Eog Based Human Computer Interface

Abstract

Digital rights increasingly exist in law but remain difficult to exercise through the information systems that mediate them. Using disciplined conceptual synthesis and problematization, this critical-conceptual IS paper explains the gap through the interaction of legal heterogeneity, conflicting organizational and commercial incentives, fragmented architectures, and asymmetrical control over rights-relevant acts. It then theorizes a human-compatible rights layer: a governed sociotechnical capability for

Plural

communication of requests, consent, refusal, withdrawal, objection, records, and support. Comparing California-style opt-out signals, the EU's mixed lawful-basis regime, and P3P, DNT, GPC, and ADPC, the paper derives seven normative requirements, develops rights by architecture as a bounded emancipatory policy argument, and treats a proposed GDPR provision on automated and machine-readable privacy management as a policy case for moving from banner-based compliance toward rights-supporting digital infrastructure.

Keywords: Digital protection, rights by architecture, human-compatible information systems,

Introduction

The internet is often narrated as an engineering triumph: a layered, interoperable network that made communication cheap, scalable, and generative. That story is accurate but incomplete. The same architecture that enabled permissionless innovation did not provide a native, institutionally complete capability through which people could express, remember, withdraw, delegate, or contest rights-relevant choices in a reliable way. Privacy, consent, objection, and other rights were therefore externalized to websites, platforms, browsers, and later consent-management vendors. The result is familiar to almost every internet user: repeated banners, opaque privacy policies, asymmetric buttons, fragmented records, and a persistent gap between formal rights and practical control (Acquisti et al. 2015; Nouwens et al. 2020; Solove 2013; Utz et al. 2019).

This paper advances a policy and regulation argument for information systems (IS): digital rights must be embedded in internet and software architecture, not merely declared in statutes or delegated to service- specific interfaces. A rights layer should enable standardized, machine-readable, bidirectional, and jurisdictionally plural communication among data subjects, controllers, processors, user agents, trusted intermediaries, and regulators without deciding substantive law. Architecture cannot generate political will, honest implementation, adjudication, or sanctions. It can redistribute initiation, representation, memory,

2

limited evidence, coordination, and observability away from controller-controlled channels; law and institutions determine when communicated acts bind and what follows from obstruction. The policy problem has become acute because major jurisdictions follow different logics. California and several other United States privacy frameworks are primarily associated with opt-out rights such as refusing Control (GPC) as a user-enabled “opt-out preference signal” that covered businesses must honor as a request to opt out of the sale or sharing of personal information, and the W3C GPC draft defines a signal for requesting that websites and services not sell or share personal information with third parties (California combines multiple lawful bases under the General Data Protection Regulation (GDPR), including consent, contract, legal obligation, public tasks, and legitimate interests, with withdrawal and objection rights (GDPR arts. 6, 7, and 21); ePrivacy Directive art. 5(3), as amended, requires consent for storing or accessing information on terminal equipment unless an exception applies (Hoofnagle et al. 2019). The EU is therefore not a simple opt-in order, but it is certainly not reducible to a binary opt-out order.

This difference matters because digital architecture travels. Browser vendors, large platforms, advertising infrastructures, and standardization bodies can make one jurisdiction's technical grammar appear natural everywhere else. If a signal designed around California's opt-out logic becomes the default template for ‘global’ privacy communication, other legal orders may be forced to adapt their rights to a thinner technical form. This is not a problem with GPC itself. GPC is a noteworthy advance within the legal setting it was designed to serve. The danger is jurisdictional overreach through infrastructure: a binary signal that fits one law may become, through platform power and convenience, the practical boundary of rights in very different legal systems.

