A computer-implemented method comprising: receiving, from a client device, a request including an attestation token, the attestation token including: a set of data that includes at least: a user identifier that uniquely identifies a user of the client device; a token creation time that indicates a time at which the attestation token was created; user consent data specifying whether one or more entities that receive the attestation token are eligible to use data of the user; and an action to be performed in response to the request; and a digital signature of at least a portion of the set of data, including at least the user identifier and the token creation time; and verifying an integrity of the request using the attestation token, including: determining whether the token creation time is within a threshold duration of a time at which the request was received; determining, using the digital signature, whether the set of data was modified after the attestation token was created; and determining that the integrity of the request is valid based at least on determination that the token creation time is within the threshold duration of the time at which the request was received and a determination that the set of data has not been modified since the attestation token was created; and performing the action in response to determining that the integrity of the request is valid, wherein performing the action comprises: determining that the user consent data specifies one or more authorized actions that are authorized by the user to be performed by a given entity using the data of the user; and preventing the given entity from using the data of the user for actions other than the specified one or more authorized actions. receiving, from a client device, a request including an attestation token, the attestation token including: a set of data that includes at least: a user identifier that uniquely identifies a user of the client device; a token creation time that indicates a time at which the attestation token was created; user consent data specifying whether one or more entities that receive the attestation token are eligible to use data of the user; and an action to be performed in response to the request; and a digital signature of at least a portion of the set of data, including at least the user identifier and the token creation time; and a set of data that includes at least: a user identifier that uniquely identifies a user of the client device; a token creation time that indicates a time at which the attestation token was created; user consent data specifying whether one or more entities that receive the attestation token are eligible to use data of the user; and an action to be performed in response to the request; and a user identifier that uniquely identifies a user of the client device; a token creation time that indicates a time at which the attestation token was created; user consent data specifying whether one or more entities that receive the attestation token are eligible to use data of the user; and an action to be performed in response to the request; and a digital signature of at least a portion of the set of data, including at least the user identifier and the token creation time; and verifying an integrity of the request using the attestation token, including: determining whether the token creation time is within a threshold duration of a time at which the request was received; determining, using the digital signature, whether the set of data was modified after the attestation token was created; and determining that the integrity of the request is valid based at least on determination that the token creation time is within the threshold duration of the time at which the request was received and a determination that the set of data has not been modified since the attestation token was created; and determining whether the token creation time is within a threshold duration of a time at which the request was received; determining, using the digital signature, whether the set of data was modified after the attestation token was created; and determining that the integrity of the request is valid based at least on determination that the token creation time is within the threshold duration of the time at which the request was received and a determination that the set of data has not been modified since the attestation token was created; and performing the action in response to determining that the integrity of the request is valid, wherein performing the action comprises: determining that the user consent data specifies one or more authorized actions that are authorized by the user to be performed by a given entity using the data of the user; and preventing the given entity from using the data of the user for actions other than the specified one or more authorized actions. determining that the user consent data specifies one or more authorized actions that are authorized by the user to be performed by a given entity using the data of the user; and preventing the given entity from using the data of the user for actions other than the specified one or more authorized actions.