More than half of the traffic on the internet is no longer human. Cloudflare's bot report of 1 July 2026 puts it plainly, "more than 50% of traffic on the Internet is now non-human", and records what that automated share is now doing: 52% of crawler requests were for AI training as of June 2026, up from 22% in spring 2025. For an institution, that becomes an operational question. When a counterparty opens an account, signs a document or sends an instruction, what establishes that a person is on the other side, that the credential presented is genuine, and that the action was authorised by whoever bears the consequences. Those are three different questions, routinely collapsed into one, and the collapse is where the exposure sits.
The Paris 2026 programme carried one session on this directly. "Personhood, Provenance, and Verification in the Agentic Age" was a panel on the Agentic AI track, staged on the Taostats Stage on Wednesday 3 June 2026, 15:15–15:55. The programme listed the panel as Pierre Aubert, Vice President of Engineering at Parity Technologies; Evin McMullen of Billions Network and Privado ID; Stuart Haber, Chief Cryptographic Officer at SureMark Digital; and Chi Zhang, Co-Founder and Chief Executive Officer of Kite. Mohamed Ezeldin, Vice President and Head of Animoca Labs at Animoca Brands, moderated. No other session title on either day named personhood or verification.
The authorisation half of that, agent payment mandates and delegated credentials, we covered in agentic commerce and the payments question. It has a standards pipeline, industry sponsors and a regulatory conversation. The personhood half has considerably less.
The standards body closest to the question has put it out of scope
The IETF's Web Bot Auth working group is active and chartered under the Web and Internet Transport area. Its in-scope list is the traffic Cloudflare counts, including "Crawlers for AI training" and "AI agents retrieving or interacting with content on behalf of end users".
The out-of-scope list is the more useful half. It excludes "Authenticating the end user of a participating client or agent" and "Techniques for distinguishing non-participating bots from non-bot clients". Read plainly: the group can let a cooperating agent prove it is the agent it claims to be, but it cannot tell you whether a person stands behind it, and it has formally declined to try. That is a defensible boundary. It also means the body nearest the problem has made the personhood half somebody else's job, and nobody has taken it up.
Proof of personhood, and where each approach breaks
The field's definitional reference is a 2024 paper, arXiv 2408.07892, written by 32 authors and last revised on 17 January 2025. It defines personhood credentials as "digital credentials that empower users to demonstrate that they are real people, not AIs, to online services, without disclosing any personal information", says such credentials "can be issued by a range of trusted institutions, governments or otherwise", states that a system meeting its definition "does not need to be biometrics-based", and argues that existing countermeasures such as CAPTCHAs "are inadequate against sophisticated AI". It is a proposal that sets out its own deployment risks, not a deployed system.
Biometric enrolment
Biometrics bind a credential to a body, which is what makes uniqueness enforceable, and they are the only one of the three families here to have drawn sustained regulatory enforcement. World, operated by Tools for Humanity, published on 17 April 2026 that "the real human network now spans nearly 18 million verified humans across 160 countries", alongside integrations including Tinder, Zoom, Docusign and Okta. The figure is the company's own and unaudited. No proof-of-personhood system reviewed here has an independently audited user count.
The enforcement record runs across several jurisdictions. Spain's AEPD reported on 19 December 2024 that Bavaria's BayLDA had ordered the elimination of every iris code stored since the project began, having found an incorrect legal basis for processing specially protected biometric data under the GDPR. On 16 February 2026 the AEPD issued a formal warning after the company notified it of an intention to restart in Spain; the company then told the agency it would postpone the relaunch. Kenya's High Court, per Techpoint Africa reporting of 7 May 2025, ordered permanent deletion of the iris and facial data of more than 300,000 Kenyans within seven days, on findings of collection without a mandatory data protection impact assessment and consent obtained through a financial inducement of roughly Ksh7,000 in cryptocurrency. Thailand's Personal Data Protection Committee ordered iris enrolment halted and collected records deleted, affecting around 1.2 million residents, per reporting of 26 November 2025. A Rest of World investigation of 27 April 2026 catalogues action in India, Brazil, France, Portugal, Argentina, Hong Kong, Indonesia and the Philippines as well, on one publication's account rather than each regulator's own.
