How we grade
The standard, the doctrine behind it, the scoring rules, and the ways this instrument can be wrong. All of it is published before the first state is scored in public.
Every audit answers one question.
If your data were taken from you tomorrow, sold, leaked, subpoenaed, or used in a way you never agreed to, what, in this state, could you actually do about it?
If the honest answer is nothing, the state does not have digital sovereignty. It has a privacy policy.
Privacy is a defensive frame: keep information from being seen. Sovereignty is an ownership and jurisdiction frame: who holds the data, who can compel its return or destruction, and who answers when it is misused. The audit grades the second.
That is why each audit reads statutes for the exemptions. This series applies the Thinkers Dilemma lens, narrative against structural reality, to legislative text. A press release says what a law promises. The exemption schedule says who it applies to.
Each principle of the doctrine ends in a question a state can be graded against. The rubric is the doctrine turned into a scoring sheet.
Ownership and Accountability are the two heaviest pillars. Accountability carries 30% because it is the only pillar that can invalidate the others. Criteria for every pillar are on the grading system page.
Five pillars, each 0 to 100
Ownership 25%, Consent 15%, Portability 15%, Erasure 15%, Accountability 30%. Each pillar is built from fixed criteria worth fixed points.
Sovereignty Score = weighted pillars, minus penalty
Pillar scores are weighted, the exemption penalty is subtracted, and the result is rounded and held between 0 and 100.
Score laws as enacted
Pending bills score zero. Expansions that litigants hope courts will adopt are not credited. A law is graded as written and as in force.
Absence of enforcement is a finding
A law never enforced scores zero on the enforcement criterion, however elegant its text.
The rubric is frozen for the cycle
Weights, criteria and bands do not change mid-cycle. If a flaw is found, it is published and every prior state is re-scored.
Grade bands
A 85 to 100, B 70 to 84, C 55 to 69, D 40 to 54, E 20 to 39, F 0 to 19. Bands are on the grading system page.
A state with a comprehensive privacy statute can lose up to 40 points for what the statute leaves out: workers, government, most businesses. It is the sharpest instrument in the rubric. A state can pass a celebrated law and still exclude the people and the data that matter.
The penalty applies only where a comprehensive statute exists. A state with no such law cannot be penalized for exemptions in a law it never passed. Its absence is already scored in the pillars.
The deduction table is on the grading system page.
Editorial judgment may cap a score at the top of the D band (54) when the arithmetic flatters a law that changes nothing. The honest question is what a resident could actually do.
It is used sparingly, because used often it eats the rubric's credibility. When it is invoked, the entry shows the arithmetic result and the cap side by side.
Every entry is checked against primary law and carries a date stamp, Last verified, and a dated log of updates since audit.
- A score changes only when an enacted, in-force change moves a rubric criterion. Pending bills score zero until they are law and in force.
- Absence claims are dated. A line such as “no publicly announced enforcement action found” is backed by a dated check of the enforcer's own releases and carries that date.
- Enactment is checked against the signed act. A bill tracker carries the title a bill was introduced under, and a bill can be rewritten after that. Georgia is the lesson: SB 111 was introduced as a consumer privacy act, a House committee replaced it, and the act the Governor signed concerns rural hospital tax credits. The Georgia audit was withdrawn and is being redone. It is the series' first public correction, and it is logged on the update log.
- Reclassification is public. When a state changes category mid-cycle, the entry says so and the change is logged.
- Federal bills are not scored. The rubric grades states. A federal preemption bill is tracked in a watch box, because it would change what the states can do.
Before auditing a state, the series publishes a forecast of its score. After the audit, the forecast and the result sit side by side. The error is the audited score minus the forecast.
- Held. The forecast stood.
- Broken. The audit landed outside the forecast. Virginia was forecast at 40 (a D) and audited at 33 (an E), the first downward break.
- Superseded. The state changed its law between forecast and audit. The error is attributed to the statute, not to the instrument.
So far the error has a pattern: states with no comprehensive law have scored above their forecasts, and states with a comprehensive law have scored below. The headline hypothesis is that no state scores above a C.
- Not neutral. The audit holds positions and invites argument.
- Not a compliance service. It does not tell companies what to do.
- Not anti-technology. The objection is not to the tools, it is to the terms.
- Bipartisan on surveillance. Corporate data extraction and state data collection are two hands of the same problem.
This is a structured editorial judgment, not a statistical measurement. The criteria and weights are choices, and they are published so they can be argued with. The audits are not legal advice.
If the rubric proves flawed, the flaw gets published and every prior state is re-scored. Corrections are logged in the open on the update log, with the original left standing. Send corrections to corrections@thinkersdilemma.com.