Silicon Valley is terrified of California’s privacy law

https://techcrunch.com/2019/09/19/silicon-valley-terrified-california-privacy-law/

by ssklash • 7 years ago

566 534 7 years ago

rdlecler12• 7 years ago

So the author would rather see each state/country implement it’s own laws so that a small startup needs to ensure they comply with hundreds of regulatory jurisdictions... awesome.

buildzr2• 7 years ago

I'm just going to ignore them all until my actual operating jurisdiction implements one, I'm not beholden to the laws of another country, let alone a specific state in it.

social_quotient• 7 years ago

I’m not sure this is entirely true. Texas for example has some pretty big arms (long-arm statute) when conducting business in or with a resident or Texas business.

Maybe helpful - http://euro.ecom.cmu.edu/program/law/08-732/Jurisdiction/Lon...

badrequest• 7 years ago

or, you could not start a business that requires you capture every single facet of a person's life as a data point.

LanceH• 7 years ago

But you'll start a business which captures some data, and you're on the hook for proving that everything captured is necessary and compliant in hundreds of jurisdictions.

mitchdoogle2• 7 years ago

The gist of these laws are all the same. Just respect ALL users' data from the start, and you shouldn't have any difficulty with compliance.

clay_the_ripper• 7 years ago

Totally disagree. Complicate is not the same thing as following the spirit of the rules. Compliance is proving you followed the rules. Totally different. Also, you have to define what you mean by “respecting privacy”. Something that I do on my website, like basic retargeting marketing for abandoned shopping carts doesn’t feel to me like an invasion of privacy. To you, it might. The rules have to be defined clearly.

bcheung3• 7 years ago

Many companies have to RADICALLY change their architectures just to support these laws. And often the costs will be enormous. How do you scan all the logs that might somehow have an association with the requesting user that are in cold storage and alter data on write only archived optical media? You have to make an entire copy of it with those data removed. It's not about just treating customers better. It's government dictating the technical architecture.

opportune3• 7 years ago

This is not true, unless by “respect” you mean “do not collect any at all”. I would argue that you could respect users’ data without implementing data takeout, for instance. I would also argue that cookies not used for tracking do not need disclosure for users to be respected

Anyway, the only companies that will end up being able to collect data at all are there very biggest ones. Everyone else will have to just fly under the radar or use some kind of SAAS solution to comply with the patchwork of regulation. Not sure that’s really the desired outcome

Steven_Vellon2• 7 years ago

If there was an easily defined definition of "respecting users data" the we wouldn't be in this situation. Plenty of people think putting a clause in the EULA that says user data can be monetized is being respectful of user data, but this is often prohibited by law. Plenty of people don't think having a tool to dump user data is necessary to respect user data.

novok3• 7 years ago

The GDPR is pretty bad for under 5 engineer startups. They can be very privacy respecting small businesses that charge for their product, like sql training courseware[0], and wouldn't mind clearing what little personal data they had on you (user server logs, billing info, etc).

But being privacy respecting and properly complying with GDPR with audit log systems, etc are 2 different things that require hiring 1 or 2 extra engineers or causing them to pause the companies roadmap as 1 or more people implement government bureaucracy infrastructure for half a year.

If they say it's easy and cheap, then they haven't actually tried to do it properly and are exposing themselves to multi-million dollar penalties.

[0] https://www.brentozar.com/archive/2017/12/gdpr-stopped-selli...

tylerl2• 7 years ago

Bullshit. "Respect users data" means different, incompatible things to different people and in different circumstances. You can't "respect" all of them at the same time.

Take the data deletion requirement. I know of many instances where users have permanently lost absolutely critical data because of that provision (already found in other privacy laws). When a user (accidentally) indicates they want you to delete their content, the provider has to permanently delete it within a reasonable timeframe, including purge from all backups.

Most users don't give a flying f'ck about all this privacy BS, but they care very much about what happened to their Master's thesis. They want a company who will be able to rescue them from their own mistakes. They want dependability. But they get "privacy" instead, and their accidentally wishes that you purge all their stuff gets obeyed.

Maybe you call that progress. But it really sucks when you purchase vague hypothetical benefit at the cost of real-world misery.

katabatic• 7 years ago

How is that different than, well -- anything? In the United States all 50 states can make their own laws; it's a fundamental part of our legal system.

As for every country making their own laws - well, yeah? That's what sovereignty is all about?

javagram3• 7 years ago

In cases where the Feds have decided there should be a uniform standard, states can’t make their own law. https://en.m.wikipedia.org/wiki/Federal_preemption

bpodgursky2• 7 years ago

Yeah... CCPA and GDPR have proved that large enterprises will do just fine, because Amazon can always afford enough lawyers to handle regulatory overhead and confusion across territories.

The startups end up either (1) ignoring the laws or (2) giving up.

Good job EU, if making the FAANGs the only companies with the clout to hold customer data or break into new markets was your primary goal.

TazeTSchnitzel4• 7 years ago

GDPR is not a difficult law to comply with for an EU company, unless you're adtech.

bcheung3• 7 years ago

Essentially, yes. And don't forget all the other ones from other countries as well.

PopeDotNinja• 7 years ago

And that's how privacy compliance as a service was born.

Sweetness• 7 years ago

i hate this, but you're right. pointless regulations that lead to pointless jobs to oversee and sell compliance is such a net waste for society.

tchock233• 7 years ago

Unfortunately, you’re correct. Post GDPR I’ve been pitched many times by EU companies trying to be my representative for GDPR, so if that is any indication we’ll see a booming industry for that in the US as well...

Funny enough, the emails sent by these companies are not GDPR compliant and they’ve given me no indication as to how they gathered my info, nor do they give me an opt out.

TazeTSchnitzel4• 7 years ago

No, a federal law that's as good as or better than CCPA would be great. But they know that's not what will happen.

rdiddly• 7 years ago

That's how it is with lots of things governed by laws though. Even murderers have to deal with a confusing patchwork of laws and penalties. "Do they have to prove premeditation in this state? Can the degree of the charge be changed at trial? Is there a death penalty?" It's getting so small-time murderers have to have a wall of law books just to do business!

ryandrake• 7 years ago

If your business is operating so close to the boundary of the law that you could be breaking it in some places but not others, then yea, you should be worried.

If your business operates well above board and is not doing anything close to what might be the danger zone, then you should have nothing to worry about.

It's always the folks walking right next to the cliff complaining about how complicated their path needs to be.

munk-a2• 7 years ago

Each state can choose to be as restrictive as they like in their laws, and each startup can chose to invest in compliance on a wide scale or in the narrow scale as they'd like.

It'd be nice if this was unified but it ain't because:

1. Tech companies lobby like hell at a national level

2. The national government is sort of broken right now

so that's how the cookie crumbles. The fact that a number of companies have skirted local regulations and abused data usage so much is why this is happening, so don't blame the victims of this activity that want sane privacy laws - blame the bad actors that have forced this issue to need to be dealt with.

Kalium3• 7 years ago

Each state can choose to be as restrictive as they like in their laws, and each startup can chose to invest in compliance on a wide scale or in the narrow scale as they'd like.

There's a special hell that exists where one state mandates records must be held for at least seven years and another mandates deletion at five. When the two states border one another and you may not have home addresses, how do you determine how to comply for a given user?

You're absolutely right, in every way, that tech companies have brought this regulatory backlash on themselves. Yet, it might still be worth considering the potential costs.

jjuhl3• 7 years ago

Just don't do stupid privacy violating shit and you'll be fine anywhere.

Collect no information. Share no information. You are good - everywhere. And that really ought to be the default behaviour..

GreenJelloShot• 7 years ago

That is what they said about GDPR...

fragmede• 7 years ago

I'm not sure how ecommerce works without some information from the user, such as what they're trying to purchase, the quantity, a shipping address, and some form of payment, most likely a credit card.

opportune3• 7 years ago

How are you supposed to do any business over the internet without collecting information?

SomeOldThrow2• 7 years ago

You could also not track or store PII.

nathanyz• 7 years ago

"With great scale, comes great responsibility"

milesskorpen2• 7 years ago

Does anyone know the real implications of the CCPA for things like Sift Science, Google's Recaptcha, and maybe even Cloudflare?

All of these are based on many companies contributing information about users to create profiles which curb abuse. And Sift/Google/etc. get commercial benefit from this data sharing, which might trigger the CCPA. But you can't give bad actors the ability to opt out of this kind of data sharing without crippling them.