The European Commission's Digital Omnibus proposal (COM(2025) 837 final; 2025/0360(COD)) placed that architectural possibility on the legislative agenda through a proposed GDPR provision initially numbered Article 88b. Its significance here lies in the design problem it exposes, not in the provision's eventual numbering, wording, or legal fate. The proposal would require online interfaces to support automated and machine-readable indications of consent, refusal, and objection. The European Data Protection Board (EDPB) and European Data Protection Supervisor (EDPS) support addressing consent fatigue through machine-readable choices while recommending legal and technical clarifications and safeguards (EDPB and EDPS 2026). A rights-first and law-first implementation through a mechanism such as Advanced Digital Protection Control (ADPC) could help move online privacy from repetitive notice-and- click rituals toward a genuine rights communication infrastructure (Human 2026).

The primary research question is: What explains the persistent gap between formally recognized [digital] rights and their practical exercisability when those rights are mediated through information systems under heterogeneous regulatory regimes? The secondary research question is: What normative requirements follow from this explanation for a human-compatible sociotechnical response that narrows the gap while preserving legal plurality and avoiding solutions that entrench controller power or merely shift it to client-side intermediaries? Privacy and data protection provide the developed EU–California and Article 88b/ADPC case; the framework may extend to other rights with context-specific adaptation.

Contributions are (1) a relational critical explanation of how legal heterogeneity, incentives, sociotechnical mediation, and uneven institutional capacity allocate power and reproduce the gap; (2) the governed rights- layer capability and its redistribution-or-reproduction mechanism; and (3) seven normative requirements (NR1–NR7). Operations and the lifecycle test coherence; empirical and design evaluation forms the natural next stage, building on the critical IS account and normative requirements developed here.

Research Approach And Critical Is Contribution

This critical-conceptual IS policy inquiry examines how digital systems shape rights exercisability. It rests on the normative position that people should be able to exercise, understand, remember, delegate, withdraw, and contest rights in digital contexts through channels not controlled exclusively by actors with conflicting interests. Following Myers and Klein (2011), critical IS governs the inquiry; privacy theory addresses subject formation, information-infrastructure and internet-governance research address evolution and contestation, and bounded sociomateriality addresses enactment. This consequential problem framing and visible contribution follow IS guidance (Gupta 2018; Rai 2017).

3

The inquiry joins critique to a bounded transformative orientation. Its critical concepts are rights exercisability and procedural, epistemic, and infrastructural power: who can enact formal entitlements, control rights-relevant acts, define and retain categories and evidence, and set participation conditions.

They challenge controller-controlled banners and isolated clicks as adequate enactments of rights, drawing on accounts of code, infrastructure, surveillance capitalism, and data colonialism (Couldry and Mejias 2019; DeNardis 2012; Lessig 1999; Zuboff 2015). Accordingly, emancipation means strengthening people’s capacity to express, remember, withdraw, delegate, and contest rights; technology alone is insufficient. This requires reform across law, standards, organizational routines, user-side systems, oversight, and remedies.

Scholarly, legal, and standards materials were selected purposively for relevance to rights exercisability, jurisdictional variation, protocol and standards history, and IS theories of critique, infrastructure, and governance. Six linked steps were followed: (1) frame the phenomenon as a failure of rights exercise rather than banner usability; (2) state the normative position and challenged practice; (3) map peer-reviewed research against primary legal and standards documents; (4) compare California opt-out, the EU's mixed lawful-basis regime, and broader plurality; (5) reconstruct P3P, DNT, GPC, and ADPC sociotechnically and examine DPV and ODRL as complementary installed-base resources; and (6) combine the critical concepts with infrastructure and internet-governance theory to explain the gap (RQ1) and derive the capability, NR1–NR7, risks, and evaluation paths (RQ2). The traceable hierarchy is evidence and theory → diagnosis → explicit critical or normative inference (meta-requirement) → NR1–NR7 → illustrative operation → future implementation feature. Synthesis and problematization operate as methods within the critical inquiry (Alvesson and Sandberg 2011; Jaakkola 2020).

