Why this directory exists
Rights language becomes more durable when systems can implement data minimization, unlinkability, strong authentication, private transport, and secure group communication as technical properties rather than promises alone.
Verified starting points
RFC 9458 · Oblivious HTTP
Forwards encrypted HTTP messages so an origin cannot directly link requests to the client.
RFC Editor identifies RFC 9458 as Standards Track and Proposed Standard.
Point-in-time primary-source maintenance classification only. It does not certify adoption, conformance, security, privacy, legal compliance, support duration, or suitability for a particular deployment.
Review record
- Reviewed
- 2026-09-04
- Next review
- 2027-03-04
- State
- reviewed_primary
Observed: RFC 9458 remains an Internet Standards Track Proposed Standard. The primary record describes Oblivious HTTP and its separation of client identity from encrypted request content through a relay and gateway architecture.
Limit: Standards status does not prove deployment, implementation quality, immunity from metadata analysis, resistance to colluding parties, or suitability for a particular threat model.
Report basis: Cognitive Liberty Privacy Directory.md#technical-standards-ecosystem-fifty-definitive-specifications
RFC 9576 · Privacy Pass Architecture
Architecture for authorization based on privacy-preserving authentication mechanisms.
RFC Editor identifies RFC 9576 as an Informational RFC defining the Privacy Pass architecture.
Point-in-time primary-source maintenance classification only. It does not certify adoption, conformance, security, privacy, legal compliance, support duration, or suitability for a particular deployment.
Review record
- Reviewed
- 2026-09-04
- Next review
- 2027-03-04
- State
- reviewed_primary
Observed: RFC 9576 remains an Informational RFC defining the Privacy Pass architecture for privacy-preserving authorization and authentication mechanisms.
Limit: The architecture is not an Internet Standards Track specification and does not make every token, issuer, verifier, browser, or service deployment unlinkable or privacy-preserving.
Report basis: Cognitive Liberty Privacy Directory.md#technical-standards-ecosystem-fifty-definitive-specifications
RFC 7258 · Pervasive Monitoring Is an Attack
Engineering guidance treating pervasive monitoring as an attack to be mitigated in protocol design.
RFC Editor identifies RFC 7258 as Best Current Practice 72 addressing pervasive monitoring.
Point-in-time primary-source maintenance classification only. It does not certify adoption, conformance, security, privacy, legal compliance, support duration, or suitability for a particular deployment.
Review record
- Reviewed
- 2026-09-04
- Next review
- 2027-03-04
- State
- reviewed_primary
Observed: RFC 7258 remains a Best Current Practice that treats pervasive monitoring as an attack and directs protocol designers to mitigate it where possible.
Limit: The document is engineering guidance, not proof that a product resists surveillance, not a universal security guarantee, and not legal advice for a particular jurisdiction.
Report basis: Cognitive Liberty Privacy Directory.md#technical-standards-ecosystem-fifty-definitive-specifications
RFC 8890 · The Internet is for End Users
Guidance that protocol and standards decisions should prioritize the interests of end users.
RFC Editor identifies RFC 8890 as Informational and not an Internet Standards Track specification.
Point-in-time primary-source maintenance classification only. It does not certify adoption, conformance, security, privacy, legal compliance, support duration, or suitability for a particular deployment.
Review record
- Reviewed
- 2026-09-04
- Next review
- 2027-03-04
- State
- reviewed_primary
Observed: RFC 8890 remains an Informational RFC stating the architectural principle that the Internet is for end users and that standards decisions should consider their interests.
Limit: This architectural principle is not a conformance certification, enforceable legal rule, or proof that any protocol, provider, or institution actually prioritizes end users.
Report basis: Cognitive Liberty Privacy Directory.md#technical-standards-ecosystem-fifty-definitive-specifications
RFC 9420 · Messaging Layer Security
Efficient asynchronous group key establishment with forward secrecy and post-compromise security.
RFC Editor identifies RFC 9420 as Standards Track and Proposed Standard.
Point-in-time primary-source maintenance classification only. It does not certify adoption, conformance, security, privacy, legal compliance, support duration, or suitability for a particular deployment.
Review record
- Reviewed
- 2026-09-04
- Next review
- 2027-03-04
- State
- reviewed_primary
Observed: RFC 9420 remains an Internet Standards Track Proposed Standard defining Messaging Layer Security for efficient asynchronous group key establishment with forward secrecy and post-compromise security goals.
Limit: The specification does not prove a messaging product implements MLS correctly, protects endpoint data, hides metadata, or satisfies every operational and adversarial requirement.
Report basis: Cognitive Liberty Privacy Directory.md#technical-standards-ecosystem-fifty-definitive-specifications
RFC 9230 · Oblivious DNS over HTTPS
Separates client identity from DNS query content through oblivious relay architecture.
RFC Editor identifies RFC 9230 as Experimental; v1.16.0 corrects the previous Standards Track label.
Point-in-time primary-source maintenance classification only. It does not certify adoption, conformance, security, privacy, legal compliance, support duration, or suitability for a particular deployment.
