Fork Rights
Exit, voice, and loyalty.
— Albert O. Hirschman (1970)
Why Receipts Are Not Enough
A potter in Arizona sells bowls and mugs through a single dominant marketplace. Over seven years she has accumulated eight hundred reviews, a seller rating that keeps her in the top search results, and a payment history the platform's own lending partner uses to extend a working-capital line every November before holiday demand spikes. The platform is not a convenience. It is her settlement rail, her storefront, her reputation, and her credit bureau.
On a Monday in late September, she receives a notification: her payouts will be held for ninety days. Not because she committed fraud. Not because she violated any rule she can name. The platform has reclassified her category as “elevated dispute risk” after a model retrained on recent chargebacks across the site. The new policy is not aimed at her. It does not need to be. It applies automatically.
The receipt is perfect. Act: payout hold. Authority: Section 12.4 of the operating policy. Bounds: ninety days; inbound payments unaffected. Justification: category-risk recalibration triggered by model version 6.2. Appeal path: independent review within five business days.
She appeals. The arbiter agrees the hold is disproportionate for a seller with her history and orders relief: ten-day hold maximum, with expedited release upon proof of shipment. The platform complies. She can breathe again.
But nothing structural has changed. The classification still exists. The model will retrain again next week. The platform still holds the lever that determines whether her rent clears and whether her suppliers ship clay. She can contest each decision as it arrives. She cannot credibly leave. Departure means forfeiting the reviews that make strangers trust her, the history that makes lenders price her as low risk, and the search rank that makes customers find her at all. She would arrive elsewhere as an unknown seller with no standing and no credit, competing against incumbents whose reputations are trapped inside their own rails.
This is the deeper problem that receipts cannot solve: inescapable coercion. A system in which the affected party can see the harm, contest the authority, even win the contest, and still remain subject to the same operator because exit costs exceed any remedy the appeal can provide.
The pattern is documented. In 2017, PayPal froze the account of a yoga-clothing seller who had used the platform for three years, seized $42,737 after a 180-day hold, then reported the seized funds to the IRS as taxable income, taxing her on money she never received. She received three contradictory explanations from three representatives. The dependency was invisible until severance made it structural.
Albert Hirschman’s Exit, Voice, and Loyalty (1970) names the reason: voice is powerful only when exit is credible. A customer who cannot switch complains into the wind. A citizen who cannot emigrate petitions a sovereign who has no reason to listen. Hirschman, writing about railroads and public schools, could not have anticipated how precisely the framework would apply to platforms. A user who leaves a social platform loses her social graph: the network of connections built over years of interaction, the communication history documenting her relationships, the public identity she has constructed, the reputation she has earned. A merchant who leaves a payment platform loses his transaction history, customer relationships, seller rating, and position in the platform's recommendations. Exit can destroy accumulated social and economic capital that has no value outside the system in which it was created. Oliver Williamson called this "asset specificity": investment that has value only within a particular transactional relationship. The party who has made the investment is locked in by the fact that what she has built is worthless anywhere else. The medieval serf was bound to the land by law; the modern user can be bound to a platform by the non-portability of accumulated capital. The means differ. The result can be the same.
When departure costs exceed submission costs, voice becomes structurally impotent. The user can complain, but the platform knows the complaint carries no credible threat. Receipts ensure that the complaint will be heard, documented, and adjudicated. Fork rights ensure that the complaint carries weight, because the user who is dissatisfied with the adjudication can leave and take her assets with her. A fork right is the right to reconstitute a service, a jurisdiction, or a governance structure using the same rules and data, under different stewardship: constitutional, not technological, distinct from open-source advocacy and from any particular engineering preference. It guarantees that the affected party can take her data, her relationships, and her standing and rebuild elsewhere without forfeiting the investment that makes the current platform valuable.
The Mechanics of Forking
A community of independent bookshops uses a shared platform for inventory management, customer reviews, and inter-store lending. The platform's governance council, which the bookshops helped elect, proposes a change to the revenue-sharing formula: a greater share of inter-store lending fees redirected to the platform's operating fund. A minority of bookshops, roughly a third of the community, objects. They submit formal contestations, request arbitration, and the arbiter rules that the change is within the governance council's authority. The minority disagrees with the ruling.
Without fork rights, the minority's options are submission or departure. Departure means abandoning transaction histories, customer review profiles, inter-store lending relationships, and the years of inventory data that recommendation algorithms use to suggest books to their customers. Departure costs exceed the cost of the fee increase. The minority submits.
With fork rights, the minority invokes its right to fork. Four operational guarantees address distinct dimensions of lock-in.
Data portability means the minority exports its data in the platform's standardized format: inventory records, transaction histories, customer reviews anonymized to protect reviewer privacy, inter-store lending records, recommendation profiles. The export includes relational data defining each shop's position in the network: connections, transaction patterns, community memberships. Without relational data, the user arrives at the new platform as a stranger, having forfeited much of what made the old platform valuable.
Protocol interoperability means the forked platform can communicate with the original platform's network through shared protocols. A fork that cannot transact with the original's users has not achieved exit; it has achieved exile. Customers of the forked bookshop platform can still browse and order from shops on the original, and vice versa. Proprietary advantage lies in quality of service, not exclusivity of network.
Credentialed migration means the minority's reputation credentials (accumulated over years of reliable service, through thousands of transactions and hundreds of positive reviews) transfer to the new instance, verifiable by any participant on either platform. A seller's reputation is hers, earned through the quality of her goods, the reliability of her shipping, the honesty of her descriptions. Its portability is a property right; confiscation upon departure is the mechanism by which lock-in operates.
Governance portability means the group can adopt different rules while preserving the constitutional floor. A fork that copies data and software but leaves the original operator with exclusive control of rule changes has moved the interface without moving authority.
