Guide
Is your patent encumbered by FIDO or web standards? Questions for counsel before you pitch
Only your patent counsel can tell you whether a standards commitment applies to your patent, and the answer turns on facts you can gather now: who has owned the patent, which bodies they joined, what they contributed, and what the specification actually requires. This checklist sets out those facts and the questions to put to counsel, drawn from the FIDO Alliance, World Wide Web Consortium, IETF, and EMVCo policies as each body publishes them.
All guidesUpdated
Passkeys, web authentication, and payment card security are built on open specifications, and the bodies that write them expect those specifications to be implementable without paying royalties to the companies that helped write them. That expectation is the first thing a buyer's counsel will test when an authentication patent arrives. If your claims touch one of these specifications, the conversation will turn on it before it turns on anything else.
This guide does not tell you whether your patent is encumbered. We cannot, and nobody outside your counsel should try. What it does is explain each body's policy in the body's own published words, list the facts your counsel will need, and give you the questions to ask, so the answer exists in writing before your first buyer meeting rather than after it.
Why does this question come before the pitch?
Because the buyer will ask it first, and a wrong guess in either direction is expensive. If a commitment applies and you pitch as if it does not, you lose credibility and may create risk; if no commitment applies and you discount the patent as if one does, you give value away.
Implementers of passkeys and web authentication have every reason to believe the core specifications are free to implement, and most of them will say so on the first call. A licensing conversation that cannot answer the question with a written view from counsel ends there. One that can, and that shows exactly where the claims sit relative to the specification, earns a second call.
The question is also narrower than owners fear. A standards commitment, where one exists, typically covers what the specification requires and the claims that are essential to it. Each body defines that scope in its own words, and features a product adds on top of a specification, or uses outside it entirely, may sit differently from what the specification requires. Where your claims fall is the question, and it is a legal one.
What does the FIDO Alliance policy say?
The FIDO Alliance changed its patent policy at the start of the decade. The promise is now a commitment to grant a royalty-free license, made by the members who work on or contribute to a specification, and specifications already at Proposed Standard when the change took effect stay under the earlier non-assert promise.
Three details in the Alliance's own FAQ matter to an owner. Who promises depends on membership in the technical working group and on contribution, not on membership in the Alliance alone. Which version of the policy applies depends on when the specification reached Proposed Standard. And members can exclude essential claims within a set window, which automatically brings a patent advisory group together to work the problem.
- Was the patent ever owned by a FIDO member, and in which years?
- Did that owner sit on a technical working group or contribute to a specification?
- Which specification, and which version, could the claims read on, and when did it reach Proposed Standard?
- Did any owner file an exclusion or a disclosure for this patent or its family?
Sourced facts
The FIDO Alliance changed its Patent Policy effective January 1, 2020. The Promise is now a commitment to grant a royalty-free license; before, it was a commitment not to sue. The Alliance's FAQ says that in most practical situations the difference is nothing, but that lawyers argue about details that might matter in certain circumstances.
Source: FIDO Alliance, New Patent Policy FAQ. Checked .
Under the policy in effect from January 1, 2020, only Technical Working Group Members and Members contributing to a Specification grant the Promise, the entire world receives it, and other Members make no commitment at all. Specifications that were at Proposed Standard on December 31, 2019 remain under the prior policy.
Source: FIDO Alliance, New Patent Policy FAQ. Checked .
A Technical Working Group Member has 90 days from a Call for Exclusion to exclude an Essential Claim from the Promise, and an Exclusion automatically convenes a Patent Advisory Group. Members must disclose patents unless they make a royalty-free license commitment; disclosure by non-Members is voluntary.
Source: FIDO Alliance, New Patent Policy FAQ. Checked .
What does the World Wide Web Consortium policy say?
The web standards body's policy is built so its Recommendations can be implemented royalty-free. Working group participants commit to license essential claims on royalty-free terms the policy defines, and may exclude specific claims only through a disclosed, time-limited procedure.
The definitions carry most of the weight. An essential claim is one that cannot be avoided by anyone implementing the normative parts of the specification, judged at a fixed point in time. Claims that are only infringed by enabling technology, or by parts the specification marks as informative, are outside the definition, and the policy treats optional features as normative unless they are identified as informative. The royalty-free license itself is narrow: it may be limited to implementing the specification, and it may be suspended against a licensee who sues the licensor.
Web authentication came to the consortium from the FIDO Alliance's platform specifications, so an owner with a passkey patent may need to ask about both policies, not one.