Review record
- Reviewed
- 2026-09-04
- Next review
- 2027-03-04
- State
- reviewed_primary
Observed: RFC 9230 is an Experimental RFC for Oblivious DNS over HTTPS. The v1.16.0 review corrects the prior directory label that described it as Internet Standards Track.
Limit: Experimental publication status does not itself establish deployment readiness, operational adoption, privacy against all intermediaries, or fitness for any particular production environment.
Report basis: Cognitive Liberty Privacy Directory.md#technical-standards-ecosystem-fifty-definitive-specifications
W3C Verifiable Credentials Data Model 2.0
Extensible data model for tamper-evident, machine-verifiable credentials with explicit privacy considerations.
W3C identifies Verifiable Credentials Data Model v2.0 as a Recommendation dated 15 May 2025.
Lifecycle relation: Successor To
Point-in-time primary-source maintenance classification only. It does not certify adoption, conformance, security, privacy, legal compliance, support duration, or suitability for a particular deployment.
Review record
- Reviewed
- 2026-09-04
- Next review
- 2027-03-04
- State
- reviewed_primary
Observed: Verifiable Credentials Data Model v2.0 remains a W3C Recommendation dated 15 May 2025 and supplies a current data-model basis for verifiable credentials.
Limit: The data model alone does not guarantee selective disclosure, unlinkability, minimization, holder control, or privacy; those properties depend on formats, cryptosuites, wallets, and deployment policy.
Report basis: Cognitive Liberty Privacy Directory.md#technical-standards-ecosystem-fifty-definitive-specifications
W3C Web Authentication Level 3
Public-key credential API for strong, origin-bound authentication without shared-password reuse.
W3C publishes Web Authentication Level 3 as a Recommendation dated 25 August 2026, identifies it as the Level 3 successor to WebAuthn Level 2, and links an implementation report from the Recommendation record.
Lifecycle relation: Supersedes
Point-in-time primary-source maintenance classification only. It does not certify adoption, conformance, security, privacy, legal compliance, support duration, or suitability for a particular deployment.
Review record
- Reviewed
- 2026-09-04
- Next review
- 2027-03-04
- State
- reviewed_primary
Observed: W3C publishes Web Authentication Level 3 as a Recommendation dated 25 August 2026, identifies it as the Level 3 successor to WebAuthn Level 2, and links an implementation report from the Recommendation record.
Limit: Recommendation and implementation-report availability do not prove universal support, correct relying-party configuration, accessibility in every flow, resistance to every attack, or suitability for anonymous inquiry.
Report basis: Cognitive Liberty Privacy Directory.md#technical-standards-ecosystem-fifty-definitive-specifications
NIST Privacy Framework
Voluntary tool for identifying and managing privacy risk while developing products and services.
NIST describes the Privacy Framework as a voluntary privacy-risk management tool and currently presents Privacy Framework 1.1 Initial Public Draft resources, including a mapping from the PF 1.0 Core to the PF 1.1 Core.
Lifecycle relation: Revision In Development
Point-in-time primary-source maintenance classification only. It does not certify adoption, conformance, security, privacy, legal compliance, support duration, or suitability for a particular deployment.
Review record
- Reviewed
- 2026-09-04
- Next review
- 2027-03-04
- State
- reviewed_primary
Observed: NIST describes the Privacy Framework as a voluntary privacy-risk management tool and currently presents Privacy Framework 1.1 Initial Public Draft resources, including a mapping from the PF 1.0 Core to the PF 1.1 Core.
Limit: The page does not make the Initial Public Draft a final publication, certify any deployment, establish legal compliance, or prove that an organization protects cognitive liberty or implements effective controls.
Report basis: Cognitive Liberty Privacy Directory.md#technical-standards-ecosystem-fifty-definitive-specifications
NIST SP 800-63-4 · Digital Identity Guidelines
Technical guidelines for identity proofing, authentication, federation, and related assertions.
NIST identifies SP 800-63-4 as final in July 2025 and as superseding SP 800-63-3.
Lifecycle relation: Supersedes
Point-in-time primary-source maintenance classification only. It does not certify adoption, conformance, security, privacy, legal compliance, support duration, or suitability for a particular deployment.
Review record
- Reviewed
- 2026-09-04
- Next review
- 2027-03-04
- State
- reviewed_primary
Observed: NIST SP 800-63-4 is a final Special Publication dated July 2025. The primary publication record states that it supersedes NIST SP 800-63-3.
Limit: Final publication status does not establish that a deployment conforms, that identity proofing is necessary for a given use, or that the guidance alone protects anonymous or private inquiry.
Report basis: Cognitive Liberty Privacy Directory.md#technical-standards-ecosystem-fifty-definitive-specifications
A directory is only useful if it can admit uncertainty and age.
Every stable record has a review date, next-review date, source basis, verification state, and limitation. Standards and technical projects also carry point-in-time lifecycle and supersession records. A stale, superseded, maintenance-only, transitioning, or unreachable resource should be marked accordingly rather than silently presented as unchanged.