Some of you may know that I host the 鈥淧rinciple Driven Leadership鈥?Podcast, so in a sense, I am in my element in this blog post because the essence of the podcast is how to lead through principles and the importance of providing vision in order to grow, resolve problems effectively and create durable results.

With that in mind, I am excited that the W3C Advisory Board has published as a W3C Statement the document Vision for W3C, which articulates W3C鈥檚 core vision for the web. W3C Statements provide a stable reference for documents that W3C Members formally endorse after review. 鈥淰ision for W3C鈥?defines the values of W3C鈥檚 mission as well as the shared principles that guide our decisions for the web, as new technologies enable new possibilities. I can not emphasize enough the importance of vision. Vision matters. It is my first core principle of leadership (the second and third being 鈥渓eaders resolve problems鈥?and 鈥渓eaders create more leaders鈥?, because vision drives impact.

Vision, paired with robust guiding principles, enables organizational alignment and begets positive outcomes. These key words describe a virtuous positive cycle: Clear vision and stated common outcomes (the 鈥渨hy鈥?, and refined principles that drive forward motion (the 鈥渉ow鈥?, create the alignment required for an organization to reach durable and sustainable success.

W3C鈥檚 vision provides our community that clarity: it is that the web is for all humanity, it is designed for the good of all people, it must be safe to use, and there is one interoperable world-wide web.

Our operational principles encompass user-first, multi-stakeholder, diversity, thorough review, consensus, royalty-free and voluntary implementation, open participation, transparency, interoperability, incubation, decentralization, and collaboration. These principles stake out the path towards the sustainable success of W3C.

Furthermore, the core sections on vision in 鈥淰ision for W3C鈥?and the aforementioned operational principles for W3C, are the drivers behind the Strategic Objectives and Initiatives that we developed and made public last month. Vision enables purposeful change, and 鈥淰ision for W3C鈥?is what underpins W3C鈥檚 mission. In all of our four strategic objectives, we will be centering our guiding star on the impact W3C has. That will ensure that we navigate challenges and opportunities in a way that fulfills our mission of making the web work, for everyone, by bringing together global stakeholders to develop open standards that enable a World Wide Web which connects and empowers humanity.

I want to thank and acknowledge the individuals and our collective community for bringing this foundational document to life. I see this as a key component of leading the World Wide Web Consortium.

Today, W3C is pleased to announce the publication as a W3C Statement of Vision for W3C. W3C Statements provide a stable reference for documents not intended to be formal standards but that have been formally reviewed and are endorsed by W3C.

Vision for W3C articulates the World Wide Web Consortium鈥檚 core vision and operational principles, with goals to:

• Help the world understand what W3C is, what it does, and why it matters
• Communicate shared values and principles of the W3C community
• Be opinionated enough to provide guidance and a framework for making decisions, particularly on controversial issues
• Be timeless enough to remain relevant without needing frequent revision, while being open to evolving based on the needs of the community 

The World Wide Web Consortium, as a community leader in defining technical standards and guidelines for a World Wide Web that connects and empowers humanity, has a role to provide a neutral open forum where diverse voices from around the world work together by consensus. The web has had a tremendous impact on the world, and its impact will continue to grow in the future as it expands reach, knowledge, education, and services even more broadly. 

Vision for W3C was produced by the W3C Advisory Board (AB) as a work item that it has been tracking as a priority since 2021, and builds on the W3C Technical Architecture Group鈥檚 excellent Ethical Web Principles, as it fits into the same framework and promotes many of the same goals. Where Ethical Web Principles focuses on the 鈥渨hat鈥?- what we produce - Vision for W3C focuses more on the 鈥渉ow鈥?- by writing down core operational principles. We are grateful to the AB Members, W3C Member representatives and W3C Team Members who joined them in the Vision Task Force, for shepherding this important work. 