Rigor is pursued through visible values, conceptual consistency, evidentiary fit, power disclosure, inclusion, reflexivity, practical consequence, and explicit failure conditions. Interacting mechanisms, not universal effects, are identified. Peer-reviewed research supports empirical claims and primary legal or standards materials support institutional claims; clarity, scope, coherence, boundedness, and generativity assess conceptual adequacy (Gregor 2006; Gupta 2018; Whetten 1989). The mainly EU–California machine- readable case may underrepresent rights, practices, and communities outside those regimes or resistant to codification. The proposition and requirements remain fallible and contestable through empirical inquiry, institutional experience, and evaluation by affected communities.

Infrastructure

The gap persists when heterogeneous entitlements lack interoperable channels; controllers and client providers have incentives to retain control; fragmented interfaces, standards, records, and workflows asymmetrically allocate initiation, representation, memory, evidence, and contestation; inaccessible channels externalize cognitive and social burdens; and weak integration, oversight, or consequence makes obstruction cheap and opaque. Privacy, the developed case, is relational: autonomy and subject formation depend on institutional and operational conditions, not isolated choices (Cohen 2000, 2019). These relations allocate procedural power over action, epistemic power over categories and records, and infrastructural power over participation (Cecez-Kecmanovic et al. 2014; DeNardis 2012). A rights layer has bounded emancipatory potential to redistribute initiation, representation, memory, limited evidence, coordination, and observability. Yet power can reappear in client defaults, controller workflows, standards, or investigation. Architecture makes exercise and obstruction communicable; law and institutions supply recognition, adjudication, and consequence. Bounded sociomateriality clarifies these relations (Rieskamp 2026), and this conditional redistribution-or-reproduction mechanism generates the governed capability below.

Internet governance likewise shows that code, markets, law, norms, and standards interact and that standards are sites of political struggle (DeNardis 2012; Lessig 1999). The TCP/IP reference model distinguishes application, transport, internet, and link functions, although protocols interact and functions may span layers (Braden 1989). Routing and naming are therefore treated as protocol-enabled functions and security as cross-cutting, not as separate layers. ‘Rights layer’ is an analytical and architectural concept for this governed capability, not a protocol-stack stratum. Although HTTP is stateless (Fielding et al. 2022), rights-related state can be maintained through linked messages, identifiers, acknowledgements, receipts, client records, and organizational workflows; their fragmentation is part of the problem. Existing standards make some policy and rights communication machine-readable, but no unified, broadly adopted,

4

institutionally complete capability connects legally plural semantics, client-controller exchange, durable state, organizational handling, oversight, and remedy. More globally accepted arrangements may evolve; this analysis identifies what they must connect.

An information infrastructure is a shared, open, heterogeneous, evolving, recursively composed sociotechnical system of digital capabilities under distributed and emergent control (Hanseth and Lyytinen 2010). Within it, a rights layer is a focal governed sociotechnical capability for representing, communicating, retaining, updating, and contesting rights-relevant acts across services and regimes. The unit of analysis is this capability, produced by interoperable vocabularies and protocols; clients and trusted intermediaries; controller and processor systems; rights records and organizational routines; standards governance; oversight; and complaint channels. No actor owns it. Authorities establish or interpret rights and recognition duties; standards bodies steward semantics and profiles; clients, intermediaries, controllers, and processors implement components; independent bodies test conformance; civil society monitors; and regulators and courts investigate, adjudicate, enforce, and provide remedies. Any protocol, client, interface, record system, or process is only a component. The capability supplies interoperable conventions for choices, requests, reasons, acknowledgements, records, withdrawals, objections, and contestation; substantive law supplies the communicated rights and duties.

This framing clarifies the limits of privacy by design: GDPR art. 25 places duties principally on controllers but does not specify interoperable user-side rights channels. IS control and platform research shows that configured controls differ from enactment and that architecture and governance allocate decision rights (Tiwana et al. 2010; Wiener et al. 2016). The narrower contribution is whether a person or authorized agent can initiate and retain a legally situated act outside a duty-bearer's interface. Initiation, presentation, assistance, preference storage, and limited evidence may shift; processing control, legal effect, adjudication, and remedy do not, and clients or intermediaries may capture the shifted capacity. Privacy-enhancing technologies provide counter-power through prevention, minimization, blocking, and anonymity (Heurix et al. 2015), while intermediaries and assistants support decisions (Human, Alt, et al. 2022; Lehtiniemi and Kortesniemi 2017). A rights layer complements them through bidirectional communication of legally situated acts across services without substituting for controller duties, PETs, law, or enforcement.