- Did any owner of the patent participate in the relevant working group, and when did they join?
- Did any owner disclose the patent or exclude claims, and inside which window?
- Does the claimed method appear in the normative text, in optional text, or nowhere in the specification?
Sourced facts
The W3C Patent Policy (15 May 2025 version) states its goal as Specifications that can be implemented on a Royalty-Free basis, and says W3C will not approve a Recommendation if it is aware that Essential Claims exist which are not available on Royalty-Free terms.
Source: World Wide Web Consortium (W3C), W3C Patent Policy. Checked .
A W3C Royalty-Free license must be available to all worldwide, may be limited to implementations of the Specification, may be conditioned on a reciprocal royalty-free license, may not be conditioned on royalties or fees, may be suspended against a licensee who sues the licensor over essential claims, and lasts for the life of the patents.
Source: World Wide Web Consortium (W3C), W3C Patent Policy, section 5: W3C Royalty-Free (RF) Licensing Requirements. Checked .
The policy defines Essential Claims as claims that would necessarily be infringed by implementing the normative portions of a Specification because no non-infringing alternative exists, judged by the state of the art when the first Patent Review Draft with that text was published. Claims infringed only by enabling technologies or by non-normative portions are excluded.
Source: World Wide Web Consortium (W3C), W3C Patent Policy, section 8: Definition of Essential Claims. Checked .
Working Group participants may exclude specifically identified and disclosed Essential Claims only through the policy's exclusion procedure and inside its time windows; for example, a participant who joins after a Patent Review Draft must exclude claims covered in it at the later of 60 days after its publication or on joining.
Source: World Wide Web Consortium (W3C), W3C Patent Policy, section 4: Exclusion From W3C RF Licensing Requirements. Checked .
What happened when claims were excluded from Web Authentication?
The process worked as the policy describes. A consortium member outside the working group disclosed and excluded claims, a patent advisory group was chartered, and its published report concluded that the disclosed patents did not read on the specification, so the work continued unchanged.
The report is worth reading for its method rather than its outcome. It took the excluded independent claims of each disclosed patent and explained why each did not read on what the specification describes. That is the kind of comparison your counsel will make for your patent, and the comparison a buyer's counsel will make too. The report's conclusion about those patents says nothing about yours.
Sourced facts
W3C chartered the Web Authentication Working Group in February 2016, taking as input a Member Submission of the FIDO 2.0 Platform Specifications from members of the FIDO Alliance.
Source: World Wide Web Consortium (W3C), Report from the W3C Web Authentication Working Group PAG. Checked .
After a W3C Member outside the Working Group disclosed and excluded patent claims in August 2016, W3C chartered a Patent Advisory Group on 17 October 2016; the patent holder chose not to take part. The group's report, approved 29 March 2017, concluded that the disclosed patents did not read on the Web Authentication Specification and recommended that work continue without change.
Source: World Wide Web Consortium (W3C), Report from the W3C Web Authentication Working Group PAG. Checked .
What about the IETF and EMVCo?
Both publish patent terms, and they differ from the other two. The IETF asks for early disclosure and prefers royalty-free technology but does not require it. EMVCo's associates programme agreement grants EMVCo a royalty-free license, which it can pass on to implementers, to the intellectual property its participants' patents would necessarily cover, with a short window to opt some patents out after a patent call.
For an owner of an authentication or payments patent, the IETF matters where claims touch internet protocols such as token, transport, or messaging standards. EMVCo matters where claims touch chip card, contactless, tokenization, or payment authentication specifications. We read the IETF's rule document and EMVCo's associates agreement for this guide; we did not review the agreements EMVCo uses for its members, so its terms for members may differ.
- Was any owner an IETF participant who contributed to, or disclosed against, a relevant document?
- Was any owner an EMVCo associate or member, and did it respond to a patent call?
- Do the claims read on a mandatory part of a specification, an optional part, or neither?
Sourced facts
IETF policy (RFC 8179, BCP 79) is designed so working groups learn about IPR constraints on a proposal as early as possible. A disclosure may say whether a license will be royalty-free, on reasonable and non-discriminatory terms that include a royalty, or not needed; licensing information is encouraged but not mandatory.
Source: Internet Engineering Task Force (IETF), RFC 8179: Intellectual Property Rights in IETF Technology. Checked .
In general, IETF working groups prefer technologies with no known IPR claims or, where claims exist, an offer of royalty-free licensing, but they may adopt a claimed technology they judge superior enough to outweigh the potential cost of licenses. The IESG does not decide whether any licensing terms have been met in practice.