A few weeks ago we released to the public the initiatives for 2025-2028 that will support W3C鈥檚 strategic objectives. Both Vision for W3C and Ethical Web Principles provide the foundational basis upon which to envision how to exercise our social responsibilities through rigorous consideration of accessibility, internationalization, privacy, and security. 

Written in the spirit of taking responsibility to address the impact of our work, Vision for W3C defines the values of W3C鈥檚 mission and the shared principles that guide our decisions as new technologies enable new actions and new possibilities. Vision for W3C allows us to take deliberate steps to address the many harmful unintended and undesirable consequences that arose from the web鈥檚 amazing success, and to continue to provide the consistent architecture that enables a World Wide Web that works, for everyone.

This week some W3C staff members, including myself, will contribute to a series of conversations about the future of identity on the web at the Global Digital Collaboration in Geneva. The timing is great from a W3C perspective because we have recently published multiple specifications that I believe will contribute to the next chapter of identity on the web. 

Verifiable Credentials 2.0

Credentials such as driver鈥檚 licenses, passports, diplomas, and payment methods all play an important role in our daily lives. In a growing number of situations, people want to exchange these credentials digitally, and governments are beginning to push for interoperable technologies to support the demand. The foundation of trust in a credential ecosystem is that parties can cryptographically verify these credentials. I lead W3C鈥檚 security activities, and so am particularly focused on the secure exchange of these credentials. 

In May, W3C published version 2 Recommendations of the Verifiable Credentials family of standards (see the press release). These standards enable the secure, privacy-respecting, and cryptographically verifiable expression of digital credentials. 

For flexibility across a broad range of applications and governmental mandates, the new standards support a variety of encoding schemas (e.g., JSON-LD, SD-JWT). The Verifiable Credentials family also provides multiple ways to attach or embed cryptographic proofs to claims. Because the crypto landscape is quickly evolving, the standards are designed to be 鈥渃rypto-modular鈥?to accommodate emerging cryptographic approaches such as Post-Quantum Cryptography (PQC) and Zero-Knowledge Proofs (ZKP). With selective disclosure and the capability to combine multiple credentials into verified presentations, this model ensures secure, efficient, and privacy-preserving user data management. 

Digital Credentials API

The unifying goal of the standards is to empower people to exchange verifiable information securely, privately, and seamlessly on the web. But how do people exchange these credentials, for example, when prompted by a site to provide a national identity? That is the role of the Digital Credentials API, conceived in the Web Incubator Community Group, and now on the standards track in the Federated Identity Working Group. That group published the First Public Working Draft on 01 July 2025.

The Digital Credentials API enables websites to request credentials, and for users to consent to return credentials that they carry around in digital wallets. Above, I said 鈥渟eamlessly鈥?and that鈥檚 where the user agent (browser typically) plays a critical role. The user experience of understanding what is being requested by a site, selecting from among relevant credentials, consenting to share the credentials, and getting new credentials from issuers (e.g., universities, the department of motor vehicles, a bank) must be excellent, and the browser is uniquely positioned to support that experience. 

Because the Digital Credentials API has been incubated for some time, both Google and Apple are already shipping early implementations, so people can check out demos and conduct experiments. This experimentation will inform the evolution of the specification. 

This is only the First Public Working Draft, and the Working Group still needs to address some important security and privacy issues. For example, one of the hot topics is how to balance data privacy with the ability of the user agent to create a secure credential selection experience. Although the Digital Credentials API already expects credentials to be encrypted and signed by wallets (before being handed back to the user agent as output from the Digital Credentials API), there are ongoing conversations about the role of unlinkability for data input to the API. There is more work to do on this and other topics, and I encourage people to join the Federated Identity Working Group discussions.

The ecosystem

As I mentioned, the APIs being standardized at W3C involve interactions with wallets. The current W3C expectation is that the wallet ecosystem will be enabled by a broader ecosystem of operating systems and standards from partner SDOs, including the FIDO Alliance, OpenID Foundation, IETF, and ISO. A lot of the current push for all of these parties to work together comes from the European Union鈥檚 Digital Identity Wallet (EUDI) initiative. A number of large-scale pilots are underway, and they will inform the ultimate EU regulation around the wallet ecosystem.

