Telemetry Nutrition Label

You don't have a consistent, trustworthy way to see what your software and devices transmit. Privacy policies are prose, buried, and unverifiable. OS permission prompts describe capabilities like "this app can access the network" rather than actual flows like "this app sends your document filenames to vendor-analytics.example every five minutes." The result is that phoning home is opaque by default.

This specification defines a Telemetry Nutrition Label: a structured, machine-readable manifest, modeled on the food nutrition label: a fixed, comparable, scannable disclosure of outbound data. The OS reads the manifest, renders it in plain language, and can correlate it against observed network behavior. The goal is not to block telemetry. It is to make it legible. And to make a declared-but-violated label detectable.

Every label is a document with a small fixed set of fields. Each outbound flow declares:

• What kind of data leaves the device — from a closed vocabulary: device_identifiers, file_metadata, file_contents, location, contacts_or_social_graph, input_or_behavior, media, account_identity, network_identifiers, crash_state, and others
• Why it's sent — from a closed vocabulary: crash_diagnostics, usage_analytics, feature_operation, content_delivery, advertising, license_check, security_telemetry, update_check, and others
• Where it goes — the operator, the endpoint, the jurisdiction, and whether the receiver is a third party
• How often and on what trigger — every 5 minutes, per crash, on launch, continuous
• Whether it's required — can the product function without it?
• How long the data is retained at the destination
• How identifiable the data is — anonymous, pseudonymous, or identified

The closed vocabularies are the point. advertising and usage_analytics cannot be buried inside a vague "to improve our services." Every flow is a categorized entry. Two products' labels can be compared side by side, the way two food labels can.

An OS presenting a label must surface, at a glance and without drilling in:

• How many flows exist and how many go to third parties
• Whether any flow carries file_contents, location, input_or_behavior, or contacts_or_social_graph
• Whether any required flow exists — i.e. the product cannot fully function offline
• Whether the vendor asserts there are no undeclared flows

This is the front of the box. Comparable in seconds, like calories and sugar on a food label. The full detail is one click away.

Because the label is machine-readable, the OS can compare declared flows against observed network behavior. If a product contacts a destination it didn't declare, sends data more frequently than stated, or egresses file_contents when the label declared only file_metadata, the OS flags the divergence to the user.

The label shifts telemetry disclosure from unverifiable prose to a falsifiable claim. A vendor that signs a false label has signed a detectable falsehood. The spec defines the reconciliation report format so that any host, auditor, or third party can produce comparable findings.

The spec deliberately does not mandate blocking undeclared flows. Whether to block is the owner's policy choice. The spec's job is legibility and falsifiability. Enforcement is a separable layer.

The reference implementation ships in LibreWin. It provides a label parser and validator, a renderer producing the plain-language front-of-box view and a drill-in detail view, a reconciler that compares observed egress against declared flows, and a label authoring tool for vendors.

A product ships its label as a discoverable resource. The OS reads it at install and surfaces it in Settings alongside the live reconciliation status.

A machine-readable telemetry-disclosure format is exactly the kind of convention a single platform could define proprietarily and license, fragmenting the space. Publishing it openly, with the format established as prior art, keeps it free. Any OS, store, auditor, regulator, or privacy tool can implement against it without asking anyone. Its value rises with adoption beyond any one platform.

Existing mechanisms like Apple's "Privacy Nutrition Labels" and Google Play's "Data safety" are self-asserted, vendor-controlled, and not machine-reconcilable against observed behavior. This spec diverges by being open, comparable across vendors, and verifiable.

Anyone. Any operating system, store, application vendor, auditor, regulator, or privacy tool can implement this format without permission, license, or attribution. The schema is dedicated to unrestricted use and the format is established as prior art so it cannot be patent-enclosed.