The company's position deserves equal weight: it appealed the German order, saying it sought judicial clarity on whether the privacy-enhancing technologies it deploys "meet the legal definition for anonymisation in the EU". That is the crux, and it is unsettled: if an iris code is irreversibly anonymised much of the objection weakens, and if it is not, the regulators are right. Two failure modes survive either answer. A biometric cannot be reissued after compromise. And enrolment uniqueness is not presence: proving someone enrolled once says nothing about who is at the device today, which is why the vendor's own Zoom integration falls back on a three-way match between the signed enrolment image, a live liveness selfie and the video frame other participants see.
Document-based verification
Document checks inherit the state's identity assurance and its coverage gaps. The United States baseline is NIST Special Publication 800-63 Revision 4, finalised in July 2025. It is instructive for what it had to add: it "expands fraud requirements and recommendations for identity proofing processes" and "adds controls for addressing injection attacks and forged media (e.g., 'deep fakes')". The modelled threat is now synthetic evidence submitted at the proofing step. Three failure modes recur. A document proves an identity exists, not that its holder is present. Coverage excludes the undocumented, usually the people least able to appeal. And the method over-discloses: to prove personhood you surrender a name, a date of birth and a number the verifier never needed.
Social graph and vouching
The third family asks verified people to attest to new ones. It is the cheapest to deploy and needs neither a biometric nor a state issuer, and its failure modes are structural rather than incidental. Collusion scales as cheaply as the graph does, a vouch that can be given can be sold, and people with thin networks are excluded by the mechanism rather than by an error in it. The graph is also a richer correlation surface than the credential it supports.
What the W3C specification actually says
The Verifiable Credentials Data Model v2.0 is a full W3C Recommendation of 15 May 2025, which W3C "recommends the wide deployment of" as a standard for the web. It defines a three-party model of issuer, holder and verifier, and pushes cryptography into separate specifications: Data Integrity 1.0 for embedded proofs, JOSE and COSE for enveloping proofs. That gives a standard shape for a claim and a standard way to sign it. It gives no rule about who may issue, what makes an issuer trustworthy, or how a verifier decides a signed claim is true rather than merely authentic. Those remain policy.
The identifier layer beneath is markedly less mature, and the difference matters when grading vendor claims the way we graded jurisdictions in what regulators actually permitted. Decentralized Identifiers v1.0 has been a Recommendation since 19 July 2022. Version 1.1 remains a Candidate Recommendation Snapshot of 5 March 2026, cautioning implementers that "any open class 1, 2, or 3 issues listed in the issue tracker might result in changes to the specification". DID Resolution, which makes an identifier resolvable, is only a Candidate Recommendation Draft of 28 August 2026. Four years after the identifier format settled, the layer that makes those identifiers resolvable has not.
One wrinkle the vendor decks omit: the EU's own Person Identification Data rulebook specifies two encoding formats, ISO/IEC 18013-5 and SD-JWT VC. It does not mention the W3C data model at all. The credential specification that reached full Recommendation is not the format the EU wallet is being built on.
The state deployments are the ones at scale, and they are contested
Regulation (EU) 2024/1183 established the European Digital Identity Framework and has entered into force. The Commission's position is that Member States must provide wallets to citizens by the end of 2026, and that service providers legally obliged to identify their customers unequivocally will be obliged to accept the wallet for authentication.
The contested detail is the face. The PID rulebook states that "mandatory inclusion of the portrait attribute shall apply as of 24 months after entry into force of the Regulation", with an opt-out that leaves the attribute empty. At a committee meeting on 18 June 2026, after opposition from a bloc of Member States on privacy grounds, it was agreed that Member States may choose to make the portrait optional. That is not removal: the data model still carries the attribute, and Member States are not obliged to offer the opt-out to their citizens at all.
Civil society has been specific rather than general. On 5 March 2026 epicenter.works set out five objections: registration certificates that let a wallet detect overasking made optional, pseudonymity restricted to authentication so services can still identify users once logged in, the mandatory portrait, existing passkey products permitted to substitute for genuine wallet integration, and a rewording of the anti-tracking duty from not allowing linkability to merely hindering it. On the last the objection is precise: hindered data can still be obtained, prevented data cannot.