The Open Wallet Foundation has organized next week鈥檚 Global Digital Collaboration to bring together the broader ecosystem, including governments interested in open standards for wallets, certification programs, and a role for governments. W3C is one of the event鈥檚 co-organizers, and W3C staff will host sessions on Threat Modeling Digital Wallets, focusing on Privacy, a Holistic Security view for Digital Identities, one focused session on the Digital Credentials API, and one for W3C Verifiable Credentials.

My colleagues and I look forward to joining these conversations to represent core values of the W3C mission, such as those reflected in recent W3C Statements such as Privacy Principles for the Web and Ethical Web Principles. For example, a core principle upheld in the W3C APIs is that users maintain control over their digital identities, which need not correspond directly to their legal identities. W3C emphasizes enabling users to present multiple identities across contexts, including ephemeral or anonymous identities, when necessary. User agents (such as browsers or other user interfaces) thus play a critical role in mediating interactions between users and online services, dynamically ensuring digital privacy and security. This approach balances user protection from undesired identification while facilitating intentional recognition, in simultaneous pursuit of both privacy and usability.

I look forward to sharing my experiences from the conference in a follow-up post.

I joined the World Wide Web Consortium at the end of 2023, the year it was established as a US 501(c)(3) public-interest non-profit organization. After meeting the people (staff, W3C Members, collaborators from the community, etc.), taking stock of what the almost-thirty-year-old organization needed to be stronger, and to plan our efforts to move the world forward through the web platform, I then started expanding our connections to liaise with organizations and counterparts. We used the whole first semester of 2025 to iterate and finalize W3C鈥檚 strategic objectives and thematic initiatives spanning the next 3 to 5 years, that I鈥檓 pleased to introduce publicly today.

We will be centering our guiding star on the impact W3C has, to ensure that we navigate challenges and opportunities in a way that fulfills our mission of making the web work, for everyone, by bringing together global stakeholders to develop open standards that enable a World Wide Web which connects and empowers humanity.

W3C鈥檚 impact is through its broad mandate and all-encompassing methodology: since our founding 30 years ago, W3C has played an essential role in driving to trustworthy global solutions by creating trustworthy international standards that rigorously consider accessibility, internationalization, privacy, and security. From our continued work on web standards stems a single, open, interoperable platform that interconnects humanity. That is our impact.

The following commitments serve to illustrate by way of examples the four strategic objectives for W3C:

1. Even though the web caters to over 5 billion people, the gap represented by the digital divide is increasing and we must consider what a 鈥渨eb for all鈥?truly means and how to sustain expanding our support.
   Strategic objective: Diversify our support
   鈫?nbsp;Ensure we have access to appropriate resources to protect our future even in the face of change.
2. We want our trusted gathering place to welcome more far-seeing technical experts and advocates about, and for, the web, so our standards work must consider the impact it has on the world.
   Strategic objective: Enhance our impact
   鈫?nbsp;Direct our standards work through a framework that enables us to qualitatively and quantitatively define, analyze, and communicate the impact W3C intends to have.
3. Owing to our role in educating and promoting awareness of ethical and principled behaviors on the web, we must increase relationships with policymakers and regulatory bodies to advise on technical aspects and ensure that our values are represented, and to ensure we understand their needs as they impact the work that we do.
   Strategic objective: Broaden our footprint
   鈫?nbsp;Expand our reach to involve communities and community representatives to ensure a truly world-wide perspective.
4. And finally, while the landscape of our work has changed significantly in large part because of the work of our community, we must examine how well-prepared and organized we are to face these challenges and perform the necessary structural evolution and operational optimization.
   Strategic objective: Solidify our structure
   鈫?nbsp;Ensure W3C is set up to be a more resilient, adaptive, and durable organization to deliver on our mission well into the future.