‘Digital’ protection broadens the frame beyond ‘data’ protection, which remains central. Digital harms concern agency, manipulation, discrimination, collective autonomy, and democratic resilience: surveillance capitalism, hypernudging, and AI-enabled persuasion use data to shape attention, choice, and behavior (Susser et al. 2019; Yeung 2017; Zuboff 2015), while generative AI scales hyper-personalized and potentially epistemically invasive persuasion (LeBrun 2025). Do-not-sell/share categories—as exemplified by GPC— are therefore important but insufficient where harms arise from first-party processing, inference, and behavioral modulation without third-party transfer. Digital protection asks how environments can remain compatible with human rights, dignity, agency, and social sustainability. Privacy and data protection provide the developed case, not the boundary, of the rights-by-architecture claim. Generative AI, autonomous agents, robotics, other automated systems, IoT, and immersive technologies distribute rights- relevant interactions across physical and digital settings, showing why the capability must evolve beyond browsers, screens, and privacy (Hanseth and Lyytinen 2010; LeBrun 2025; Zheng et al. 2018).

Why Notice-And-Choice Keeps Failing

The notice-and-choice model assumes that individuals can evaluate information, form preferences, express decisions, and later revise them. The empirical record repeatedly undermines that assumption. Privacy policies are often long, complex, unread, or poorly understood (Obar and Oeldorf-Hirsch 2020). Consent banners can use salience, defaults, asymmetry, hidden settings, and other dark patterns to steer acceptance (Gray et al. 2021; Nouwens et al. 2020); large-scale evidence from commercial interfaces shows that such steering techniques extend beyond banners (Mathur et al. 2019). Even without overt manipulation, repeated, context-dependent choices tax attention and weaken meaningful engagement (Acquisti et al.

2015; Utz et al. 2019). The deeper issue is not that users do not care about privacy. The privacy paradox is often misread as indifference, but more careful analysis shows that constrained contexts, limited alternatives, social pressures, and cognitive burdens shape behavior (Solove 2021). In other words, observed clicks are poor evidence of unconstrained preference. A system that asks individuals to repeatedly manage complex legal

5

and technical trade-offs without durable memory, human support, user-side assistance, or usable records is not empowering them; it is outsourcing systemic complexity to the least resourced actor in the chain. The current model also fails temporally. Consent, refusal, withdrawal, and objection are continuing relations. A person may lack a portable, intelligible record or cross-service view of what was communicated, to whom, under which description, and when. GDPR art. 7(3) recognizes withdrawal and requires it to be as easy as giving consent, but rights remain difficult to manage when exercise is distributed across service- specific channels (Solove 2013). The paper therefore diagnoses an evidentiary asymmetry wherever a duty- bearer retains the operative state while the person lacks a corresponding record across services, devices, and time.

The model fails collectively as well. Privacy decisions can affect other people, as when contact lists, group photographs, household sensor data, or genetic information reveal facts about relatives, friends, coworkers, or communities (Human 2024). Children require support, not solitary legal clicking, and online data privacy can be understood as part of children's media rights (Brown and Pecora 2014). Privacy, in these contexts, is not only individual self-management but relational and collective protection (Nissenbaum 2004; Human 2024). A rights layer should therefore allow trusted assistance and delegated or guardian- mediated support without turning that support into a new surveillance channel.

Finally, screen-only, controller-specific mechanisms can be insufficient in repeated, ambient, inaccessible, cross-device, or cross-service settings. Smart-home IoT devices can make data practices and privacy risks difficult to observe or verify (Zheng et al. 2018). The same interface limitation can arise in mixed-reality environments, robots, smart vehicles, wearables, and agentic AI systems, where a banner may be unusable.

