Your data built a quarter-trillion-dollar industry. You were never in the room.
Everyone in the data economy gets paid except the person the data describes. Nobody, anywhere in the chain, holds a record of the yes.
How we got here Skip to the systemThe plumbing never asked permission.
The consumer internet made a trade nobody read: free services for permanent collection. Data became exhaust, then inventory. The cookie made you followable. The smartphone made you continuous.
An industry grew in the dark: thousands of brokers holding thousands of attributes on nearly every adult, bought and sold with no memory of where any of it came from. You cannot ask to see a file you do not know exists.
Cambridge Analytica put a number on it: 87 million profiles, repurposed. Europe answered with GDPR. The surveys have said the same thing ever since: roughly eight in ten Americans feel no control over what companies collect. So people started lying on forms and burning email addresses. Trust broke, and the data rotted with it.
California built the machinery: CCPA, then the Delete Act, then DROP, one request that reaches every registered broker. Texas and Vermont built registries of their own. 825 brokers sit across those registries today. This site works from the same rows, further down this page.
GM sold driving behavior to LexisNexis and drivers found out from their premiums. 23andMe went bankrupt and fifteen million genomes sat in the asset column. Then the GenAI land grab repriced every record ever collected. The question stopped being abstract: whose property is a life's data, and where does the money go?
Ownership is the wrong tool. Data copies; property law assumes things that do not. What a person can hold is a license: a recorded yes, scoped, dated, revocable, that every copy has to obey.
We know, because we tried it the other way.
We set out to build a 300 million person identity graph the way the industry builds them: acquire, match, resolve. The deeper we got, the clearer it became that we were walking into the diagram above. A graph you assemble that way is a liability wearing an asset's clothes: no memory of the yes, no right to hold what it holds, worth less every time a legislature meets.
The way in is not owning the graph. It is owning the record of consent. Build the spine and the graph assembles itself: every node licensed, every edge revocable, every fact worth more because it can prove where it came from. That is where the value is. Not the biggest graph. The only clean one.
We could take that road because the substrate already existed: SuperTruth's patented Truth Layer, patents in attested provenance and revocation, and DTI™ rails already running in clinical production with MedSync.
Nobody had built the infrastructure for the record of the yes. So we did. Everything below is it, running.
Every record answers one question. Who said yes?
DataSpine will only store a fact about you if it can point to the moment you said yes. That moment is called a consent event, and the database itself refuses anything without one. Every button below is real, and every answer you see is the database's own.
Stop watching. Step in.
Ava and Rio are synthetic. You are not. Two different worlds ask for your details below: a store and a clinic. Different stakes, different rules, one rail underneath. Sign up in either and from that moment this whole page is about your record: your consent event, your masked surface, your withdrawal, your receipt.
THE CONSUMER WORLD
THE CLINICAL WORLD · SEPARATE REGULATED TRACK
The difference is what each world may carry: the store's data rides the co-op; the clinic's contact details ride too, but the clinical payload is refused by the schema itself and lives on MedSync's regulated rails. Demo database, PIN-gated. Withdraw stops your record serving instantly; Remove deletes your rows outright. Any demo reset clears them too.
One anchor for everything: the consent event.
When you say yes, six things get written down: where, what you were shown, what you allowed, when, how long it lasts, and whether you took it back. Every piece of data hangs off one of those moments. Take the yes back and everything riding on it stops being served, everywhere, at once.
Anatomy of a consent event
The wall is the database.
Every attempt below is a real write. The rejections are PostgreSQL's own words.
GM streamed driver-behavior data to LexisNexis; drivers found out when their insurance quotes went up. Records nobody consented to moved for years because nothing structural stopped them. Here, a record without a consent event cannot physically exist.
Or aim it yourself
The presets above are ours. This one is yours: pick any identity, ride any consent event, date it however you like. The database does not know the difference between a demo and a determined adversary.
Withdrawal is one write. Every copy obeys.
Ava said yes at Northwind's checkout. Because she allowed sharing, another member, Beacon Media, can look her up. They see her email, but where she signed up stays hidden behind a code. Now watch what one withdrawal does. If you signed up above, run it on your own record up there instead.
When 23andMe went bankrupt, fourteen million DNA profiles became an asset for the estate to sell. Data that is sold can be resold. Data that is licensed dies with the license: withdrawal follows the record everywhere, and there is nothing to auction.
What Beacon Media Group sees of Ava
Raw storage (the co-op's own eyes)
Some things the schema refuses to hold.
The FTC moved against BetterHelp and GoodRx for routing health data into ad targeting. The lesson was not "be careful with health data." It was that health data should never share rails with marketing data. Here it has no vocabulary to arrive in.
Health data has no vocabulary
Clinical data has no type to arrive as. In production it rides MedSync, inside the provider's perimeter; only DTI trust scores travel. Type a reason for visit in the intake above and watch it bounce. The catalog, live:
Compensation cannot coerce
"Agree to sell your data or you cannot use the service" is not a real choice. The database refuses any deal recorded that way. Try it:
Built. Inert. Off until the law says otherwise.
Individual data licensing is fully built and hard-locked. There is no config toggle. The gate opens per jurisdiction only when counsel records a legal authorization with a statute cite, and the statute must be in force today: on the books is not enough. Run the whole lifecycle, or sign up above and run it on your own record:
California's Delete Act built the deletion rail: one request, every registered broker. No legislature has built the payment rail. These rails exist and stay dark until one does; that is a legal condition recorded by counsel, not a feature flag.
Every broker, every attribute, every state.
All 825 companies we matched across the three state registries, and everything they told California about themselves. A filled square means they registered in that state. A filled dot means they admit it. Hover any column for what it means. Search anything.
Registration from each state's registry; attribute columns are California filings, as reported. Blank rows under the attribute columns are brokers that never filed in California.
This ledger is also served as an attested data source on the household spine: broker headquarters, disclosed breaches, and deletion-request pressure, state by state. One estate keeps the record. The other serves it, receipts attached.
Same rows. Three businesses.
Quality pays. Volume without quality costs.
Data brokers get paid per record whether or not the record is true. That is why so much of it is wrong. Here, wrong data costs you almost three times what it earned, and if the people behind your records pull out, your earnings go back too.
Who brokers data, and who is registered nowhere.
Nothing in this column is synthetic. These are the actual CPPA registry filings, and the actual disclosures brokers made about GenAI sales, minors, and denied deletion requests.
The rails exist. The train does not run.
Deals can be drafted, reviewed, and canceled. Nothing switches on and no money moves while the gate is closed for that state. That is Rule 4, and the receipt below reads the same rows.
The locker keeps a receipt.
The consent locker is your side of the spine, shown here as an Apple Wallet pass. The card is a receipt: you act in the locker app, and the card shows the result. Run the gate demo above and watch; the card follows the database.
The QR is the provenance token: anyone the person shows it to can verify the claim against the spine without seeing the raw surface.
Sign up on the patient intake above and this card reads
medsync/patient-intake as its source. The clinic's contact consent
is on the card; the chart never is. Clinical trust travels as DTI scores on
MedSync's rails, not as records.
Free. For businesses and for people. In phases.
We are releasing this in phases, and the direction is set: free for businesses, free for consumers. The registries, the matrix, and the receipt come first. The co-op follows. The payment rails are already built and waiting on the law; you watched the gate hold them shut.
Your data built their industry. The next one gets built on your yes.