Consumer Data Standards

The Consumer Data Standards (CDS) are the technical rulebook for Australia’s Consumer Data Right (CDR) regime, published and maintained by the Data Standards Body (DSB). Where the CDR is the law, the CDS is the machine-readable contract that makes the law real — a single OpenAPI-described API that every accredited data holder re-hosts under its own base path.

• A mandated, uniform contract - The DSB publishes one Banking API specification (e.g. v1.36.0) and every bank ships the identical surface: products, accounts, balances, transactions, direct-debits, scheduled-payments, payees, and customer. Cross-provider differentiation at the API layer is close to zero by design.
• A two-surface access model - A public, unauthenticated Product Reference Data (PRD) surface anyone can call with only an x-v version header, and a consent-gated consumer data sharing surface requiring the full FAPI stack and CDR accreditation.
• A standardized, least-privilege scope model - Consent maps to scope, scope maps to resource, using a byte-identical CDR scope set (bank:accounts.basic:read, bank:transactions:read, common:customer.detail:read, and so on).

The CDS is the cleanest specimen in my catalog of a regulator forcing machine-readable substance: it dragged an entire banking sector across the machine-readability line most industries are still arguing about. The lesson from scoring it is that the mandate produced existence, not quality — a valid OpenAPI and bank-grade auth as the floor, but governance, operational transparency, and commercial clarity left to each provider. For anyone building on CDR, the standard is the surface; the differentiation lives entirely in the developer experience and product surface built around it.

The energy extension — and what it proved

The Consumer Data Standards were written for banking and then transplanted into energy, which makes them the only instrument in the API Evangelist sector series to have been tested twice, in two different industries, under the same law, regulator and standards body. That is as close to a controlled experiment as this field offers, and The State of Australian Energy APIs measured it.

It worked. Across ninety-five newly researched energy organizations, those with a live, verified mandate implementation average 42.2. Those with no obligation average 30.2. Australia leads the four-market energy quartet at 41.6 with agent-readiness of 57.3, against the United States’ 30.2 — and the United States has a perfectly good voluntary standard, Green Button, that it has had for a decade.

Three findings are worth carrying into any future designation:

• Verification is the whole game. Organizations that claim the mandate but whose implementation could not be verified average 30.4 — lower than having no obligation at all. A compliance page is not an endpoint, and an assessment that reads the first will get the answer backwards.
• A mandate is the only thing that produced a shared vocabulary. Four Australian retailers publish byte-identical cds-energy and cds-common documents. No unmandated market in the study shares a domain resource across more than two organizations — not through a standards body, and not through commercial pressure to interoperate.
• The obligation transplanted; the architecture did not. In CDR banking every bank self-hosts its own Product Reference Data — one contract, fifty deployments. In CDR energy that data is centralised at the regulator: AGL’s own base URI returns 404 on /energy/plans while the AER’s gateway serves 1,343 AGL plans anonymously. Same law, redesigned topology.

What the mandate did not produce is governance. Australian energy scores 1.6 on that facet, with twenty-one of twenty-four organizations at zero. The CDR specifies the schema, the security profile and the consent model, and says nothing about versioning or deprecation — so nobody wrote one. Compliance is not governance, and a mandate delivers only what it asks for.