Machine-readable communication is one proposed support for such settings, not a universal replacement for intelligible and accessible human-facing interaction. Digital regulation cannot depend exclusively on an interface pattern that already fails on ordinary websites.

Jurisdictional Mismatch: Opt-Out Signals and Mixed Rights Orders selling-or-sharing switch that covered businesses must honor as a valid opt-out request (California and can spare people repeated site-by-site expression of the same recognized choice.

The EU grammar is richer. GDPR arts. 6, 9, and 21 combine multiple lawful bases, special-category protections, and context-dependent objection rights; ePrivacy Directive art. 5(3) generally requires consent for terminal-equipment access. Under GDPR arts. 4(11) and 7(3), consent must be freely given, specific, informed, and unambiguous, and as easy to withdraw as to give (European Data Protection Board 2020).

One binary global signal cannot represent this grammar without loss. Table 1. Jurisdictional Logic and Communication Requirements

Do Not Sell/Share Personal

information.

Signal Can Be Effective When

legally enforced.

Reduce Richer Rights To A

binary refusal.

Depending On Legal Basis And

purpose.

Auditable Communication Is

needed.

Acts Or Lawful-Basis

plurality.

Heightened Protection, And

limits on profiling.

Accessibility, And Contextual

rules must be expressible.

Ignore Vulnerability And

social support.

Explanation, And Ambient

sensing.

Machine-Readable Rights Acts

are needed.

Become Obsolete Or

misleading. This difference shapes what a rights layer must communicate. A California opt-out can express no sale or sharing; an EU channel may need to carry a purpose-specific consent request, another lawful basis, refusal

6

or objection, and evidence of later withdrawal. That requires vocabulary, context, bidirectionality, and records. A binary signal can be one message within the layer, not the layer itself. Technology concentration amplifies the mismatch. A few dominant firms shape browsers, advertising systems, app ecosystems, and cloud infrastructure; standardization thus becomes a tussle in which architecture advances interests (Clark et al. 2005). Letting the easiest technical solution define rights can weaken legal plurality through protocol design rather than formal repeal.

This creates a risk of jurisdictional digital imperialism: infrastructures can extend asymmetrical power through extraction, dependency, and externally defined technical orders (Couldry and Mejias 2019; Kwet 2019). A standard built for a dominant market may become the de facto global form of rights exercise. A human-compatible layer must allow plural legal grammars rather than let one binary signal define the bounds of global digital rights.

Standards remain necessary, but should carry legal plurality: a rights layer must accommodate GPC-like opt-outs and ADPC-like consent, refusal, withdrawal, and objection without universalizing either regime. Table 1 outlines selected regulatory logics and their communication implications.

Protocol Histories And Lessons For Regulation

Protocol history shows that technical means, legal mandates, and market incentives must align. P3P made website practices machine-readable so browsers could compare them with user preferences, but depended on accurate self-description and saw limited deployment and misused compact policies (Cranor et al. 2008; Leon et al. 2010). Technical machine-readability was feasible; self-declared transparency without incentives and enforcement was fragile.

DNT let browsers send a do-not-track preference and sites return status, but compliant behavior remained outside the specification. After insufficient deployment, the W3C process ended in a 2019 Working Group Note rather than a Recommendation (W3C Tracking Protection Working Group 2019).

GPC connected a browser signal to a California right: California recognizes it for sale/share opt-outs, n.d.). Its scope remains intentionally narrow; the W3C draft defines a sale/sharing signal, not a vocabulary for consent, withdrawal, objection, and contextual rights (W3C Privacy Working Group 2026).

ADPC takes a richer direction: a public specification for bidirectional communication of data-protection information, requests, preferences, and decisions between user-side software and services (Human et al. 2021). It supports general and specific choices, consent, refusal, withdrawal, and objection and may support compatible legal profiles. ADPC currently specifies communication paths using HTTP, JavaScript, and Bluetooth, illustrating how one component of the broader rights layer may operate through different technical channels. The broader rights layer also includes vocabularies, client and controller processing, records, workflows, governance, oversight, and remedies; it is neither identical to ADPC nor confined to the web.

