• data storage and/or backend computation taking place in/on a decentralized / distributed-locus-of-control system,
• where these systems are exposed directly to browsers via regular-web HTTP gateways,
• and where there are well-defined general APIs (these being the "web3" APIs) such that these gateways are interchangeable in the access they provide;
• where a web app can choose to have a relationship (e.g. a paying customer relationship) with their own gateway provider, rather than having one forced upon them;
• and where the user-agent can further enable the user to have their own relationship with different gateway provider, overriding the website's choice of gateway, in a way invisible to the web app. (Just like how UA stylesheets override site stylesheets, in ways invisible to the web app.)
The gateways are a necessary part of the definition, because HTTP is fundamentally a protocol for talking to specific servers, so Web -three, then, is 90% about the particular way in which we hitch decentralized stuff up to that centralized model.
The fact that the website and the user get choice in their gateway, is what makes this a decentralized system, rather than being something like X.509 that's nominally decentralized (anyone can be their own CA root authority for their own DAG-of-trust) but where in practice there's only one public DAG-of-trust forced on everyone by a consortium of browser and OS manufacturers.