Not every state has pressed on. TechCrunch reported that the United Kingdom scrapped its digital ID scheme on 21 July 2026, abandoning a programme costed at £1.8 billion over three years and a plan to introduce the ID by the end of the current parliament in 2029, after opposition that included what it describes as the second-largest public parliamentary petition on record, signed by nearly 3 million people. India's UIDAI dashboard reports roughly 1.45 billion Aadhaar enrolments. The same technology, opposite political settlements.
Zero-knowledge proofs move the problem rather than removing it
A zero-knowledge proof lets a holder establish a proposition without revealing the data behind it: over 18, resident in an approved set, unique within a registry. The verifier learns the answer and nothing else. We set out that architecture in blockchain privacy for regulated finance, and of everything in this stack it is the component that does most for privacy.
It is not an answer to the objection, and the Electronic Frontier Foundation set out why on 18 August 2026. The issuer of the tokens these schemes rely on "could track every time that credential is used, creating a dangerous trail of metadata on any user they wanted to target". The issuer "could be pressured by authoritarian governments to remove a user's access to a service", which for a credential that gates services means removing that person's access to the internet entirely, and a single point of failure for internet access, EFF argues, contradicts the very idea of a free and open internet. The practical findings are worse: a security researcher bypassed an EU age-verification app with a Chrome extension that tricked it into repeatedly accepting the same "over-18" token, and in that rollout the zero-knowledge features were not switched on outside a closed demonstration build. None of this says the mathematics fails. The objections are about issuance, revocation, deployment and law, and a buyer is buying the surroundings as much as the proof.
Disclosure is already law, and it binds the wrong party
The Commission confirms that Article 50 of the AI Act applies from 2 August 2026. Providers must design systems so that "the individuals concerned are informed that they are interacting with an AI system, unless this is obvious". Generated or manipulated content must be marked in a machine-readable format, with systems placed on the market before 2 August 2026 given until 2 December 2026, and deployers of deepfakes must disclose "upon first exposure at the latest".
The limit is structural. Article 50 binds providers and deployers who intend to comply, and a counterparty attempting to pass as a person is outside that set by definition. It raises the floor for honest systems and leaves the adversarial margin where it was.
Agent identity is a separate problem, and it is earlier
Work to identify agents rather than people started later and is moving faster. An individual Internet-Draft of 26 March 2026, "OpenID Connect Agent Identity Claims for Autonomous AI Agents", profiles OpenID Connect so identity providers can issue tokens for autonomous agents, with required agent_id and agent_owner claims and trust levels L0–L4; it is not an IETF working group document and expires on 27 September 2026. A W3C Community Group, Agent Identity Registry Protocol, was proposed on 24 April 2026 on the premise that "there is no agreed upon mechanism for verifying an agent's identity, its controlling entity, or its authorization scope before interaction begins". The OpenID Foundation's AI Identity Management Community Group is running but pre-specification, and puts the development of standards protocols expressly outside its own scope. None of this work addresses telling a human from an agent.
Cloudflare, whose measurements opened this piece, argued in a separate post of 21 April 2026 that the binary itself is wrong: "there are wanted bots and there are unwanted humans", and traffic is better sorted by intent and behaviour. For most institutional decisions that is the useful reframing. Personhood is a proxy for accountability, someone identifiable, answerable and pursuable, and software with a named principal behind it can satisfy that test better than an anonymous human does.
What can reasonably be asked now
- Which of the three questions does each control in our onboarding stack answer, and which are we assuming is covered by one that does not cover it.
- Where a vendor cites a verified-user count, who audited it, and if nobody did, what the number is being used to justify.
- For any credential we accept, what is the issuer's revocation policy, who can compel it, and what happens to a customer whose credential a party we do not control withdraws.
- Whether the format we are building against is the one our regulator will accept, given that the fully standardised W3C model is not what the EU wallet's own rulebook specifies.
The honest position in September 2026 is that the credential format is settled, the identifier layer is not, state deployments are contested in their details rather than in principle, and the question of whether a counterparty is a person has no owner anywhere. Institutions will answer it with policy, not a specification.
The Paris 2026 programme is archived in the session record and the agenda. The inaugural Gulf edition is at Louvre Abu Dhabi, Saadiyat Cultural District, on 3–4 December 2026, admission by application and review: the edition page, request access.