I think these kind of companies are really important to a functioning internet. I hope there are carve outs of some sort, but seems like they're living on the edge right now.

matty22• 7 years ago

If Recaptcha gets the ax due to CCPA, the internet will be better off for it.

milesskorpen2• 7 years ago

There needs to be some way to identify non-humans and/or malicious actors.

HALtheWise• 7 years ago

Do you have a proposed alternative way of preventing spam? Neural networks basically mean that any traditional captcha too hard for a bot is also too hard for a human.

mehrdadn• 7 years ago

If the Environmental Protection Agency can hold a straight face while revoking California's ability to protect its own environment with higher standards, I'll hold off on getting excited about privacy laws until we see the FTC/FCC/etc.'s response.

tspike• 7 years ago

A significant part of the fear comes from how poorly worded it is.

itronitron• 7 years ago

all each company has to do is click 'accept'

quadrangle• 7 years ago

BINGO!!!

Hah!

TazeTSchnitzel4• 7 years ago

Broad wording means companies have to be conservative (collect less data) and less loopholes. That's a win for the ordinary person.

tick_tock_tick2• 7 years ago

Or realistically it means they will collect the same and wait for clarification. Since it's worded so poorly they won't be punished for it or going by past examples in California the fine will be so small it was worth it.

summerlight• 7 years ago

Broad wording usually has a higher risk of being ambiguous thus violating the vagueness doctrine. This is not a strictly better thing; all the efforts invested to the law can be easily invalidated by 9 justices due to the poor wording.

gojomo2• 7 years ago

So many NYC-based journalists who love to spit all over "Silicon Valley".

Is there room for a TechCrunch-like publication with a more Silicon Valley-influenced editorial bent? (There's already a massive surplus of sneering Brooklyn-based scolds in "tech media".)

Barrin92• 7 years ago

Is there room for a TechCrunch-like publication with a more Silicon Valley-influenced editorial bent?

are you actually asking for someone to purposefully preach to the quire? The function of journalism is to speak truth to power, you think facebook et al need any further help? I think they actually paid the telegraph for a series of agitprop articles, you might want to check those out.

corebit• 7 years ago

"are you actually asking for someone to purposefully preach to the quire?"

He's both rightfully pointing out that TechCrunch is preaching to one minority choir and asking for another publication to preach to a different choir. Ironically the publication he's asking for was TechCrunch before it was bought by AOL and ruined.

throawayuk55po3• 7 years ago

We need to have a conversation about jurisdictions in the digital age. The way governments have decided that having a website accessible in a country makes you liable to respect the law of this country is a convulted and hacky notion that has been accepted way too fast.

The physical establishment rule was the only sound approach. The fact that some countries started to lose shouldn't have allowed them to rewrite the rules (especially in such a hacky manner).

Can you imagine owning a grocery store and having to ask every customer their nationality to check which law you must follow to do business with them? Then multiply this hell by 10 and soon 1000 considering new laws created left and right and you have the environment these dishonest politicians have created.

javagram3• 7 years ago

Just block your website from being accessed in any country where you aren’t sure you can comply with their laws.

A lot of sites are doing that for GDPR.

dantheman• 7 years ago

The country can choose the block the website. Why should you have to do it?

elondaits• 7 years ago

The GDPR only applies to websites / companies that either have offices / legal status in a european country or that specifically target / sell to europeans (e.g. they place ads in Europe, ship merchandise to Europe, etc.). You don't need to block european countries if you have no business or interest there.

FussyZeus• 7 years ago

We need to have a conversation about jurisdictions in the digital age. The way governments have decided that having a website accessible in a country makes you liable to respect the law of this country is a convulted and hacky notion that has been accepted way too fast.

You know if you turn that around and say "How come we have to respect the laws of every country we do business in?" it sounds a lot more self serving.

Nobody said your website had to serve Californians. Nobody said your iPhone game has to be accessible in North Korea. Nobody said your movie has to be viewable in China.

If you're intending to serve any product to an entire planet composed of nations, states, societies all pulling from different experiences, different cultural attitudes, I think expecting a completely friction-free experience in doing so is more than a little unreasonable.

And more to the point that this particular discussion is about, these are principles that pretty much every society could reasonably get behind. Sorry that means mining data isn't a solid business model anymore, but I'm also not even remotely sorry. Adtech should die. It's a blight on our society.

ohduran3• 7 years ago

This. Imagine if you said the same thing with taxes. "Gee, why do I have to pay taxes differently in every country?" Well, because that's what you have to do if you want to do business there. You're not forced to do anything in here if you don't want to; if the opportunity is worthy, others will take your place.

Same with the laws, especially those that remove agency from the users.

fennecfoxen• 7 years ago

Nobody said your movie has to be viewable in China.

You will of course forgive me if I do not find economic favoritism that benefits politically connected industrialists, the restriction of freedom of thought by oppressive governments, and the general Balkanization of the Internet, to be things that we ought to celebrate.

Once upon a time the memes of Internet culture would suggest that "information wants to be free!" Oh, sweet halcyon days of yore!

throawayuk55po3• 7 years ago

We need a principle-based approach, sound societies can only be built with sound principles.

If I have interesting ideas, I could write a book and sell it in every country of the world. Then this product would be taxed and would need to respect the publication-related laws of that country. On the other hand, if someone reads my book and then travels across the country to hold free seminaries to teach my ideas to the masses, it is not reasonable to try to tax this value transfer, but this is exactly what governments have decided to do.

You see: values vs principles. We can have values but we need to articulate sound principles to give life to these values. What you describe are values.

And what I contend is that we already had sound principles, principles developed across decades and even centuries. The physican establishment rule is the only sound and workable principle.

What we have now is a mess encouraging anti-democratic dynamics (centralization, fingerprinting, and ironically data collection since you need to know more about consumers to know how to apply the laws), in addition preventing innovation and making business difficult.

All of this while for every non-taxed value under traditional principles, a taxable value is actually created... but for some reason nobody is interested in investigating this correlation... for example, the person holding seminaries pays a tax on the room he rents for the seminary. But government prefer to go hard on their propaganda.

If a country wants to tax the books royalty, it should focus on upping its game to attract intellectuals instead of hacking together unsustainable notions to tax "learning".

Similar things could be said for advertising company. When an advertiser advertises in a country, it is by definition to sell a product that most of the time will be taxed into the country (and even if it doesn't, this value transfer will at the 2nd or 3rd degree lead to an activity that can be taxed).

This is why principles based on physical presence and not abstract fictions are not only sufficient and sound but they are also fair. The same is true for privacy, which are after all transactions of their own kind. If you want to regulate data, make sure people use services based in your country by creating the proper environment instead of hacking together extraterritorial laws based on wacky principles.

Just compare these new frameworks, with the readability of the physical establishment principles, that been able to accomodate even the most complex business models for centuries.

Principles should be a foundation, not something you throw out of the window as soon as you start losing to avoid confronting your difficult challenges at the cost of creating an international mess. Digital is not complex, and does not require complex regulations. Trying not to adapt to the world and not to confront your true problems is the only that is complex.

tchock233• 7 years ago

Not everyone has data mining and adtech as a business model. Why should people running legit online businesses that do not involve mining data be punished for unscrupulous actors in the adtech biz?

xwdv• 7 years ago

You are dead wrong.

A completely friction free experience is exactly what you should expect.

Every political obstacle we create for data traveling through wires undermines the entire point of having an internet, and cedes more power to legislating bodies who are clueless about technology.

An individual should be empowered to serve data to another individual anywhere in the globe without barriers, period. If people can’t get behind that idea, then just get the fuck out of the way.

c3534l• 7 years ago

The problem is that both views are essentially correct. The business is located in one country, but the customers can be in any country, and customers are not really entering another country and the businesses are kind of, but not really doing business "in" another country, to the extent that they know what country they're doing business in at all. We're still at that stage in the computer of using physical analogies to reason about how things "should be" even though those metaphores don't really work anymore.

danShumway8• 7 years ago

As a user, I want to be able to access any website online without providing them my location data (even approximate).

As a user, I want to be able to pay or donate to a company or individual without providing them my identity or location data. This is already an extremely hard thing to do because of tax laws like VAT. Please don't make it harder for me.

As an activist, I want everyone to use technology that by-default masks their physical location from websites they access. I want them to feel free not to provide their physical location to anyone online, including businesses like Facebook.

As an activist, I want the majority of popular online payment systems to avoid revealing a buyer's physical location by default, and I want users to feel free to not provide their physical location when paying for a digital product or giving money to another individual. This is already a (nearly) impossible goal because of the sheer amount of tax and money-laundering laws that need to be addressed first. Please don't make it harder.