The minority deploys the same open protocol on a new instance, configured with the revenue-sharing formula it prefers. The fork is not a schism. It is a constitutional exercise: the minority has used its structural capacity to leave in order to create a competing governance model, and the original platform must now justify its fee increase to the majority that remains, knowing that the majority, too, can fork if governance deteriorates.
Four things forked in that sequence, and each is a distinct layer of the right. The minority took its data together with the relational context that makes records meaningful. It took its identity: the reputation earned through years of reliable service, portable because the credentials attest to performance rather than membership. It took the rules, adopting the governance formula it preferred while preserving the constitutional floor. And it took its protocol connections, the interoperability that prevents a fork from becoming exile. Data, identity, rules, protocol. A fork that carries fewer than four arrives diminished. A platform that can prevent any one of the four has reimposed the lock-in the right was designed to break.
These guarantees are costly to implement and politically difficult to mandate. They reduce the switching costs that give platforms their market power. A platform that must enable its users to leave with their data, their connections, and their reputations cannot rely on lock-in for retention. It must retain them through quality of service.
Fork Rights as Republican Liberty
A Roman citizen-farmer who owned his land could afford to take up arms against a tyrant. He had something to defend and something to return to. A Roman client who depended on a patron for his livelihood could not effectively resist: resistance meant destitution. Republican freedom therefore requires the absence of present interference and protection against arbitrary interference in the future, which depends in part on a credible capacity to resist.
Fork rights are the computational analogue of this right to resist. A platform that knows its users can leave with their data, connections, and reputations must govern itself with care: not because users fork frequently but because they could. Poor governance produces defection: not complaints that can be absorbed, but departures that reduce the platform's value. Anticipation works in the governed's favor: the platform facing credible exit governs more carefully than the platform facing captive users.
Most users will never exercise the right to fork, just as most citizens never took up arms against their government. The right's value lies in its existence, not its exercise, because existence changes the calculus of power on both sides. The governed need not resist; they need only be capable of resistance. The governor need not be virtuous; the governor need only know that the governed can leave.
Resistance required material preconditions. Economic independence made political independence possible. Fork rights serve the same constitutional function in the computational domain. A user who can leave with her data, connections, and reputation has the computational equivalent of the citizen-farmer's land: a foundation from which resistance is possible and to which she can return. A user who cannot leave has the computational equivalent of the client's dependence: her voice structurally limited by her inability to make departure credible.
The Portability Problem
The most serious objection to fork rights is that portability of relational data creates a privacy problem. If a user can export her social graph, she is exporting information about other people who may not have consented to the export. If a merchant can export his transaction history, he is exporting information about his customers. One party's fork right implicates the data of parties who did not choose to participate.
A fork must carry enough relational structure to remain useful without treating third-party data as the forking user's property. Some relational data can be represented without disclosing counterparty identity. A social graph exported as anonymized nodes with connection weights allows a forked platform to reconstruct network position (centrality, clustering, community memberships) without revealing who the connections are. Transaction histories exported as frequency distributions, category summaries, and aggregate volumes preserve commercial patterns without individual details. Reputation credentials can attest to performance metrics without disclosing the specific transactions that produced them.
Zero-knowledge proofs, selective-disclosure credentials, secure multiparty computation, and related techniques can support parts of this design. They do not make the policy problem disappear. A proof that a seller exceeds a threshold still depends on who issued the underlying credential, what the threshold means, and whether the receiving platform accepts it. Some relational context cannot be exported without exposing another person's interests. The right therefore includes a duty to minimize third-party disclosure and an independent process for deciding what cannot travel.
The constitutional framework does not require that every privacy-preserving mechanism be deployed today. It requires that the right to fork be established, that privacy constraints be specified, and that engineering be pursued with the seriousness a constitutional guarantee deserves.
What Fork Rights Do Not Solve
Fork rights address inescapable coercion but not universal coercion: the situation in which every available platform implements the same abusive practices, and forking from one to another merely changes the surveiller without changing the surveillance.
They also fail when no alternative can perform the essential function. A refugee cannot fork a border, a patient may have no second hospital within reach, and a merchant cannot carry reputation into a market whose dominant buyers refuse portable credentials. In those cases, exit cannot substitute for voice. The institution exercising unavoidable power owes the constitutional floor whether or not competition exists, and the affected person needs representation, interim relief, and a forum capable of ordering a remedy.
Nor is exit equally available. Capital, language, disability, legal status, network effects, and collective-action costs determine who can use a nominal fork. A right measured only by whether export is technically possible will protect the organized and solvent while leaving the most dependent exactly where they were. Credible exit is assessed from the position of the affected class, including the cost of maintaining service during migration and the risk of retaliation by the incumbent.
If the dominant business model is surveillance-based advertising, every platform built on that model implements similar data collection, similar behavioral profiling, similar manipulation of attention. Forking between architecturally identical systems is migration, not escape. Fork rights are meaningful only if genuinely different governance structures exist, and the fork right alone does not guarantee their existence.
Fork rights can create conditions for competitive governance by reducing switching costs. Competition still requires capital, interoperability, legal access, and institutions willing to recognize portable standing. The receipt regime, civic asymmetry, and the constitutional machine provide a floor beneath that contest so a person is not told to “just leave” an unavoidable system. Above the floor, platforms and communities can compete on privacy, transparency, and control.
A market for governance remains a proposal, not an automatic result of lower switching costs. Competition may improve service; it may also converge on the same profitable abuse or be defeated by network effects. Fork rights give users bargaining power and make alternatives more buildable. They do not relieve public law of the duty to govern chokepoints that people cannot route around.
Contestability requires credible exit. Without fork rights, receipts become petitions. If contestability can be maintained without exit rights, this claim is wrong.