A method for privacy policy enforcement to ensure reconciliation between a user and a service provider communicating via an open system interconnection "OSI" communication architecture, the method comprising: receiving, by a privacy settlement bureau (208, 408, 508), a privacy policy for a device of the user; receiving, by the privacy settlement bureau (208, 408, 508), a usage policy for the service provider, wherein the privacy settlement bureau (208, 408, 508) remotely manages policies for the user and the service provider; receiving, by a first server (407, 507), via a network having a privacy layer monitored by the privacy settlement bureau (208, 408, 508), at least one dataset (409, 509) from the user's device to be sent to the service provider, wherein the at least one dataset (409, 509) comprises at least one data segment; receiving, at the first server (407, 507), from the privacy settlement bureau (208, 408, 508), a privacy policy enforcement vector comprising encryption codes; encrypting, by the first server (407, 507), the received at least one data segment based on the received encryption codes; receiving, at a second server (417, 517), from the first server (407, 507), at least one encrypted data segment; receiving, at the second server (417, 517), from the privacy settlement bureau (208, 408, 508), a selective corresponding keys vector having selective decryption keys corresponding to the encryption codes and configured to allow decryption (415, 515) of at least one encrypted data segment when a match between the privacy policy and the usage policy occurs to decrypt the at least one encrypted data segment; and performing selective decryption, by the second server (417,517), for each received at least one encrypted data segment based on the selective corresponding keys vector, wherein at least one encrypted data segment is decrypted when a match between the privacy policy and the usage policy occurs, wherein at least one of the first server (407,507) and the second server (417,517) is external to the user's device and the service provider, and wherein the decrypted at least one data segment passes through the privacy layer added to the OSI architecture, the privacy layer being in communication with the user's device. receiving, by a privacy settlement bureau (208, 408, 508), a privacy policy for a device of the user; receiving, by the privacy settlement bureau (208, 408, 508), a usage policy for the service provider, wherein the privacy settlement bureau (208, 408, 508) remotely manages policies for the user and the service provider; receiving, by a first server (407, 507), via a network having a privacy layer monitored by the privacy settlement bureau (208, 408, 508), at least one dataset (409, 509) from the user's device to be sent to the service provider, wherein the at least one dataset (409, 509) comprises at least one data segment; receiving, at the first server (407, 507), from the privacy settlement bureau (208, 408, 508), a privacy policy enforcement vector comprising encryption codes; encrypting, by the first server (407, 507), the received at least one data segment based on the received encryption codes; receiving, at a second server (417, 517), from the first server (407, 507), at least one encrypted data segment; receiving, at the second server (417, 517), from the privacy settlement bureau (208, 408, 508), a selective corresponding keys vector having selective decryption keys corresponding to the encryption codes and configured to allow decryption (415, 515) of at least one encrypted data segment when a match between the privacy policy and the usage policy occurs to decrypt the at least one encrypted data segment; and performing selective decryption, by the second server (417,517), for each received at least one encrypted data segment based on the selective corresponding keys vector, wherein at least one encrypted data segment is decrypted when a match between the privacy policy and the usage policy occurs, wherein at least one of the first server (407,507) and the second server (417,517) is external to the user's device and the service provider, and wherein the decrypted at least one data segment passes through the privacy layer added to the OSI architecture, the privacy layer being in communication with the user's device.