Laws that force websites to geo-lock based on consumer location are going to be (in the long run) bad for privacy and bad for the open Internet. I don't care about what businesses do or don't want, but the strategies we use to take down advertisers and data-hungry corporations matter.

My less-charitable reading of this situation is that people are generally fine with using user-location as an indicator of jurisdiction because the laws working on that principle are primarily pro-privacy right now. If these laws were being passed in other areas, I wonder if people would be more nervous about the precedent they set.

kansface• 7 years ago

The GDPR doesn’t apply to European IPs, it applies to Europeans. It would be like a French guy showing up at the grocery store you run and now you have to obey EU regulations or be subject to massive fines. Also, half of the grocery stores in the US now flat out refuse to do business with the French, or any American expatriates. The other half make people with French accents fill out a disclaimer form before they can enter which is also somehow against EU regulations in some cases... but it’s mostly OK for now, because the law weirdly seems to only be enforced against large US multinational food chain suppliers who were able to out compete local French companies. To top it everyone thinks this was such a success that they are racing to pile on with California leading the charge.

opportune3• 7 years ago

The issue is that with the internet, the default option is “available everywhere” whereas basically any other commercial thing is only available in a physical location, because that’s where the good is being sold/ the service is being offered. The main thing similar to tech is media, but even if someone in a country where some media content is banned is caught consuming that media, the consumer is punished rather than the producer.

I am actually in favor of privacy regulations. But there are two major issues that most people don’t understand

- Compliance is not easy if you do anything much more complicated than serve a static website. Basically anything business related will have PII. And you can introduce PII accidentally with things like logging, putting it in places it shouldn’t be

- Because the internet is open by default you need to comply with basically every single regulation on the planet, and the burden is fully on you to know how and why you comply with those regulations. (Some places will just firewall you, which in many ways is better, but others just want to make money off you)

baddox• 7 years ago

If you're intending to serve any product to an entire planet composed of nations, states, societies all pulling from different experiences, different cultural attitudes, I think expecting a completely friction-free experience in doing so is more than a little unreasonable.

Is it so unreasonable? Given that the Internet essentially solves the problem of technically doing this, perhaps it is in fact the laws which are unreasonable.

Your statement isn't so different from saying "it's unreasonable to expect to be able to have a nearly-instant audio conversation with virtually anyone on the planet for very little cost." I would give the same response: that no, that's really not that unreasonable given that the technical problems are essentially solved, and if there are laws preventing that, perhaps the laws are unreasonable.

exar0815• 7 years ago

This is manifestly bullshit. When I as an Engineer build a physical product, I have to take care that it fulfills the legal and normative requirements of every place I plan to sell it. The product of a software company is said software. The "storefront" is their website. When I cater to a global audience, I have to make sure I fulfill all requirements. Period. No matter what I sell.

Now, there are ways around it. Either agree on a supernational legal frame , for example a car which is certified in one EU-Country is deemed certified everywhere (something Tesla used to great effect) or have one reliable entity for certification (like the FAA was in Aerospace, which is most likely bound to change).

But putting the onus on the customer to find the legalities in the origin country of the software/website provider is not the solution. Especially for large providers. Just an example question: Where is the website "legally" located? The company's HQ? The local office? The office of the developers? The main database? The CDN-Server for your location?

edit:formatting/typos

throawayuk55po3• 7 years ago

Why do you have to respect national norms? Because there will be health and safety implications within their country.

In the case of visiting a website, the customer is the one visiting you, there is no good rational to put the burden on the business. It is much more sound and natural to either put it on the consumer, a business may be visited by nationals from hundreds of juridisction, while a consumer will only visit 1 or 2 businesses.

You can also decide that the laws of the country in which the business is based apply.

You make it sound more difficult than it actually is, every website selling software products already mentions the address of the owner, at the very least to define a party for the contract / terms of service.

novok3• 7 years ago

I think a good metaphor to think about this is how a book store in new york will be visited by people from hundreds of countries, where some of the products they sell there are illegal in some countries because of obscenity laws.

If the EU made a law that made the NYC bookstore liable in the EU for selling "obscene" books to europeans, and then arrested the unaware bookstore owner in a vacation to france, is that really right?

That is a big issue with the GDPR in general.

criddell2• 7 years ago

Can you imagine owning a grocery store and having to ask every customer their nationality

For privacy matters it's easy though. The UN has declared that privacy is a human right for all humans in all countries.

ohduran3• 7 years ago

The UN has no way to enforce anything. It comes down to individual countries in the end, and sometimes that's too general.

ssivark• 7 years ago

A natural consequence of your suggestion would be the legislative/EULA analogue of "tax inversion", whereby major companies would move "physical presence" (for some technical definition) to a legislatively lax state/country, and states would have a race to the bottom to attract companies (like with tax benefits).

While I understand your point about the impediments to unfettered interaction, this seems to me to be a fundamental problem with "globalized" interactions where the different parties to a transaction expect to be governed by different laws.

Can you imagine owning a grocery store and having to ask every customer their nationality to check which law you must follow to do business with them?

It is, unfortunately, a little too easy, to implement filters based on whitelists/blacklists at the DNS level, since those are largely organized geographically (proximity by packet travel time, and what not)

zapnuk• 7 years ago

Can you imagine owning a grocery store and having to ask every customer their nationality to check which law you must follow to do business with them?

Thats a bad metaphor. If you open a grocery store in one country you follow the relevant law of said country. If you extend you business to another country the new store has to follow the law of the other country.

The problem with physical establishment is that it could create a 'race to the bottom', similar to tax laws. With non-tangible elements like privacy, what stops big players like the USA to implement weak privacy protections to get a competitive edge?

purple_ducks• 7 years ago

Can you imagine owning a grocery store and having to ask every customer their nationality to check which law you must follow to do business with them

Can you imagine a grocery chain who wants to profit from potential customers all over the world but doesn't want to obey local laws in the jurisdictions it operates in?

If people don't want to serve people outside their jurisdiction, do an IP lookup as some US outlets chose to do.

Hacky US start-ups don't get to dictate the rules of the game to the world.

gedy• 7 years ago

It's more like an international customer calling a US business on the telephone and placing an order. That's not 'serving outside their jurisdiction'.

hartator2• 7 years ago

If people don't want to serve people outside their jurisdiction, do an IP lookup as some US outlets chose to do.

Are you sure your comment you've just made comply with the law of all the 200 countries in the world?

citilife• 7 years ago

My favorite example is:

If a purchaser calls a suppler from state Y from state X and ask to buy something. Which laws do I follow?

* The purchaser follow laws from state X

* The supplier from state follows laws from state Y

* We then pay any duties to ship from state Y to state X

This is the way things have been done, since, well... forever. No one thinks it's weird if this kind of business is conducted in person or over the phone.

Now, with the internet - it's believed that the supplier must now take on the burden of knowing the laws for purchaser - that's kind of strange.

The supplier is not operating in country X, so it probably wont be punished by country X.

Anyway, as a developer and maintainer of making a fair amount of cross boarder trade. I host my servers in one location, the state in which I operate. Good luck punishing me.

The reality is that my only burden is the state in which I operate, otherwise we're interfering with the sovereignty of the state in which I reside... don't think they'll like that. Good luck challenging that one.

munchbunny2• 7 years ago

The reality is that my only burden is the state in which I operate, otherwise we're interfering with the sovereignty of the state in which I reside... don't think they'll like that. Good luck challenging that one.

I mean, that's exactly what's going on. You can choose to follow State Y's laws when serving customers in State Y, or you can choose to not serve customers in State Y. But if you choose to not follow State Y's laws while serving customers in State Y, then State Y can use whatever leverage they can get their hands on to keep you out of State Y. That's State Y flexing their own sovereignty when it comes to protecting their citizens, which is the flipside of your argument about your state protecting you.

cmroanirgo• 7 years ago

I'd suggest that in your example, the purchaser isn't having all details about himself being recorded and monetized by the supplier, just simply for contacting the supplier: no agreements of trade have been entered into, but even if they had, there's little cause for selling the information to other 3rd parties.

Surely the purchaser has some rights to sovereignity?

IfOnlyYouKnew2• 7 years ago

You can't have two partners in a transaction following different sets of laws. That's why contracts routinely specify a jurisdiction. Otherwise you couldn't even agree on a court to hear your case.