These long-term objectives will be supported by five strategic initiatives that the W3C Team will execute and track over 2025-2028:

• Structural evolution: Ensure that our underlying structure and processes are fit for purpose and can effectively enable our future work.
• Impact framework: Enable W3C to qualitatively and quantitatively define, analyze, and communicate the impact we have on the world.
• Stakeholder outreach strategy: Improve our overall effectiveness by reinforcing and enhancing relationships with existing stakeholders (e.g., W3C Members, implementers, web developers, etc.) as well as finding new stakeholders that can help further advance our mission.
• Technology strategy: Maintain relevance through a focus on navigating technology evolution and newly emerging web and web-adjacent technologies.
• Policy engagement: Provide expertise and insight from our community to governing bodies and policymakers to ensure future policies are better informed by our collective knowledge and values.

In summary, we should work towards diversifying our support, finding new stakeholders that can contribute, and strengthening existing work with membership to rapidly adapt to and mitigate risks posed by our rapidly changing environment, while strengthening our organization鈥檚 structure and operations. Our positive impact will help ensure we attract more people to shape and strengthen the web, and grow ourselves in the process so we can further the virtuous circle. By adopting initiatives that support strategic objectives, we can truly realize our vision of making the web work, for everyone 鈥?a web designed for the good of its users, that is safe and secure.

I invite you to read World Wide Web Consortium (W3C) 2025-2028 Strategic Objectives and Initiatives, a public document streamlined from a document that the W3C Board of Directors approved a few weeks ago, following W3C Team and Members iteration and review.

Continuing the series that puts the emphasis on the key areas that help ensure that the Web works, for everyone, this month I am diving into Web security. It is one of the key areas that we call 鈥渉orizontals鈥?and that shape every W3C work package because they involve approaches that are common to all work groups. Our horizontals are Web accessibility, internationalization, security and privacy. 

The imperative

Creating a more trustworthy web and protecting user privacy is fundamental to creating a web that works, for everyone.

Privacy, along with Security, are integral to human rights and civil liberties, and are essential to the success of the web platform. Today, so many of the features of the web and its usage involve information about people and their communications that privacy must be considered consistently across the design of the entire platform. The human factors and the sociotechnical aspects add additional complexity.

To affirmatively realize the privacy of people using the web and address privacy threats that have already arisen requires us to operate in an interdisciplinary and global space, and to develop dedicated privacy features.

How W3C approaches privacy on the web

Following the mid-2000s W3C work on Platform for Privacy Preferences (P3P), the W3C Team in 2011 identified the need to strengthen the foundations of trust on the web for communities large and small to access and share data, and made it an area of focus in 2011. The evolution then trended toward significantly more intense collection, processing, and publication of personal data.

We follow a recipe that is simple but which details are of importance:

• Review the privacy of web standards
• Advise W3C groups developing standards to mitigate privacy issues
• Develop some private technology standards

Horizontal reviews are conducted for privacy of proposals and specifications under development by other W3C Working Groups and Community Groups, and of charters for other W3C groups. Related to that is advising groups developing standards on how to avoid and mitigate privacy issues with web technologies.

The other main component is the standardization of new technical mechanisms that improve privacy on the web, including work moving from incubation when there is a basic technical design, significant implementer interest and activity.

The W3C Privacy Working Group undertakes the former and a lot of the latter. The rest of the privacy-focused features specific to technical work covered by another Working Group are typically best developed in those Working Groups, alongside related technical features.

In focus: Global Privacy Control, Private Advertising

Global Privacy Control (GPC) defines a signal, transmitted over HTTP and through the DOM, that conveys a person's request to websites and services to not sell or share their personal information with third parties. This standard is intended to work with existing and upcoming legal frameworks that render such requests enforceable.