Table 2 summarizes the sequence: P3P exposes unenforced self-description; DNT, simplicity without institutional force; GPC, recognized but narrow opt-out; and ADPC, richer bidirectional communication. These lessons orient Article 88b toward legally grounded automation that keeps supported and vulnerable people involved.

Machine-Readable Privacy-Policy

descriptions.

Description Without Incentives And

enforcement is weak.

A Browser Signal Expressing A Do-Not-

track preference.

Signals Without Legal And Institutional

force are easily ignored.

Sale Or Sharing In Regimes Such As

California.

Effective, But Binary Opt-Out Logic Is Too

narrow for frameworks such as the EU’s.

Refusal, Withdrawal, Objection, Requests,

and records.

Regimes Must Be Richer Than One Global

flag and capable of user-side support.

Proposed Article 88B And The Eu Opportunity

The proposed provision initially numbered GDPR art. 88b (COM(2025) 837 final) serves as the worked case for automated, machine-readable choices. Implementation would depend on standards, clients, controllers, oversight, and enforcement. The EDPB and EDPS support addressing consent fatigue through such choices while seeking legal and technical safeguards and clarifications (EDPB and EDPS 2026).

The illustrative Article 88b lifecycle tests how a standardized channel can carry rights-relevant acts over time: A purpose-specific controller proposition may reach a chosen client, or a person may initiate a request through it; ADPC messages are one possible exchange component (Human et al. 2021; Human 2026).

Cognitive, contextual, accessibility, or authorized collective support can inform consent, refusal, objection, or another request. The controller acknowledges receipt and status, links the act to its workflow, and returns a minimal receipt supporting later update or withdrawal. An absent or contradictory response can enter a complaint or audit pathway; only a competent institution determines breach, remedy, or sanction. These roles may generalize to other digital rights, but their legal meaning and recognition duties do not automatically generalize.

The EU has distinctive reasons to act: Charter arts. 7–8 protect private life and personal-data protection, ECHR art. 8 protects private and family life, and the GDPR is one operational expression of related commitments. Those rights remain difficult to realize through manipulative, repetitive, controller- controlled interfaces. If consent enacts autonomy and dignity, its infrastructure must be compatible with people and legal requirements for validity. Article 88b could give future digital rules shared communication for requests, decisions, and records, but adoption must remain disaggregated. User-side assistance may be chosen; recognition is mandatory only where law requires it. Client conformance, controller processing, standards participation, investigation, adjudication, and remedy remain separate institutional questions; the capability coordinates them without one owner or universal duty. Article 88b must not become blanket browser-default consent or a channel limited to dominant browsers. Standardization should include supervisory authorities, civil society, accessibility and child-protection experts, smaller firms, technical experts, and diverse jurisdictions. It must be deliberative enough for legitimacy but timely enough that incumbents cannot indefinitely preserve banner dependence.

Normative Requirements for a Human-Compatible Rights Layer The analysis identifies seven contestable normative requirements. First (NR1: legal plurality), the capability must be legally plural. It should carry California opt-outs, EU consent and objection, and future rights without privileging Californian, EU, or advertising-industry ontologies or presuming a privileged adult as the default rights-holder. This requires extensible vocabularies, accountable governance of semantics, and NR5’s human-compatible support. Technical neutrality is not enough; legal pluralism must be built into the institutional and technical arrangement (Hoofnagle et al. 2019; Human et al. 2021).

Second (NR2: bidirectionality), the layer must be bidirectional. Controllers need to communicate requests, purposes, legal bases, consequences, and changes. Data subjects or their agents need to communicate decisions, refusals, withdrawals, objections, questions, and preferences. A one-way signal may be useful for simple opt-outs, but it cannot support the communicative richness of EU data protection or the contextual complexity of pervasive digital environments (Human, Pandit, et al. 2022).