In B2B transactions, there are often international standards. Even where the supplier's location is set to be the relevant jurisdiction, this only follows from the assumption that a purchaser of industrial goods tends to have the experience to navigate foreign law. This cannot be assumed for consumers.

xg15• 7 years ago

So, out of couriosity, how would your alternative look? Anarcho-capitalism?

hartator2• 7 years ago

Agreed. A good rule of thumb is the law applicable is where your HQ is located. Or you have to come up with good reasons why US companies shouldn't comply with the Chinese gov but should with EU ones.

lagadu2• 7 years ago

No company has to comply with laws of jurisdictions they're not based on. Unless they want to be allowed to conduct business there, that is.

kelnos5• 7 years ago

Not sure why you think this is so odd. This is how interstate commerce has worked in the US long before the Internet came around. Mail- and phone-order businesses were (and are) required to obey the laws of the state they're shipping to.

The physical establishment rule was the only sound approach.

The only reason that rule exists is because enforcement was much more difficult when your target doesn't have a physical establishment within your own borders. If you can enforce it for foreign entities (via some kind of side leverage, like a trade treaty, threat of sanctions, etc.), then, at face value, you should: why should the law behave differently based on physical presence? You yourself point out that things are different in the Internet age; that includes the acknowledgement that commerce can now trivially cross borders without having to have satellite offices everywhere.

munchbunny2• 7 years ago

I heavily disagree that the physical establishment rule was the only sound approach. It's certainly a valid approach, but not the only sound approach.

The problem with the physical establishment rule is that it leaves the end user with no leverage to actually protect themselves or their data.

The EU and California taking a stance that you must obey their data handling rules in order to do business there is a direct result of the lack of a robust system between states and nations to give users the ability to control their own data when the company's physical establishment is in a different legal system. This approach is the most immediately practical one: I vote for the politician who is willing to enact laws that actually have teeth to regulate the use of my data.

The industry has certainly shown a lack of desire to put teeth into any sort of self-regulation. I worked in ad tech - that industry standard body (the IAB) pretended to care at best, and actively lobbied to erode privacy rights most of the time. Real privacy enforcement mechanisms that actually respected users only started to show up once the GDPR boogeyman showed up.

At the time when we were generally happy with the physical establishment rule, the set of problems we were dealing with was very different. We were more worried about individual freedom in terms of access to services and communications, not individual freedom in terms of safety from bad actors.

buboard10• 7 years ago

Either jurisdictions will expand to include the entirety of the planet, or they will be abolished.

codesushi42• 7 years ago

What will these laws accomplish in real terms?

This just seems like poorly written legislation with the purpose of pandering to the populist public. I guess if it makes you all at least feel better.

simplecomplex2• 7 years ago

Nothing, except soon there will be annoying legalese on every website form. Just like the GDPR. Large businesses will benefit at the expense of smaller ones. Lawyers will make more money selling these legalese templates, and sometimes when a big company doesn’t pay the right bean counter they’ll end up being investigated by regulators, and paying the state money to continue doing the same thing.

But it will be celebrated as a heroic victory because “privacy good. Business bad. I want a banana.”

bengale• 7 years ago

The GDPR does a lot to protect user data. As someone that’s implemented stuff at a huge company for GDPR and at my startup, it was waaaay harder at the larger company. The ICO has been beyond helpful with the few questions I’ve had recently and implementation for my startup has been fairly straightforward.

nabnob6• 7 years ago

I see a lot of comments deriding this law, can someone explain to me why these are bad things? Quoting from this article - https://techcrunch.com/2018/06/28/landmark-california-privac...

- Businesses must disclose what information they collect, what business purpose they do so for and any third parties they share that data with.

- Businesses would be required to comply with official consumer requests to delete that data.

- Consumers can opt out of their data being sold, and businesses can’t retaliate by changing the price or level of service.

- Businesses can, however, offer “financial incentives” for being allowed to collect data.

- California authorities are empowered to fine companies for violations.

I totally understand that this will impact a lot of tech companies' profits...but that's to be expected if you're making money selling people's data to third parties without their permission.

jakelazaroff3• 7 years ago

I am on board with this law, but I’m curious how these two points will shake out:

- Consumers can opt out of their data being sold, and businesses can’t retaliate by changing the price or level of service.
- Businesses can, however, offer “financial incentives” for being allowed to collect data.

Seems to me that it’s a distinction without a difference. Is there something I’m missing?

danaris• 7 years ago

It sounds like this means it'll have to be clearly disclosed up front as a bonus, rather than being charged after the fact as a penalty and hidden somewhere in the ToS.

danharaj• 7 years ago

Maybe something like the advertised price of the service must be the price without data collection.

jtchang• 7 years ago

It's all about marketing and perception. See how credit card companies set rules regarding surcharges and cash. Before credit card companies tried to prevent a discount being offered if a customer paid cash as stipulation for taking credit cards. Durbin Act of 2010 changed that which made it legal in all 50 states.

kelnos5• 7 years ago

It might be a matter of semantics? You can quote a standard price, and then give a discount for allowing data collection, but you can't quote a standard price, and then add a surcharge for disallowing data collection.

I agree that there is no practical difference between the two, but given how deceptive companies can be when disclosing various pricing and hidden fees, this might be an attempt to curb that behavior?

moosey• 7 years ago

The way I'm guessing that will be clarified is that if you are charging for your product, you cannot offer a lower price point for allowing data collection. This will probably boil down to professional, paid for services, being allowed to collect only a small amount of information, and what is strictly needed.

The second line would allow companies to pay people to permit them to collect information. I imagine that because of the first statement, a company that is charging for the service cannot take advantage of this statement.

jassmith87• 7 years ago

Its intended to fuck over Facebook. If you're charging for a service you can simply offer a discount for allowing data collection after bumping prices for everyone by the same amount, Facebook however isn't charging. Facebook can't offer a discount on free, and they can't just force only users who opt-out to go pay (because that falls afoul of the first quote you put).

Basically this puts Facebook in a real tight situation, I honestly wonder how they will survive it.

nabnob6• 7 years ago

IANAL, but I'm guessing it's the difference between opting in and opting out?

For example, I think it would be legal for Verizon to get around this law by increasing their prices by $5 across the board, and offering a $5 rebate for customers who want to opt-in to their data being sold.

But it would not be legal for Verizon to allow customers to opt-out of data collection by paying an extra $5 a month.

In the first approach, Verizon will not track by default and customers have to opt-in.

In the second approach, Verizon will track by default and customers have to opt-out.

taurath2• 7 years ago

Because then they'll have to be up front about "why" they're charging you a lower amount, which puts a real dollar value on the data for the user, something which previously was never disclosed.

aeternum• 7 years ago

I don't think lawmakers have thought through the ramifications. Here are a few:

Way too hard to enforce, the definition of 'customer data' is going to be a constantly moving target. Does every click count? How about aggregated clicks important for general product optimization?

What constitutes 'selling' user data? Very few companies actually sell your data, instead they place ads based on your data. Will that be banned as well? Many companies, including Google would have to significantly change their pricing model if so.. yet that is apparently illegal.

JohnFen16• 7 years ago

Will that be banned as well?

I sure hope so.

Many companies, including Google would have to significantly change their pricing model if so

Good. It would be even better if they have to change their business model.

mattbee• 7 years ago

European here, I can help:

Yes a click counts as personal data if you can reference it back to a real person. Aggregated clicks probably wouldn't.

Selling ads based on personal data is selling your personal data. The personal data provides the value to the transaction.

Yes lots of companies may need new business models, but for the most part what I've seen is dark patterns, non compliance or wriggling to avoid any real change.

In Europe at least, it's back to the regulators to make a move.

irrational• 7 years ago

I think of customer data as any data that has been created/logged/stored based on some action I took (logging into website, clicking a button, visiting a website, opening an app, etc.) that can be tied back to me, my friends/family/community, my devices, my ip addresses, my locations, etc. in any way shape or form.

Supermancho• 7 years ago

Way too hard to enforce, the definition of 'customer data'

HIPPA manages with "Patient data". The standard techniques include non-reversible addressing of users. Patient N has an internal number and an external number. Without having Patient N's internal record in hand, you can't correlate it back to that user, which is particularly useful in a legal defense.

mahmoudimus2• 7 years ago

I think the idea is that regulation always has unexpected side effects, some of which can be abused to actually do the perverse inverse of what they're intended to protect against.

This is intuitive because regulation + law can really put a competitive barrier for established incumbents who (and arguably, they would be the target for lawsuits here) have resources to implement and comply with these regulations.

The law does sound great as a consumer, but I think the question is still up in the air about how will it be enforced and what will be the unexpected side effects?

Definitely something to watch for.

P.S. We've been working on a developer-friendly SaaS that helps companies automatically comply with jurisdictional controls + data security / privacy controls. Feel free to email me: mahmoud - @ - https://verygoodsecurity.com and I can dive deeper to answer any questions.

dangus• 7 years ago

On the flip side, the downsides of regulations don’t outweigh their utility.

