doesn’t have an ID card. Instead of biometrics, the person is given a device that prompts them with questions: first name, surname, postcode, pharmacy, GP, perhaps the name of a pet.

It resembles the security questions you use when you reset your password, but there is one fundamental difference. With Google, Google knows the answer; you are not the owner of that data. In this system, only you and the source see the answer.

The pharmacy knows your pharmacy. The municipality knows your address. But nobody has a central database with all that information combined.

The person provides what they choose to share voluntarily. Don’t want to share your pharmacy? Fine, skip it, provide something else. Each answer is hashed and matched against the existing sources. A match means “this is correct.” No match means “this is incorrect.” The police never see the actual values; only ticks or crosses.

With enough matches, you achieve probabilistic certainty. Just “Niels” alone is weak; many people share that name. But “Niels” plus “Van den Bergh” plus a specific pharmacy plus a specific postcode? That combination is virtually unique. With five correct answers, you typically reach over 99% certainty, comparable to fingerprint matching, but without the privacy intrusion.

The trade-off with this approach

We have to be honest about the limitations. This system doesn’t work for everyone. Homeless people don’t have a regular pharmacy. People who have just moved may have outdated data. Tourists aren’t in Dutch systems. There will always be situations where this isn’t the solution.

But that’s precisely the point. No system works for everyone. The question isn’t which system is perfect, but which system we want to build as the default.

An alternative to large-scale data scraping

This is about more than just identification. It’s about a fundamental choice we make as a society, often without realising it.

In the physical world, we have invested centuries in the separation of powers. Legislative, executive, and judicial branches; separated, balanced, and held in check.

Nobody holds absolute power. Enforcement operates reactively: first, something happens; then investigation follows; then a warrant; then, potentially, action.

In the digital world, systems are built on the premise of proactive enforcement. That collects everything, in case it might be useful someday. That predicts who might do what. Surveillance infrastructure is built under the banner of “digitalisation.”

We propose the opposite: digitalisation, premised on retroactive enforcement under the division of powers.

Whether we need digital identification is not the question. The question is: do we build it in a way that respects the same principles we have established in the physical world?

---

This proposal is now with the Dutch Ministry of Justice and Security. Whether there will be a pilot remains to be seen.

But the discussion extends beyond a single pilot. If you work on similar challenges in digital infrastructure and privacy, or if you know organisations that are seriously considering this, I’d love to hear from you. This is a conversation we need to have more broadly.