Third (NR3: person-held records), the layer must support durable user-side records. People should be able to inspect what was requested, what was decided, when it was decided, and how to revise it. Records should not become new tracking identifiers, and privacy-preserving design is essential. Yet without records, withdrawal and accountability remain dependent on controller-controlled logs. User-side receipts can rebalance evidence without centralizing everything in state or platform databases.

Fourth (NR4: accountable client mediation), the layer must shift interface power. If controllers define every button, color, default, and pathway, dark patterns will persist. User-side software can present requests through standardized, accessible, and independently audited interfaces. This does not eliminate design problems; browsers and operating systems can also manipulate. It shifts control over initiation and presentation and may improve observability, while controller incentives remain an institutional problem. User-side interfaces can also support multiple languages, accessibility settings, plain- language explanations, and visual or audio modalities.

8

Fifth (NR5: human-compatible support), the layer must enable cognitive, contextual, and collective support. Cognitive support includes simplification, automation, memory, summaries, and warnings. Contextual support allows different choices for different purposes, devices, times, or risk levels.

Collective support allows children, elderly users, disabled users, or anyone who chooses assistance to involve guardians, experts, civil-society organizations, or trusted communities. Such support need not be paternalistic when it is transparent, revocable, and chosen or legally authorized. It is recognition that humans are social and limited, not isolated preference machines (Human and Cech 2021; Human 2024).

Sixth (NR6: auditable handling), use of the capability must be connected to enforceable duties and be auditable. Regulators need to know whether a controller recognized a signal, whether a request matched a standard vocabulary, whether consent was validly obtained, and whether refusal or withdrawal was honored. Machine-readable communication can make these questions easier to audit, but only if standards require verifiable traces and if sanctions make noncompliance costly. DNT's insufficient deployment shows the risk when recognition and consequence remain external to a specification. Rights- layer implementations—including those envisaged by proposed Article 88b—should avoid that mistake.

Seventh (NR7: adaptability), the layer must be future-facing. First-party data use, generative AI, hyper-personalization, mixed reality, robots, and IoT show that digital protection cannot be reduced to third-party tracking. A person may not be concerned only that data is sold or shared; they may be concerned that data is used to manipulate, infer vulnerability, profile a child, personalize prices, produce political persuasion, or adapt an AI companion. A rights layer should therefore be designed as a foundation for digital protection, not only for cookie consent (Human 2024; LeBrun 2025; Susser et al. 2019; Yeung 2017).

Figure 1 provides an illustrative, non-exhaustive mapping for NR1–NR7, linking each diagnosis and meta- requirement to selected actors, capture risks, and prospective indicators. Figure 1. Illustrative derivation mapping for the seven normative requirements.

Rights-Layer Operations: What Must Be Communicated Six illustrative operations (Table 3) show how NR1–NR7 apply across actors and time: information or request, decision, record, update or withdrawal, delegated or supported action, and audit trace. They are analytical categories, not findings, wire commands, or a universal sequence; ordering depends on the applicable right and regime. The layer should carry controller-provided information or propositions, person-initiated requests, context, decisions (including objections), legally relevant reasons, updates or withdrawals, the scope of assistance or delegated authority, and acknowledgments, while supporting minimal records and audit evidence. Together, the operations establish context, express and link rights- relevant acts, revise prior acts, enable assistance, and support review.

This operational view matters in the EU because GDPR arts. 7 and 12–22 distinguish consent and withdrawal, controller-provided information, person-initiated requests, objections subject to different conditions, and rights concerning qualifying automated decisions. Timing and effects vary: information may precede processing, requests trigger responses, some objections require grounds but direct-marketing objections do not, and withdrawal does not affect prior lawful consent-based processing. A thin signal

New-Domain Coverage

Arrows show an illustrative derivation path; the remaining columns identify selected roles, risks, and future indicators rather than exhaustive causal steps.

Related Journal Articles & DOI Links

Selected peer-reviewed publications relevant to 12 Lead ECG Acquisition. Click the DOI to access the full paper (may require institutional access).

Why Choose Us?

Bangalore guidance for robotics, Spectre and autonomous systems projects.