We don’t scrap seatbelt and airbag regulations just because they’ve had some unintended side effects.

Regulations aren’t set in stone forever, either, and a functional legislative body can always modify and update them as their effects become more well known.

Or, well, maybe I sound too idealistic. But...I think most of us can all agree that consumer data protections are highly lacking.

gerbilly• 7 years ago

The status quo has unintended side effects.

jtanderson2• 7 years ago

Wrt the laws benefiting incumbents with more resources: in this case I think it’s simple. If you don’t have the resources, just don’t collect the data! If your business model absolutely depends on it, then you should have the resources to do it correctly anyway, so the extra burden of this law shouldn’t be too much on top of that. This is definitely a simplified view, but I think it’s worth noting that following these regulations may actually be easier and cheaper than breaking them (which isn’t the case for, say, some finance and trade regulation).

reaperducer4• 7 years ago

I think the idea is that regulation always has unexpected side effects

So does a lack of regulation. That's how we ended up here.

briffle• 7 years ago

I see a lot of comments deriding this law, can someone explain to me why these are bad things?

Jeff Hammerbacher: ‘The best minds of my generation are thinking about how to make people click ads… That sucks.’

Those best minds are now having to change the way they generate revenue..

nabnob6• 7 years ago

When I first wrote that comment, it was at -2 after three minutes. Which is interesting because usually HN users claim they care about privacy.

HillaryBriss• 7 years ago

I'm definitely not against it, but my guess is the best minds will now be put to work figuring out how to defeat, avoid, mitigate this regulation.

buboard10• 7 years ago

Hardly. It doesnt seem the law will affect the business, it will just make the cost of data collection explicit: "Pay $40/month to use facebook or get a free rebate by enabling ads".

rodgerd• 7 years ago

You're on a web site chock-full of people whose income or dreams of wealth depends on unfettered surveillance capitalism.

“It is difficult to get a man to understand something, when his salary depends on his not understanding it.”

chooseaname• 7 years ago

- Consumers can opt out of their data being sold, and businesses can’t retaliate by changing the price or level of service.

If you're ad dependent, would this basically mean you have to give your service to this user for free after this?

mdavidn5• 7 years ago

No. It just means you need to make ads relevant to the content rather than to the individual user.

bcheung3• 7 years ago

Some problematic scenarios:

- How do you identify what is customer data? There may be information stored in logs somewhere. Do you now have to write log parsers to extract personal data for everything that previously you just stored for general debugging and security purposes? How do you even know all the permutations of personal data that came be stored in the logs. There are possibly infinite possible ways personal information can manifest in logs. How do you ensure compliance with something when you don't fully understand what can come out of it? Any engineers now must fully understand the consequences of anything they log and design delete mechanisms for it. This extends to any 3rd party software you use that generates logs. You must now fully and deterministically understand your entire system just to comply with this law. Such a request is essentially NP-complete.

- How do you prune said data from logs?

- How do you delete data that are archived in write only media formats and/or that are in cold storage somewhere? You'd have to physically destroy the media and make a copy of everything minus the part you want to exclude. This dramatically increases archive storage complexity and cost.

darknoon• 7 years ago

Yes, if you log personal information like IP addresses you need to have a plan to delete it. Maybe storing it long term is a liability not a benefit.

Don't bring complexity theory into it.

codeulike• 7 years ago

In Europe, we have GDPR which is broadly similar. And the answer to your question about logs is basically "Tough shit. Personal data is important and if you've been leaving it in logs all over the place then you're going to have to sort that shit out".

The Backups question is a bit more complex. One source I've seen: "According to France’s GDPR supervisory authority, CNIL, organisations don’t have to delete backups when complying with the right to erasure. Nonetheless, they must clearly explain to the data subject that backups will be kept for a specified length of time (outlined in your retention policy)."

Paired with that is that if you're keeping data (or backups) for any length of time beyond the immediate needs of the customer then you need to be able to justify it.

allover• 7 years ago

How do you even know all the permutations of personal data that came be stored in the logs. There are possibly infinite possible ways personal information can manifest in logs.

Nonsense. You write the log statements. You know what data structures you are logging.

If you're using some server's built in logging, or some logging library or middleware you don't understand, turn that off until you understand what it's logging.

ska• 7 years ago

There are a (very) few hard edge cases. But most of this stuff is easily addressed by 1) having good designs around data handling in your system and 2) treating customer data and PII as data you only have limited rights to in the first place.

platz2• 7 years ago

engineers now must fully understand the consequences of anything they log

I don't think this is quite the dichotomy you make it out to be.

So we can create optimizing compilers, but we can't figure out what to log?

This seems like a problem of never having motivation to solve the problem before.

"We can't do that, it's too hard" is often a mea culpa I'm industry when they oppose regulation. Then they will come up with a solution from having actually spent some effort to actually think of potential solutions.

JackRabbitSlim• 7 years ago

ALL of those scenarios are only problematic because the design of these megalithic services didn't even consider things like the basic privacy of their livestock/user base.

Think this law is going to allow me to require 7-11 to delete me from their DVR records? Not part of the business model, it's a matter of security. Nice straw man though.

Their terrible system design can't handle "FROM PornPrefs DELETE SSN,Name,Address WHERE SSN LIKE "999-11-2222"". They brought this on themselves.

laughinghan11• 7 years ago

Do you now have to write log parsers to extract personal data for everything that previously you just stored for general debugging and security purposes? ... Any engineers now must fully understand the consequences of anything they log and design delete mechanisms for it.

YES YES YES YES YES.

Are you not already doing this for passwords, credit card numbers, and social security numbers?

Such a request is essentially NP-complete.

I think you mean undecidable, or equivalent to the halting problem, or subject to Rice's theorem. NP-completeness is irrelevant. I think you'll find that HN is the last place you'll win arguments by inaccurately using technical terms in the hopes that it will go over other people's heads, Legally Blonde-style (https://www.youtube.com/watch?v=8rNVaY7Stt4).

To anyone who knows what they're talking about, this an obviously nonsensical argument. It's similarly undecidable to verify whether the data that you expose publicly contains customer data, or customer passwords, or your own passwords, but you do it anyway, by restricting your engineers to only write and deploy code that they understand.

darawk2• 7 years ago

- Consumers can opt out of their data being sold, and businesses can’t retaliate by changing the price or level of service.

This is something I object to. It's just fundamentally stupid and doesn't make sense. The entire premise of free exchange is that I give you my services in exchange for something of value of yours. Making it illegal to withhold services if you don't give up your data is crazy. The only reason those services are being provided at all is to get that data. That's effectively a requirement that people provide services for free.

EDIT: I'll also add that it strongly favors incumbent tech companies, by explicitly carving out "selling to third parties" as a disfavored tactic. Google can monetize your data internally. Your average startup may not be able to. Specifically carving out "selling to third parties" favors large, incumbent players over small startups. But then, regulation always does.

1000units7• 7 years ago

Good laws put bad people out of business. I don't see the issue here.

ashelmire2• 7 years ago

- Consumers can opt out of their data being sold, and businesses can’t retaliate by changing the price or level of service.
- Businesses can, however, offer “financial incentives” for being allowed to collect data.

This just means your service always costs money, but you can refund the full amount for allowing you to collect data.

joshklein2• 7 years ago

Charging different customers a different price for the same product is illegal under US law, and California laws don’t change that.

EDIT: Several comments below point out the innumerable businesses operating in such a way as to make mine an impossible claim.

Enumerating the established methods to avoid meeting the legal parameters of price discrimination is not the same as price discrimination being legal.

My bar for following just laws is higher than the minimum required to avoid being prosecuted. I’m sure experts can help work around any future privacy laws too, so why even worry?

Surveillance already creates a different product one can charge more for, though your lawyer might advise you call it “personalization” in memos.

matthewmcg2• 7 years ago

I think the legislative motivation is a belief that people do not (and perhaps cannot) understand the potential cost of consenting to data sharing. Without that understanding, can you really have a meaningful consent?

In this view, a company offering a discount in exchange for sharing is inherently deceptive.

mfer2• 7 years ago

The entire premise of free exchange is that I give you my services in exchange for something of value of yours. Making it illegal to withhold services if you don't give up your data is crazy. The only reason those services are being provided at all is to get that data. That's effectively a requirement that people provide services for free.

The service isn't free. The exchange just isn't money. When money is involved a price is put forth. It's an agreed to and published exchange mechanism. When it's data on someone the price isn't shared. It's kept secret. There's always a price. It's just not always money or public. This will make more information public.