W3C launched the Private Advertising Working Group

in late 2024, motivated by the Ethical Web Principles W3C Statement, to specify web features and APIs that support advertising while acting in the interests of users, in particular providing strong privacy assurances using predominantly technical means.

If you wish to know more about ongoing work, I suggest you take 8 minutes to watch the Privacy talk my colleague Tara Whalen, W3C Privacy Lead, gave early April 2025.

W3C Statement: Privacy Principles

The Privacy Principles were elevated in May 2025 to W3C Statement, which means that although the document is informative and not a formal standard in nature, it creates a stable reference that has received formal review and endorsement from W3C Members.

The document provides definitions for privacy that are applicable worldwide as well as a set of privacy principles that aim to guide the development of the web as a trustworthy platform.

You can read more in Tara Whalen鈥檚 blog post on the W3C Statement: New Privacy Principles for a more trustworthy web.

Protecting user privacy is fundamental to creating a web that works for everyone. Last week, W3C published its Statement on Privacy Principles, in support of furthering this goal. This document defines some foundational privacy concepts and provides a set of privacy principles to guide web development. We hope this guide will enhance the community鈥檚 understanding of privacy, illustrate ways of realizing it in practice, and inspire a vision of the trustworthy web that we can create and sustain together.

Last December, W3C published its first ever Statement, on Ethical Web Principles. The Privacy Principles Statement continues this series, focusing specifically on the considerations required for creating a web that respects people鈥檚 privacy. This milestone is significant: W3C Statements are documents that have been formally reviewed and endorsed by W3C's membership as a whole. The Privacy Principles document was developed over three years and incorporated feedback and contributions from the W3C community, and is now accepted as a W3C Statement to indicate our collective stance on the fundamental importance of web privacy and how to achieve it in practice.

I first started working on privacy with W3C in 2012 (as one of the original co-chairs of the Privacy Interest Group) and I have seen first-hand how users鈥?online privacy has evolved over the years, both in terms of new opportunities as well as new challenges. During this time, a lot of helpful privacy material has been produced, such as a guide on mitigating browser fingerprinting (to reduce the risk of user tracking) and a questionnaire to assist specification authors and reviewers in improving the level of privacy and security of their designs. The Privacy Principles Statement complements this body of work by providing a more general document that includes core privacy concepts as well as overarching guidance that ensures privacy is built into the foundations of web technologies.

Privacy is a very broad topic. In order to reason about privacy on the web, and therefore provide actionable guidance, it鈥檚 first necessary to define what we mean by privacy in the context of the web. That鈥檚 why this document begins with an introduction to privacy on the web, covering topics like data governance, individual autonomy, deceptive patterns, consent, opt-out and privacy labor, as well as the role that browsers (user agents) play in safeguarding web users. This provides context for the actionable principles, each of which is marked with the audiences that it's most relevant to: websites, user agents or API (web technology) designers.

It鈥檚 also important to consider how web technologies interact with social and policy aspects in the privacy realm. The regulatory environment, for example, is constantly evolving and has significant implications for the data protection of users around the world. One of the goals of the Privacy Principles Statement is to support online privacy regulations; the document is written to address both technological and policy considerations and hopefully help achieve some alignment between different regulatory regimes. Because the discussions around online data can sometimes become complex, the document includes several short, concrete examples to illustrate privacy risks and possible mitigations 鈥?for example, handling geolocation information or managing children鈥檚 services.

It鈥檚 taken a lot of work from many members of the W3C community to get these Privacy Principles to this stage, and I want to acknowledge their hard work and dedication. This document is the result of sustained effort by the Privacy Principles Task Force (a group representing a wide range of web stakeholders, convened by the W3C Technical Architecture Group), with particular credit to its Chair Daniel Appelquist and to the document editors, Robin Berjon and Jeffrey Yasskin. Additional thanks are due to all of the people who constructively engaged in discussions about web privacy鈥搒ome of them over several years!鈥搕hat were instrumental in producing a Statement that accurately reflects our collective privacy vision for the web.