Source: Internet Engineering Task Force (IETF), RFC 8179: Intellectual Property Rights in IETF Technology. Checked .
Under EMVCo's Associates Programme Participation Agreement, a participant grants EMVCo a perpetual, worldwide, royalty-free license to its Necessary Intellectual Property in the EMV Specifications, sublicensable to implementers. Necessary means no commercially reasonable non-infringing alternative exists. After a Patent Call, a participant has 45 days to disclose and, except for its own Submissions, may elect not to grant that license for some or all of the disclosed patents.
Source: EMVCo, EMVCo Associates Programme Participation Agreement. Checked .
What facts should you gather before you meet counsel?
The chain of title, every standards membership and contribution by every owner, the specifications and versions that matter, and an honest description of what your product or method does that the specification does not. Counsel's time goes much further when these arrive in writing.
- Chain of title: every owner of the patent and its family since filing, with dates.
- Memberships: every standards body or working group any owner joined, with dates and membership level.
- Contributions: any text, proposal, or comment any owner submitted to a specification.
- Disclosures and exclusions: anything filed with a body about this patent or its family.
- The specification: the exact document and version your claims might read on, with the sections you think are closest.
- Your difference: what your method does that the specification does not require.
What should you avoid while the question is open?
Avoid any outreach that states or implies a conclusion counsel has not reached: that the patent covers passkeys, that no standards commitment applies, or that a named product infringes it. Each of those can create risk and none of them helps a buyer say yes.
- Do not describe the patent as covering a standard in a first message.
- Do not send claim charts against a specification without counsel's review.
- Do not tell a buyer that no standards commitment applies unless counsel has said so in writing.
- Do lead with the product and the result, which stand on their own whatever the answer turns out to be.
Questions for your patent counsel
- Has any owner of this patent or its family been a member of, or a participant in, the FIDO Alliance, the World Wide Web Consortium, the IETF, or EMVCo, and in which working groups and years?
- Did any owner make a licensing commitment, a disclosure, or an exclusion that covers this patent, and under which version of which policy?
- Do any of our claims read on the normative or mandatory parts of a specification, as each body defines essential or necessary claims?
- If a commitment applies, what exactly does it cover, and what does it leave outside, such as non-normative uses or uses outside the specification?
- Does any commitment bind us as a later owner, and does it travel with the patent if we license or sell it?
- Can a commitment be suspended against a licensee who sues, and does that matter for our licensing plan?
- Which of our use cases are clearly outside any specification, so we can lead with those?
- What can we say about standards in a first, non-confidential message without creating risk?
Questions we hear
Are passkey patents royalty-free?
Some commitments under the FIDO Alliance and web standards policies are royalty-free, but whether any commitment covers a particular patent depends on its owners' memberships, contributions, and disclosures, and on what the claims cover. Only counsel can answer that for your patent.
If I never joined FIDO, am I bound by its policy?
The FIDO FAQ says the promise is made by members who sit on a technical working group or contribute to a specification. Whether an earlier owner of your patent did, and what that means for you, is a question for counsel.
Can I still license a patent that touches a standard?
Often there is still a licensing path for features and uses outside what the specification requires. Counsel should map where the claims sit before you decide which use cases to lead with.
Where Patenture fits
Patenture does not give opinions on standards commitments, essential claims, or encumbrance; patent counsel does. What we do is build the commercial side around counsel's answer: which use cases sit clearly outside any specification, which buyers need them, and how to present them. The Claim to Market Read carries a written list of questions for patent counsel, including these where they apply, and a table of what the read did not settle.
By Mike Dayton. Published . Updated .
Every engagement starts with a mutual NDA and a written data-handling annex your counsel can review before intake. How confidentiality works.
Patenture is not a law firm. The claim explainer and the counsel question list are commercial analysis; claim construction, validity, and prosecution strategy stay with your patent counsel, whose access is a condition of the engagement.
Related guides
How do you license a cybersecurity patent? A field guide for security, identity, and trust technology
How to license a security, identity, or fraud patent: the product, the buyer, the standards and award checks, and the first package.
Updated Read the guideCan you license a post-quantum cryptography patent after NIST's royalty-free precedent?
What NIST's royalty-free precedent means for post-quantum patent owners, the migration schedule buyers face, and where licensing room remains.
Updated Read the guideYour product uses the patent and your claims reach three other markets: what do you do?
For companies that ship the patented technology: find the markets your claims reach, screen for conflicts, and license by field.
Updated Read the guide