About us
Where operational privacy meets operational transparency.
TCIEG helps organisations and institutions make transparency operational, so that consent and trust can scale across services and public infrastructure, and people keep control of their data. We work with co-regulated digital identification and AI governance standards.
How TCIEG started
Twenty years apart, working on the same problem.
For the past 20 years, two privacy experts have been running parallel, but disconnected, efforts to put transparency controls in place across systems, so that individuals could consent freely and on an informed basis.
Mark Lizar was in Europe campaigning for awareness of Operational Transparency, a principle drawn from the 2007 International Security Trust and Privacy Alliance (ISTPA) research Analysis of Privacy Principles: Making Privacy Operational. Meanwhile, unbeknownst to Mark, Michele Drgon, who co-edited the ISTPA research, was in the United States driving Operational Privacy frameworks with global clients, and working on the privacy engineering standards that design transparency and other privacy controls into technology, across AI, the internet of things and cloud computing.
They met in April 2026 in international privacy standards work, while contributing to guidance on privacy protection in AI. Mark had been evangelising the ISTPA comparative research on global privacy principles for almost two decades.
Once they learned that they had both been passionately driving attention to notice and consent requirements, they decided to join their two complementary efforts, forming TCIEG.
Where it started
Trust you can verify, data you control.
A month later, on 20 May 2026 at CPDP in Brussels, the panel “Transparency by Default: An Internet Transparency Code of Practice”, moderated by the Council of Europe, heard Ana Brian Nougrères, United Nations Special Rapporteur on the Right to Privacy, set out the challenge:
“We must demand that digital systems are architected to prove their compliance and accountability at the very first point of interaction, not after the data is already flowing through opaque, multi-party chains.”
That call set TCIEG's direction. Trust and data control fail together online, because people are asked to trust organisations they cannot see and to give up control before they know who holds their data. They are fixed together, with evidence available at the first point of interaction.
Read the full story: why TCIEG exists · Watch the panel · Read the keynote
Mission
Our mission.
TCIEG's mission is to make transparency operational, evidence-based and verifiable before identification, processing, tracking or transfer, where prior transparency or consent is required.
Make authority transparent at the point of engagement, make the claim of authority inspectable at the point of contact, and give the individual usable evidence of the interaction, so we can control our own data.
The work moves privacy from policies and controller-maintained assertions toward digital interactions that can be independently reconstructed and verified.
Consent
Real consent requires real evidence.
Consent is a human-defined choice. Permissions are system-managed. Those are not the same thing.
A system can record that a permission changed without proving that legally meaningful consent occurred. Evidence of consent should be able to show what the individual was told, who was requesting the authorisation, what purposes applied, which notice governed the interaction, what the individual authorised, and what happened when that authorisation was modified or withdrawn.
TCIEG promotes the Operational Transparency Stack, a standards-based approach to creating that evidence. It builds on established privacy standards and emerging evidence structures, including ISO/IEC 29100, ISO/IEC 29184, ISO/IEC TS 27560:2023 and the Kantara Initiative's ANCR work. Together these support a progression from privacy principles and notice presentation to structured records, receipts, authorisation evidence and auditable lifecycle history, and an interoperable evidence layer that works across technologies, organisations, jurisdictions and use cases.
Operational transparency
Transparency as a system capability.
Privacy requirements become meaningful in digital systems when they operate at the point where the interaction occurs.
Before an organisation identifies an individual, requests personal information, initiates tracking, requests an age or identity attribute, or asks for authorisation, the organisation itself should be knowable. The applicable authority, purpose, notice and relevant conditions should be resolvable and inspectable. The evidence of that interaction should persist.
Operational transparency turns transparency from a webpage into a system capability. It makes it possible to reconstruct what governed a particular interaction, instead of depending on the organisation's own later account of what occurred.
Identification
Co-regulated digital identification.
Digital identity infrastructure has concentrated on establishing facts about the individual. There must also be a reciprocal side.
Before an individual is asked to prove who they are, disclose an attribute, demonstrate their age, present a credential or otherwise become identifiable, the organisation making the request should itself be identifiable and accountable. Its authority, purpose, applicable notice and conditions of interaction should be knowable first.
Public rules can establish what must be disclosed and evidenced. Standards can provide common structures. Industry can implement interoperable systems. Independent resolution and verification can make the resulting infrastructure inspectable. That is a path toward digital identification which protects the individual before identification occurs, rather than placing the entire burden of proof on the individual.
Regulators
Working with regulators.
TCIEG advances the case for verifiable transparency and consent evidence with regulators and policymakers, and the development of an Internet Transparency Code of Practice is the instrument that work is organised around.
Regulators face the same evidentiary problem repeatedly. After an interaction has occurred, how can anyone reliably determine what an individual actually saw, which notice applied, which organisation was acting, what authorisation was obtained, and whether later changes were honoured? Standardised evidence can materially improve regulatory capacity.
The work includes engagement with regulators, consultations, regulatory sandboxes, implementation initiatives and policy programmes. The long-term objective is straightforward: where organisations are required to demonstrate transparency or valid consent, standardised and reconstructable evidence should become part of how compliance is demonstrated.
Standards
Working with standards communities.
Standards are central to this mission. TCIEG supports the continued development, alignment, implementation and adoption of standards that make notice, consent, identification, authorisation and lifecycle evidence interoperable.
We do this work through the Internet Transparency Code of Practice: a transparency by default code that organisations can adopt and regulators can inspect, built on published notice and consent standards and the Kantara ANCR extension. Mark Lizar is an originating author of the Kantara Consent Receipt specification. Michele Drgon brings two decades of privacy engineering standards work.
We also identify where adoption is impeded by a lack of interoperable interfaces between technologies and platforms. AI, digital identity, age assurance, agents, wallets, consent management, privacy signals and cross-border data systems increasingly interact with one another. Their transparency and authorisation mechanisms cannot remain isolated indefinitely.
Partners
Working with pilot partners and sponsors.
Standards become meaningful when they can be demonstrated. TCIEG is seeking sponsors, implementation partners, technology providers, research partners, regulators and other organisations interested in building and testing reference implementations, demonstrations, regulatory pilots and sandbox projects.
These projects show how interoperable transparency evidence works in real systems, including consent, age assurance, digital identification, AI interactions and cross-border data exchange. Sponsors and partners help move the work from architecture into demonstrable infrastructure.
Contact us
Talk to TCIEG
TCIEG welcomes discussion with regulators, standards participants, civil society, technology providers, legal experts, privacy engineers and implementation practitioners working toward interoperable Operational Transparency standards.