draft-ietf-vcon-privacy-primer — Privacy Primer for vCon Developers

draft-ietf-vcon-privacy-primer (McCarthy-Howe) is the working group’s privacy primer — an informational document aimed at the technical professionals who, in the course of building or operating vCon systems, end up collecting, using, disclosing, and erasing other people’s personal data. It is not a normative specification and does not change the schema. Its job is to give an engineer a working vocabulary for the privacy questions a vCon raises, and a map of the legal and ethical landscape those questions sit in, before any line of code touches a real conversation. Thomas McCarthy-Howe is the sole author. I co-chair the vCon working group with Brian Rosen.

The conceptual framing for vCons across this site lives on the vCon topic page; the core spec page covers the JSON container itself, and the overview explains what vCons are for. This page covers what’s specific to the privacy primer — why a dedicated privacy document belongs in this cluster at all, and what ground it covers that the core and the overview only gesture at.

Why a vCon needs a privacy primer

The reason the working group wrote a separate privacy document is structural rather than rhetorical. A vCon is a container for a complete conversation. In practice that means it carries the things a conversation is made of: the identities of the parties, the full text of what was said, transcripts, and the original media — audio and video recordings. Each of those is a category of personal data, and the media in particular carries data that is hard to take back. A recording of a voice is, for privacy purposes, a biometric identifier; a video frame of a face is another. A vCon therefore concentrates, in a single signed object, exactly the kinds of data that privacy law treats as most sensitive and that engineers are least practiced at reasoning about.

That concentration is the whole point of the format — the value of a vCon is that the record is complete and portable — but it is also precisely what makes a casual approach to privacy dangerous. The primer exists so that the people building producers and consumers of vCons start from a shared and accurate model of what they are handling, rather than discovering the obligations one regulatory complaint at a time.

The roles the primer defines

Privacy regimes do not treat everyone who touches personal data the same way; they assign duties according to role, and the primer makes those roles explicit so that a vCon implementer can locate themselves in the picture. The central distinction is between the controller — the party that determines the purposes and means of processing — and the processor, which acts on the controller’s instructions. In a typical vCon pipeline these are different organizations: a contact-center platform may be the controller for the conversations it records, while a transcription service or an analysis vendor that receives the vCon is a processor. The distinction matters because the duties, and the liabilities, fall differently on each, and because a vCon crossing a trust boundary is very often a vCon changing hands between a controller and a processor.

Alongside the controller and processor, the primer keeps the data subject — the individual the data is about — in view as the party whose rights the whole apparatus exists to protect. That framing is deliberate: it positions the engineer not as the owner of the data but as a custodian of it on behalf of someone else.

Fair information practices and data-subject rights

The substantive spine of the primer is the set of fair information practices that underpin essentially every modern privacy framework. These are the familiar principles — purpose limitation, data minimization, accuracy, storage limitation, security, and accountability — restated in terms a communications engineer can act on. The primer’s value here is translation: it takes principles that are usually stated in legal abstraction and connects them to the concrete decisions a vCon system makes, such as how long a recording is retained, what an analysis service is allowed to derive from a transcript, and who a signed vCon may be disclosed to.

The primer then sets out the rights that individuals hold over their own personal information — the rights of access, rectification, erasure, and the rest — and treats them as design constraints rather than afterthoughts. The right to erasure in particular has sharp consequences for a format built around tamper-evident, signed, append-only records: a vCon is engineered to make its history verifiable, and honoring a deletion request against an immutable signed object is a genuine design tension. The primer does not pretend that tension away; it names it, which is the first thing an implementer needs.

The scope of protected and sensitive data

A recurring failure mode in communications systems is treating only the obvious identifiers — a name, an account number — as the personal data that needs care. The primer draws the scope wider and more accurately. Basic identifiers such as name, age, and address are personal data, but so is a great deal that a conversation captures incidentally, and the primer is explicit that certain categories are sensitive in a heightened legal sense: among them the biometric data that audio and video recordings inherently contain. A voiceprint extractable from a recording is sensitive data whether or not anyone set out to collect it, and a vCon that carries the recording carries the voiceprint with it.

This is the point at which the primer is most clearly written for vCon specifically rather than for privacy in general. The format’s defining feature — that it keeps the original media alongside the derived analysis — is also the feature that pulls sensitive biometric data into scope by default. The primer makes sure that implication is stated plainly so that nobody treats the media payload as inert.

Anonymization and aggregation

Finally, the primer covers the techniques that reduce privacy risk by reducing the identifiability of data: anonymization and aggregation. It explains what each is for and, as importantly, where their limits lie — anonymization that can be reversed is not anonymization, and aggregates can leak information about individuals when the groups are small or the queries are adversarial. For vCon developers these techniques are the practical levers for honoring data minimization while still extracting analytical value from a conversation record, and the primer frames them as engineering tools to be applied with their failure modes understood rather than as guarantees to be claimed.

Throughout, the primer references the existing IETF privacy work but deliberately extends past it. Much of the IETF’s prior treatment of privacy concerns the network and the protocol — the privacy of the parties to a communication as the communication transits the Internet. The primer’s subject is the longer tail: the privacy of individuals in relation to the organizations that retain, process, and disclose the record of that communication after the fact. That is the regime a vCon lives in, and aligning the document with the fair information practices and current regulatory frameworks is what lets it serve as a comprehensive overview rather than a checklist.

Status

draft-ietf-vcon-privacy-primer-01 (4 May 2026), vCon working group document, Informational. Current revision and state on the IETF datatracker.