While we鈥檙e taking a moment to celebrate the publication of this document, we acknowledge that the work is far from over. We鈥檙e eager to hear feedback about the Privacy Principles, which we can use to improve and expand our future documentation. And of course we encourage you to put the principles into practice as we build a better web!

As the year 2024 comes to an end, the Web Consortium presents our 30th anniversary year holiday card (click the still image for the animation) to once more express our gratitude:

鈥淲ith you, our W3C community, we have achieved a lot in the past 30 years and we look forward to many more opportunities to work together and continue to build a web that works, for everyone鈥?/p>

Our card is available in the following languages, thanks to W3C Chapters and our Team:

• English
• Arabic
• Italian
• Japanese
• Brazilian Portuguese
• Simplified Chinese
• Traditional Chinese

It has been nearly two years since W3C re-launched as a public-interest non-profit organization, and almost a year since I joined as CEO and President. As I pause to reflect, I wanted to share some of W3C鈥檚 notable highlights from 2024. As you鈥檒l see, we demonstrated a lot of the 鈥渨hat鈥?of W3C in really important ways, but the 鈥渨ho" was also a big focus as well as 鈥渇or whom鈥?

W3C 30th anniversary

On the occasion of our 30th anniversary, we released a short animation (clip with audio description) with select milestones for W3C and the Internet between 1989-2024. At W3C@30 we celebrated three decades of W3C and of advances in the web, by lining up a few speakers who shared stories about the incredible impact of W3C standards on themselves or the world, and enjoyed ourselves during an authentic evening that culminated with a gala that was nice and cozy (as much as can be for several hundreds people). Photos are available.

Expanding the W3C Team

2024 was a big year as far as increasing the capability of the W3C Team. The W3C Staff has remained consistently relatively small over the years but this year we hired 10 new persons and managed to fill a number of important roles, and to create new positions that are in line with the work we need to be doing for a web that better serves humanity.

• Ken Troshinsky (USA), hired in February as Chief Financial Officer
• Simone Onofri (Spain), hired in February as Security Lead
• Ken Franqueiro (USA), hired in May as accessibility technical specialist
• Tamsin Ewing (New Zealand), hired in July as accessibility content specialist
• Tara Whalen (Portugal), hired in July as Privacy Lead
• Emma Fraser (USA), hired in July as Board enablement specialist
• Tzviya Siegman (USA), hired in September to spearhead our work in Sustainability, and to handle Member relations in North America
• Sylvia Cadena (Australia), hired in September as Chief Development Officer
• Christine Gefaell (USA), hired in October as Director of Legal & Compliance
• Catrina Ahlbach (USA), hired in November as manager of the Office of the CEO

I am proud in particular that we welcomed so many women to the Team this year and that we expanded even more the geographic and cultural diversity of our global Team.

Today the W3C Team operates primarily remotely and includes engineers and experts who work from 11 countries and across 12 time zones (Pacific/Auckland, Australia/Brisbane, Asia/Tokyo, Asia/Shanghai, Indian/Reunion, Europe/Athens, Europe/Madrid+Paris+Lisbon, Europe/London, America/New York, America/Chicago, America/Denver, America/Vancouver).

Principles and goals for the web

2024 was a year where W3C began to surface more of our guiding principles and goals for the web, with emphasis on the human impact of our work.

• Just last week we published as our first ever W3C Statement the Ethical Web Principles which are as much a guide in ethical thinking for our work in the W3C community as they are across the web industry.
• The document Vision for W3C articulates W3C鈥檚 mission, what it does and why that matters, and the values and principles by which it operates and makes decisions.
• W3C Team Member Dominique Haza毛l-Massieux published a white paper on managing the impact of AI & Machine Learning on the Web (blog)
• W3C Team Member Simone Onofri wrote a white paper on the societal, ethical, and technical impacts of digital identities (blog)
• W3C Members chartered the Sustainable Web Interest Group with a goal to improve digital sustainability so that the Web works better for all people and the planet.

