Irony: the contract for the web, while giving you the option to control your cookie settings at first glance just drops to a prompt that all cookies are strictly necessary, so you should just accept them, because they are a request for service.

No wonder Google and Facebook signed on so quick! They'd be happy to give the appearance of accommodating to grant you control, whilst in reality nudging you right back toward the typical exploitation path.

Furthermore, some of the principles seem to be self-defeating. "Gender responsive" and most of the principles that have to do with "systemically underserved groups" assume the capability to granularly determine or "target" those in that group; something that defeats the purpose of not being able to isolate one group or another from service. This is one of those cases where setting access constraints on a geographic basis would actually be helpful, as it removes any semblance of an individual's identifying information or circumstance (except geographic location) from the equation.

Will update as I get further, just got through the government section, and I'm liking what I see in general, but I still feel that there is a heck of a lot of concession in the form of implicitly playing exploitative behavior by large actors getting enshrined in this thing.

Edit:

Under "Keep the Internet available all the time", there are the typical carve outs for trying to allow content takedowns in ways grounded in law, but consistent with human rights without any concession to any of the problems such a carve out creates. See copyright trolling, DMCA abuse, et al.

Government protection and establishment of data rights is actually pretty good.

The Companies section is basically a regurgitation of the Government principles with slightly modified language. No comments offered with regards to multi-nationals, or any responsibility to not act in a parasitic manner to the user base at large. Again, I can see Google and Facebook buying into this, because legalistically speaking they can say they've already done most everything, and there is no implied commitment to actually do or remedy any of the socially unhealthy things they engage in as business verticals.

Principle 6 has the potential to become problematic, as what is the "best" and "worst" of humanity changes with the beholder. I.e. businesswise, the worst aspects of human nature drive the best KPI's; so from their point of view given massive blinders, they'd be doing exactly what they are supposed to on the tin.

The Citizen section is okay; though 8 still enshrined traceability of groups. Building that in just seems to be championing the process of using web-based metadata collection as a viable course of doing business, and does nothing to condemn targeting of specific groups.