I wonder if this will start to change how business operate. Right now they are skewed against consumers towards businesses. I wonder if consumer protections, like this, will cause businesses to re-evaluate business models.

buboard10• 7 years ago

except, the full sentence in the bill reads:

including by charging the consumer who opts out a different price or providing the consumer a different quality of goods or services, except if the difference is reasonably related to value provided by the consumer’s dat

Doesnt that second part cancel the first part? Businesses can also pay money for data ... so facebook can switch to subsciption only, but pay its users with virtual coins for viewing ads

jakelazaroff3• 7 years ago

The entire premise of free exchange is that I give you my services in exchange for something of value of yours.

"Something" doesn't mean "anything". You can't offer your services in exchange for e.g. my body parts. Why are we willing to ban that but not our data?

The only reason those services are being provided at all is to get that data. That's effectively a requirement that people provide services for free.

Well, no — they could charge money for them. But even this is a false dilemma; surely we can come up with at least one business model other than "charge directly for our service" and "surveil our users".

m-p-3• 7 years ago

You just have to change the onboarding process to include a fee, and offer an incentive/rebate of the subscription price to match the cost to basically make it free. That way if they decide to change their mind and not give their data, you're still in the clear by removing the incentive and either charge their payment method or disable their service until they do (or reenable data sharing).

That way it feels more transparent to the end-user, and they have to make the conscious choice of either giving a bit of their data in exchance of a free service or be prepared to pay to keep their data private.

caconym_2• 7 years ago

At least in America we already restrict certain types of transactions, e.g. selling illegal and/or restricted drugs is itself generally illegal IIRC. Similarly I'm pretty sure slavery is illegal even if it's entered into voluntarily (please correct me if I'm wrong there, I'm not speaking from specific knowledge).

We impose these restrictions for the good of the public. If we decide that exchanging personal data for goods and services should be illegal under certain conditions, I don't see why that's any different than the precedents I mentioned.

rebuilder• 7 years ago

It's not a requirement that services be provided for free. It's an acknowledgment that, if services can't be provided without violating basic human decency, they should not be provided at all.

sha666sum• 7 years ago

Data mining as a business model is fine, as long as the customer is making an informed decision, there are equally good alternatives out there which you can pay for in other means, and you're not drawn to a particular service because of network effects or platform lock-in.

However, customers aren't well informed, and if they were, they wouldn't use these services. Currently customers are getting scammed for their data. This is why we need regulation.

loup-vaillant3• 7 years ago

The entire premise of free exchange is that I give you my services in exchange for something of value of yours.

Not if the thing I value is my personal data. Because I, as a typical short sighted consumer, will consistently underestimate the value of my data, as well as how my data affects those around me (extreme case: my data is my social graph, which you can use to reconstruct the social graph of my acquaintances).

If I don't know the actual value of what I am giving up, I am naturally going to get swindled.

brailsafe• 7 years ago

I think the intention is to decrease the opacity of 'free' services, with the awareness that most people using most free services don't or can't know what happens with it and what is collected. Money is not personal data, likewise almost anything else is not personal data, and there should be more legal protections in llace imo to protect a naive person's ability to limit the propagation of it, or hold companies accountable. If most people knew how any givem system worked, then software engineers wouldn't make as much. It's not a clear cut transaction when the cost is "any amount of data we can collect about you and sell to anyone for any price in exchange for this specific service we provide amd cam take away at any moment". That's a bullshit transaction.

brightball• 7 years ago

Agree entirely. This part is overreach as it’s now forcing a company to provide a service for which they receive no compensation. That’s too far.

cgriswald2• 7 years ago

In the case of data, is it always yours to give? Is the fact that I am friends with Friendo my data or Friendo’s? Both? Neither? Collectively both? Taken further is my contact info about Friendo mine to give? Is the photo with Friendo’s face that I took of a group of us at a bar my data to give?

If Friendo doesn’t have the same relationship I have with Tech.co, how is Friendo benefitting? Where is the exchange there?

Railsify• 7 years ago

Your quoted statement conflicts with the following: > Businesses can, however, offer “financial incentives” for being allowed to collect data.

Couldn't a financial incentive be charging more?

jlarocco3• 7 years ago

The only reason those services are being provided at all is to get that data.

If people don't find your product valuable enough to pay for, then your company should go out of business.

Companies have been exploiting people's privacy behind their back, and now that they've been called on it they're throwing a tantrum.

jlarocco3• 7 years ago

The entire premise of free exchange is that I give you my services in exchange for something of value of yours.

The problem is that these companies advertise their products as "free," which means something very different. And they usually don't mention at all that they're collecting shit tons of personal data. It's taking advantage of people's ignorance, and it's practically fraud, IMO.

Every other business tells the customer up front what the price is, and maybe it's time tech companies started doing the same.

Without telling users what data they collect, how much they collect, how they use it, and who they give it to, there's no way for users to make an informed decision.

stiray• 7 years ago

This explains it, I think that California took same diction.

Giovanni Buttarelli, European Data Protection Supervisor “There might well be a market for personal data, just like there is, tragically, a market for live human organs, but that does not mean that we can or should give that market the blessing of legislation.”

Privacy is fundamental human right that you cant trade for. Same as you cant sign a lawfull contract that you want to be someones slave, even if you want to.

pmontra3• 7 years ago

Making it illegal to withhold services if you don't give up your data is crazy.

Maybe you can show me generic ads based on your content instead of targeting them based on where I've been on vacation last month, etc.

Or simply stop building businesses based on people data. Sell something people want to pay for. Humankind has been able to do that for thousands of years, did we forget how to do it?

xz0r• 7 years ago

It's just fundamentally stupid and doesn't make sense. I give you my services in exchange for something of value of yours.

I never explicitly stated that I'd serve these companies by giving my data. Services cannot be assumed, why do you think there are such long Terms of Service. We as users should also have Terms of Service then.

tikiman1632• 7 years ago

I think you've missed the point. This does not make it illegal to collect or even sell user data, it makes it illegal to do so without consent.

Any concern regarding whether consent is likely to be withheld really just points out how stupid a company's business model is. Incumbent vs. Startup is also a false premise because Facebook is an incumbent that relies on selling user data. They do make some money from purely internal advertising, but in total Facebook only makes less than $5 per user when selling data, and that's lifetime, not per year. So the only way to make real profits from selling data is if you sell millions of people's data. Their internal data use however, is just for add targeting which they make more money from each year. This internal use makes more per user and is therefore a more viable strategy for a small company than selling data.

There are already regulations that make it impossible to sell user data that would be valuable that apply to more than just internet collected information. So, any data selling strategy a startup or incumbent company might have will either not earn significant profits or is very likely already illegal.

In any case, advertising revenue rarely ever covers a company's expenses. If a company is only staying afloat because of selling data, then that company is achieving a very poor return on investment and is wasting the time of everyone involved. Either they need better business processes, strategies or they're not offering something of sufficient value to be worth the time put into the business.

heliodor• 7 years ago

I interpret the purpose of that item combined with the subsequent one is to ensure that they can't force you to sell yourself but can offer you the option and leave the decision with you.

paggle• 7 years ago

Regulations that don’t achieve anything create a massive drag on innovation and commerce. Every regulation is a compliance check that needs to be paid for, a lawyer that needs to be hired, etc. which advantages incumbents.

It’s like lines of code in a program — each one makes the application worse, so each one should have a purpose that it achieves.

mdavidn5• 7 years ago

The law would not be necessary if companies were upfront with how they collect and process information about individual consumers. Now this is a compromise many consumers want.

danShumway8• 7 years ago

I've commented in the past that the privacy community is diverse. I divide the community into (at least) two major groups:

- People who believe that privacy means being able to anonymously use services.

- People who believe that privacy means being able to control what other people do with data about you.

These are not compatible views, and they often conflict with each other -- both philosophically and practically.

If you believe you should be able to compel a business to delete data you gave them, then necessarily there needs to be a way for that business to confirm your identity and link you to that data. You become more concerned with this idea of "owning" information about yourself.

If you believe you should be able to do everything anonymously, then it becomes much harder to control information after it's been leaked. You can't implement things like geo-locking users because what you do with the information doesn't matter -- just collecting it is a problem.

If you're in the "everything should be anonymous" crowd, you're also less likely to agree with efforts like Right to Be Forgotten; you may even reject the idea of data ownership entirely. For someone in the "I control my own data" crowd, the Right to Be Forgotten is absolutely critical -- it's one of the most important safeguards we have against a future where everything is permanently indexed forever.

I'm oversimplifying, but at the moment, the majority of pure-tech solutions for privacy are on the "everything should be anonymous" side, and (at least for the moment) most legislative solutions are falling into the "you should control your own data" side. That leads to conflict. Not always, but sometimes.