Philanthropic external funding

Further underscoring the importance of our impact on humanity, W3C was the recipient of a major grant from the Ford Foundation 鈥渁s an investment in a more inclusive future.鈥?This funding will go towards development of web accessibility standards, guidelines, and implementation resources to support access for people with disabilities.

Not only will this strengthen the foundations for our work in accessibility to continue and thrive in the long term, but it is also a boost to our development efforts as this is the first grant that we received since becoming a US public-interest non-profit organization.

Vitality of the Consortium

Finally, I want to share the following 2024 key figures:

• 493 specifications are being actively developed, of which 284 are on the W3C Recommendation track (dashboard)
• W3C has 46 open working groups and 11 open interest groups
• To date, 1,955 Technical Reports have been published since 1 January 2024. Of those, 29 reached the status of W3C Recommendation, or, in other words became web standards. The first number is so big because about 1,800 of them were published as 鈥渄raft鈥?/li>

All in all, we鈥檝e accomplished a lot together in 2024. At the same time we have laid the groundwork to face some of the challenges in front of us as we move into the new year and to create an even bigger impact on the world.

I returned from my first W3C TPAC week energized and thoroughly impressed by the drive and the strong sense of community.

TPAC is our annual, now-hybrid meeting, where most W3C work groups meet amongst themselves or jointly, to coordinate solutions and resolve challenging technical and social issues that the Web faces. TPAC 2024 was the 24th edition of that popular and well-attended yearly event. 845 attended in total, with 549 at the in-person hub in Anaheim, California (USA) and 296 remotely. We used 15 to 17 separate meeting rooms each day at once and held a total of 191 meetings that week. 87 of them were part of the Breakouts day on Wednesday, dedicated to sessions organized by TPAC participants themselves.

I wish to come back to the incredible spirit of community that I felt throughout the week but one moment stood out. Our event was disrupted on day 2 by a two-hour power outage that affected the entire block. Rather than being upset, one of several paths were followed - some people in our group helped ensure others were safe and accounted for (in particular those in wheelchairs), some found spaces to continue working, some took it as a salutary break. One of our attendees who had arrived that day saw the room he was in get dark just as he plugged his computer and thought he had caused it. Others joked that the power cut was a radical way to pause the jack-hammering that was taking place as part of the hotel renovation - another unfortunate source of disruption in some meeting rooms.

I had a lot of conversations with members via zoom and in person, in the hallways, during breaks and meals. While some concerns about our future and the future of the web were voiced, there is a clear expression of optimism across our community, and genuine commitment to making the web work for everyone.

Another highlight of the week was the celebration of the 30th anniversary of W3C (the actual anniversary falls on the first day of October). We carved out time at the end of Wednesday for inspirational talks and a gala. It was a great celebration. After kick-starting the Talks with a short anniversary video spanning 1989-2024 with milestones for W3C and the Internet, I spoke about the challenges we鈥檝e overcome to bring the web to where it is today and the challenges in front of us. We鈥檝e changed the world and will continue to.

I really enjoyed the other speakers covering the past, present, and future. We focused on celebrating our community, and on our impact on humanity.

The gala dinner gave members an opportunity to make a toast, or share their gratitude to the community. Food and company was excellent and the atmosphere was friendly and relaxed. The cake arrived. It was splendid and delicious, it turned out. I asked to be joined for the cutting by Tatsuya Igarashi, the representative from Sony (one of the few organizations to be a Member since W3C鈥檚 founding in 1994), and by David Singer of Apple, the outgoing Chair of the W3C Board of Directors whose last W3C event it was now that he is retiring. And like any good party, most stayed late and the hotel staff had to kick us out of the veranda lest we kept the hotel guests from sleeping.

