In this instance, private means control over one’s identity, data, and its permissioning (when it is shared and with whom). This kind of control has never truly existed in the Web2 era. Data ownership is relegated to the likes of corporations and governments, not users. In fact, data monopolies like Meta build moats around their data arsenals. They then extract value from these data arsenals – in the case of Meta, to the tune of 117 billion dollars, 98 percent of which is generated by identity-driven targeted advertising – and bury the ability to opt-out of commercialized third-party data sharing or rationalize exceptions through the T&Cs. From the onset, Web2 has never conceptualized data as an extension of users’ identities, but instead as a means to generate revenue or fees to export identity credentials (think of the costs associated with sending transcripts and test scores or renewing a passport, for example).

A portable identity is one where the underlying data is both accessible to the identity holder across several mediums and easily shared to relevant third-parties. Portability implies customer-centric design, a value not currently practiced by the architects of Web2. Because data resides in the centralized databases of each institution, users are at their mercy for data transfer. In contexts where institutions have invested little in bureaucratic digitization, like many healthcare or local government providers, data disclosure to third-parties is a particularly painful process. On the other hand, digitization is also no panacea. Even though regulations like GDPR and CCPA specify that exported personal data must be ‘useable’ in a structured and machine readable format, the downloaded files often resemble something out of a data dump hellscape. The threshold for regulatory approval over data usability is clearly a subjective and low-bar. For user approved third-parties looking to tease out the relevant identity information, data cleaning and engineering is necessary.

When an individual’s identity is persistent, it exists indefinitely beyond the confines of the institutions that may have originally captured or credentialed that identity data. Lack of persistence is a problem that plagues identity management systems in general and has been replicated in Web2. If my credit card provider closes shop tomorrow, I lose my credit and account transaction history (ironically, some data would be salvaged and live on through the credit bureaus, but I would have little recourse to amend or correct it). If my country collapses or descends into civil war, I would need to register for a new sovereign identity with the UNHCR upon escape. And while Web2 may only reproduce existing issues around identity persistence, the more important takeaway is that centralized internet cannot fundamentally fix it (more on this later).

An identity qualifies as personal if it is unique to the identity holder. Due to the siloed nature of Web2, many identity profiles cannot claim to be truly unique (although they will have a unique identifier, like an email or account number, to help facilitate authorization and access rights). With financial identity in the United States, for example, so hinged on Social Security numbers, data leaks of the magnitude of the Equifax hack have unleashed rampant identity fraud. Social engineering and phishing, meanwhile, usually entail some form of identity imitation, with social media data or other personal information repurposed. However, if all of these profiles existed in one place at the user level, it would be much easier for users to differentiate and distinguish themselves as the ‘unique’ identity. This is in harsh contrast to the current paradigm, where impersonators only need specific datasets to achieve their ends.

Now, astute readers might ask, do we need to migrate to a decentralized, permissionless, and trustless internet in order to reform identity and better align its application with the four Ps? Many industry stakeholders, including the Digital Identity Alliance, might argue no – in fact, there are members of its coalition that are incentivized to marginally improve identity without truly disrupting the underbelly of the data-sharing economy. But, I intentionally zeroed in the four Ps to illustrate the limitations of such improvements even against the backdrop of a Web2 friendly framework (versus that of SSI), and that, inevitably, we will hit walls that I believe only Web3 can tear down.

Most of the innovation in Web2 centers around portability, specifically around the introduction of centralized or federated identity management systems. In a centralized identity system, one identity provider – commonly a government agency – oversees identity data and user authentication. This centralized database is accessible to permissioned relying parties, who receive the underlying data attributes from the centralized identity provider. A federated identity, alternatively, is comprised of a consortium of industry-specific identity providers who enroll users and acquire akin identity data. The final repository of identity information is usually aggregated in one database. This consortium can then authenticate users and transfer data attributes to desired relying parties. (As a side note, federated authentication services are different from authorization for service provision. In many federated identity models, users can access the services of the consortium after his or her on-boarding with one partnering institution.)