It's important to keep in mind that even though the privacy movement is aligned on many issues, there is no binary "pro" or "anti" privacy, because there's disagreement from privacy advocates on both where we're going and how to get there. In this case, California's law is very much a "control my data" law. Points like, "Businesses would be required to comply with official consumer requests to delete that data" conflict with the way that "be anonymous" privacy advocates see the world.

lemoncucumber• 7 years ago

Thanks, this clarified my thinking on the issue in a really useful way.

BoiledCabbage2• 7 years ago

I think this is a very important distinction you make, but it doesn't necessarily mean that they are fundamentally incompatible.

It today's world, data about a person is an asset. A person should own their assets, and have control over them. If there were only one option, this would have to be it - it's the only one that aligns with business interests. If you instead go purely the route of anonymous data collection, because data is such an asset it just gives businesses the strong incentive to find ways to de-anonymize your data. That is an unstable situation, and a societal counter-productive incentive.

Since data on me has value (clearly since businesses are run off it), make it a true product. Give it value, allow me as a consumer to trade it, allow businesses to quantify it's value in the market place, and explicitly bid on. That aligns incentives. As data becomes more (or less) valuable, businesses will adjust their prices for it. This aligns incentives, the more data is worth to a business, the more they'll be willing to pay for it. IMHO this is clearly the right approach.

That said, there is still a world where both methods exist. Users choose when they interact if they want to perform anonymous interaction (or pseudoanonymous), and people provide services to ensure it is anonymous. HN, reddit those are forms people would likely choose pseudoanon for, but there would be a firewall between someones pseudoanon identity and their true identity. And people would be pseudoanon knowing the risks and taking care to not divulge linking identityy info, and businesses would ensure there are limits on data preservation / recording of pseudoanon interactions. The same way people post on HN and use care in what they choose to disclose, HN would also ensur data expiry is short enough and would not share/sell pseudoanon data to 3rd parties.

Again, if you can only pick one, it has to be consumer ownership of their data, but I think they both can work together.

laughinghan11• 7 years ago

There's no conflict.

necessarily there needs to be a way for that business to confirm your identity and link you to that data

Why would linking you to that data require confirming your identity? My password links my HN account to me and me alone, while revealing nothing about my identity.

There's no conflicting views. They're two, completely compatible aspects of the same view.

One is how much or how little data each service gets about you. The other is how much control you have over what those services do with the data they do get.

That's why technical and legislative solutions work in tandem, reducing the former (amount of data) and increasing the latter (control over data). That's also why technical solutions are preferable: there's no need to legislate control over data that services are unable to collect about you in the first place.

rco8786• 7 years ago

They’re not bad for the consumer. They’re just hard to implement in practice. I’m going through this right now at a well known tech co. Nobody, including the lawyers on both sides of the table, knows exactly what to do to be compliant because a lot of the bill is pretty vague on details.

And for some companies doing shit like selling customer data is the only reason they’re in business. Good riddance to them though.

the_watcher• 7 years ago

- Consumers can opt out of their data being sold, and businesses can’t retaliate by changing the price or level of service.

If the price of the service is based on the ability to sell data, how is it reasonable to disallow the business from changing the price of the service for those who opt out?

Also, how can you reconcile this with being allowed to offer financial incentives for being allowed to collect it?

andrewmutz• 7 years ago

These laws may be targeted at companies that deal in advertising data relating to consumers, but the laws as written affect all of us.

Are these the right laws to regulate SaaS companies that build business software? Should a consumer be allowed to request that data about them be deleted if that data are records of legitimate business transactions? If you buy a car from a dealership, do you "own" the data in their systems about your transaction and should you be able to request its deletion?

leesalminen• 7 years ago

Agreed. It’s been tough for us as well. We don’t monetize customer data in any way yet these regulations add real cost for us. We’re in the business software SaaS world as well, so it’s not really even our data to delete. We end up having to have a 3-way ticket between the business, the customer and us (the SaaS provider) and explain how we are deleting data from their system.

biesnecker• 7 years ago

There are a bunch of exceptions to the requirement to delete user data in the law (full text: https://leginfo.legislature.ca.gov/faces/billTextClient.xhtm...), the exception for data that is collected "to enable solely internal uses that are reasonably aligned with the expectations of the consumer based on the consumer’s relationship with the business" would probably apply in the cases you cite.

thorwasdfasdf• 7 years ago

It's pretty presumptious of people to assume that when they visit a website that it's just "their" data. The website receives the user, just as much as the user comes to the website. The data of visiting a website belongs to both the company and the user. To simply assume that it entirely belongs to the user is just wrong.

domnomnom• 7 years ago

Every state will end up having a different law like this, and it will be terrible adhering to each one.

nickjj• 7 years ago

Yeah this is a really good point and with 50 states that's a lot of things to keep track of. Let's hope it isn't able to be broken down like sales tax.

Remember last year when there was a big hoopla about that Massachusetts court case that hinted that any online vendor would now be responsible for collecting and reporting on sales tax for purchases coming from any US state (even if you as the business owner didn't have a business location there). Basically changing the requirement of the buyer to report sales tax for out of state purchases onto the business. The only problem is there's 9,998 different tax jurisdictions (as of 5 years ago)[1] spread across 50 states.

[1] https://taxfoundation.org/state-sales-tax-jurisdictions-appr...

narrator• 7 years ago

Good way to make sure all companies support scrubbing of evidence of crimes so wikileaks or government investigators can't get at the evidence.

Basically Hillary's private email server getting bleachbitted, but for everyone now. Makes running an organized crime gang, political corruption graft ring or chinese espionage ring much easier. Same with banning facial recognition. Makes getting away with crime a lot easier than it would otherwise be. If you are a corrupt politician, this is really important stuff.

4ntonius8lock• 7 years ago

I think there are a lot of people here whose employment depends on being able to sell and buy peoples data freely.

Many of the people here who work for these companies truly and honestly believe the online services they are offering are/will change the world for the better.

As such, they view hindrances to this as threatening to the progress they are trying to help bring about.

Personally, I support this privacy initiative and think SV companies are many times viewed through rose tinted glasses by their employees, but that's just my perspective.

I can totally see how viewed through the lens of a hindrance to progress, some people would feel very strongly that I'm wrong in supporting such legislation.

chaostheory• 7 years ago

I totally understand that this will impact a lot of tech companies' profits...but that's to be expected if you're making money selling people's data to third parties without their permission.

Yes, it is also subsidizing what would normally be paid services. Before online advertising, people would pay for services like email. Sure, $5 / month is cheap for us, but what about the developing world and the lower class?

tylerl2• 7 years ago

It makes it extremely difficult to legally be a tech firm unless you're already a tech giant, just like the FDAs procedures make it impossible to invent a new drug unless you're already an established, giant pharma company.

None of the big names in tech will have any trouble at all complying with this; I'd be very surprised if any at all are not already compliant today.

At the same time, the percentage of tech startups that are already compliant with this law is likely around zero, and few will ever become so. Unless this is precisely what your startup is about, small firms, especially with venture funding, can't afford to invest anything at all into privacy beyond the surface. If your startup fails because it gets sued into oblivion, that's no worse (and way less likely) than it failing because nobody actually wanted a chat app for dogs.

drusepth3• 7 years ago

This law's implementation is bad for the same reason GDPR's implementation is bad: the people it's meant to target are easily capable of complying (and likely already do) and it's good for "the people" on paper, but disproportionately affects (hurts) small businesses that don't have the means to comply (or even know if they're properly complying to the extent of avoiding a lawsuit).

hackerbabz• 7 years ago

If a company (small or giant) can't afford to protect my data and preserve my rights to it, then I don't want that company to exist.

Just like I don't want startups making unsafe medicine, or losing my medical secrets.

raxxorrax• 7 years ago

I doubt this to be true honestly, because having user data worth selling already implies you to have a certain size. The request are reasonable and the dismissal with reference to difficulties startups might face is probably not applicable.

But if that is really a problem, just apply the requirements to companies with a minimum amount of users. Venture capital funded companies don't need to cut corners and shouldn't be allowed to when it comes to privacy.

bmistree• 7 years ago

I just wanted to piggy-back onto the parent’s comment with a concrete example.

I’ve always been told that it’s good practice to take periodic backups. In the absolute worst cases, you can simply restore directly from these.

If a customer requests that their data are deleted, in addition to my production instance, does that mean that I have to remove their data from my backups? If so, I’m uncertain of the best way to do this. I’m uncertain if many managed services will allow me to mutate backups. And even if I were managing my database and backups directly, it seems painful to load each backed up database, remove the data, and rewrite the backup.