The week also saw us have our first W3C Team Day in over a decade. We used the opportunity that so many of our staff were present for TPAC to spend an extra day with each other. And we were able to include during most of our activities and via video conferencing all the Team members who had not been able to attend in person. For many of us, not just new folks like myself, this was the first time that people were meeting each other in person. It was a great opportunity to connect / reconnect and build the bonds needed to do the challenging but captivating work that we鈥檙e involved in.

All in all I returned home exhausted but energized and confident in our consortium鈥檚 collective ability to face whatever comes next.

Continuing the series that puts the emphasis on the key areas that help ensure that the Web works, for everyone, this month I am diving into Web security. It is one of the key areas that we call 鈥渉orizontals鈥?and that shape every W3C work package because they involve approaches that are common to all work groups. Our horizontals are Web accessibility, internationalization, security and privacy. 

The imperative

A technology isn鈥檛 truly beneficial to humanity if it isn鈥檛 safe, and security standards are an essential aspect of ensuring the Web is safe.

Security, along with Privacy, are integral to human rights and civil liberties and have long been important in the World Wide Web Consortium's agenda. W3C has a long history of improving Web security and our work has been instrumental through the development of authentication technologies that can replace weak passwords and help mitigate threats from phishing and similar attacks.

Security is essential to our digital lives as appropriate measures can create trust between people, organizations, businesses, and governments, and while advances on the web make it easier for people to interconnect, this results in a wider attack surface for servers. In other words, the more ways you allow people to interact with your site and products, the more ways bad actors have of attacking.
As users we want to engage with what we trust. We want to ensure our information, our money, and other resources aren鈥檛 stolen. We want to make sure we are interacting with who we really think we鈥檙e interacting with. As a provider of information, service, or product on the web we want to ensure that we reduce risks and costs, and that we increase trust and strengthen our reputation.

How W3C approaches Security

We follow a recipe that is simple but which details are of importance:

1. Develop security technology standards
2. Review the security of web standards
3. Guide Web Developers to design and develop in a secure manner

At the heart of developing the right security standards is threat modeling, which enables the creation of living documents that identify cross-areas threats and mitigations and provide information on residual risks, and in turn frame and guide technical specifications.

We are in the process of elevating the conduct of reviews from a pool of volunteers to a chartered group, called the Security Interest Group (SING) whose charter the W3C Members are currently assessing as part of approving the group. With a mission to improve Security on the Web by advising groups developing standards on how to avoid and mitigate security issues with their technologies, the Security Interest Group would also suggest changes to existing standards and technologies to improve the security of existing systems.

Last February, we welcomed to the W3C Team our new Security Lead, Simone Onofri. Among the many projects he set into place, he helped launch a cross-organization group, called the Security Web Application Guidelines (SWAG) Community Group, to guide Web developers and ensure a holistic approach to security through the edition of web creators security best practices and providing a platform for stakeholder collaboration (e.g., OpenSSF, OWASP, Open Web Docs, etc.)

In focus: Digital Identities

In recent years we've seen the emergence of the paradigm of decentralized identity and credentials, where users have a digital wallet and control over their identity. All sectors, from social networks and education to enterprises and governments worldwide are considering becoming providers and consumers, with the intention to have digital credentials that are more secure and privacy-preserving than physical ones.

Given the societal, ethical, and technical impacts, Simone and the W3C Team wrote a paper on Digital Identities on the Web. "Identity & the Web" analyzes through different use cases the systemic impact on both the market side and the human side, as well as the role that Web standardization may play in managing that impact. We published the report this month and are looking forward to charting a credible and safe path to strengthen the position of the Web during this rapid evolution phase of the information ecosystem.

Key players

I want to conclude by emphasizing that as a horizontal area, Web Security matters to most and that most can be key players. Whether you are an independent developer or work for an organization that develops products or services, or are a user, your participation in Web Security can make a difference and will be meaningful: contributing to a Web that works for all humanity.