Note: I’m not saying that any of this is impossible. However, it does require a lot of ancillary engineering work difficult for a small company that’s just trying to get to product market fit.

alxlaz3• 7 years ago

It makes it extremely difficult to legally be a tech firm unless you're already a tech giant

Why? There are plenty of tech companies that collect very little data, and don't sell any of it. I fondly remember one of my customers telling me how much effort it took to come up with a wordy enough privacy policy page for one of their products so that it wouldn't look suspicious. The first draft was barely two paragraphs long and contained just a couple of items, most of them ephemeral (e.g. IP addresses, which were collected only for logging purposes and were only stored for 30 days).

If a company is unable to even articulate what data it collects and cannot do basic operations on it (e.g. remove a piece of it), then it shouldn't be in the business of handling personal information. The same way a clinic that can't even keep track of blood samples shouldn't be in business.

And if a company's earnings depend strictly on being able to collect and sell personal data, what they need is a better business plan, not having everyone turn a blind eye.

Despegar2• 7 years ago

just like the FDAs procedures make it impossible to invent a new drug unless you're already an established, giant pharma company.

This is complete nonsense. The biotech industry is very large and vibrant and are most certainly not Big Pharma.

hkai• 7 years ago

If you favor an idea that a private company should be compelled to provide a service for free, even if you don't share your data, would you also agree to the idea that a private company should be compelled to respect freedom of speech on their platform even if they don't benefit from it?

mychael• 7 years ago

Is this an opinion article or a legit journalism? The article clearly has a slant, but TechCrunch didn't classify it as Opinion.

Despegar2• 7 years ago

While I think CCPA is a step in the right direction from the status quo, which is basically a free-for-all, it's still a mediocre privacy law. GDPR remains the gold standard because it's opt-in, CCPA is opt-out.

The only reason it was even passed was because some guy was going to force the issue with a ballot initiative so lawmakers scrambled to do something. If not for that, California would be the last state to pass meaningful privacy regulation.

morganherlocker5• 7 years ago

Lot's of (mis)information floating around regarding CCPA. I recommend taking the time to read the actual text[1]. The text is not particularly long or dense. There has been a lot of speculation about complex compliance procedures, but the main thrust of the bill is to provide users with information about how their data is collected, who it is shared with, and the rights to prevent certain types of selling or sharing of said data. The leginfo site also includes non-partisan analysis (under the "Bill Analysis" tab) of the bill and amendments as it moves through the legislature, which is useful for getting an understanding of how specific issues are being considered and addressed. Something to consider is that bills change substantially through the amendment process, so often critiques you read are based off old versions of the text that have already been addressed.

[1] https://leginfo.legislature.ca.gov/faces/billTextClient.xhtm...

SamReidHughes4• 7 years ago

(4) Exercise free speech, ensure the right of another consumer to exercise his or her right of free speech, or exercise another right provided for by law.

Well, thanks for the link. For example, informing people that a user is located in a dormitory in The Netherlands sounds like free speech to me. So is location tracking information exempt from deletion?

morganherlocker5• 7 years ago

Location data is explicitly called out as sensitive personal information in the text of the bill, so it's definitely not exempt as a category of data.

(e) Many businesses collect personal information from California consumers. They may know where a consumer lives and how many children a consumer has, how fast a consumer drives, a consumer’s personality, sleep habits, biometric and health information, financial information, precise geolocation information, and social networks, to name a few categories.

As to how this will interact with free speech - in this case, speech of the company - is a bit of an open question. One of the assumptions of the bill though is that selling telemetry data about a consumer is not a form of protected speech, and that adding some restrictions to this practice is reasonable.

notfromhere2• 7 years ago

The main problem is that the bill is rushed and the legal bits have a lot of ambiguity.

source: CCPA and its potential compliance has been a big PITA

morganherlocker5• 7 years ago

No argument there; just pointing out that many of the common complaints around ambiguity are explicitly addressed in the text of the bill already.

reaperducer4• 7 years ago

It's not rushed. It's agile!

buboard10• 7 years ago

Yep. This law is nothing like the draconian extremes of GDPR. One can even say it's good because it weeds out the really shady businesses but allows the ad ecosystem to work.

yalogin• 7 years ago

It’s jarring to see such headlines on TechCrunch. They fed the valley by giving every little news a place and are ne of the original hype masters for startups. They profit off the area by hosting the disrupt conference as well, which is again a huge pat each other on the back event. So now they turn around and post a headline like that is just somehow ugly to me. It’s absolutely in their right obviously.

degenerate• 7 years ago

Pet peeve: when editors/authors throw their opinions on the end of headlines. [and why it's a good thing / and why you should care / and why it's dangerous / etc]

Just give me the facts and let me decide on my own after reading the facts. I don't need your opinion up front.

buboard10• 7 years ago

Journalists think that bashing big tech because they are rich gives them views. I doubt there is evidence for that but journobloggers tend to be very herdish.

noodlesUK4• 7 years ago

People keep comparing this to the GDPR. I have lived in the UK pre and post GDPR and the US. I like the GDPR a lot. It isn’t just internet businesses either. Because it was such a crazy bogeyman, plenty of brick and mortar businesses have paid a bit more attention to their data security. I like being told what’s gonna happen with my PII, and having the right to control my data. Most people seem to like the effects of the GDPR in my (anecdotal) experience. Yeah you have people using it as some bizarre bogeyman to stop you doing normal things, but it makes you think about it. From a business perspective, the ICO provides great advice to people and companies when they need it. It’s not as though what you need to do is a secret. You just need to do business in accordance with peoples’ rights.

ptest15• 7 years ago

Besides the tremendous onus laws like this may place on small startups and side projects:

Does anyone know how companies are supposed to comply if “user data” literally cannot be deleted? I’m thinking in the case of blockchain type applications, where one users’ actions feed into another users’ actions, and you can’t deleted user A’s actions without deleting potentially tons of other stuff and destroying the application.

Like does this law basically ban GitHub and code collaboration too?

dsfyu404ed2• 7 years ago

Besides the onus laws like this may place on small startups and side projects:

Startups and side projects are a non-issue. They can just comply from the get go. It's the too small to afford compliance but too big to easily change their business model that are going to be hurt by this. However, that brings up the question as to whether those business models should be able to exist profitably in the first place.

ptest15• 7 years ago

What I’m saying is that there is more work for startups / side projects to do, not that it’s impossible. It raises the barrier.

chobeat3• 7 years ago

For the 1) you just don't commit data in the blockchain itself. You can commit an ID that points to external data and drop these external data if requested. This clearly looks like an anti-pattern but putting personal data in an immutable data structure is an anti-pattern too, since those data don't belong to you.

What if a bank put the gold of their customers in a concrete pillar instead of a vault? Fuck the back, I guess. I don't see why not.

ptest15• 7 years ago

Again, the GitHub example is a good one. I have some commits in Django core from years ago. What if I “request” my data be deleted from GitHub? What are they supposed to do? If they rewrite the history it will destroy the project; and if anyone can rewrite the history in the future it leaves projects open to hostile actions.

I suppose the argument would have to be made that it’s not personal data; it’s an act of public publishing or something. So in this case it’s akin to me publishing a blog and other people quoting it years later. I can delete the original blog but not the reprints in newspapers or quotes.

Or that it stops becoming “your” data and becomes instead “the other user’s” once eg the Django project accepts the PR. So you can delete user A’s PR but not the Django project’s now-integrated copy. I think this rationale makes the most sense. After all, someone could still have the repository on their computer and push it back to GitHub again.

I realize this is an edge case that doesn’t apply to 99.9999% of companies, but as an engineer I find it interesting!

Edit: after thinking this through more, I suspect that e.g. GitHub could argue they comply as long as they delete User A’s repo. Subsequently integrated PRs, etc wouldn’t have to be deleted because they could argue they’re no longer User A’s.

I kinda feel like if language to allow this was added to the law explicitly it would be open to abuse, so I suppose this kind of thing has to remain vague and open to interpretation in e.g. the courts if someone is being nasty.

mdavidn5• 7 years ago

Git does have a mechanism to remove data from history. It's ugly, and you end up with new commit hashes, but it works. It was designed for situations in which a developer accidentally adds something sensitive, like a production database snapshot, to source control.

ptest15• 7 years ago

Yeah so you could do a rebase and remove all of the user’s commits, but their work would likely still remain in the subsequent history- integrated as changes in some way. It would be a real mess.

calithrowaway• 7 years ago

How is this not a violation to the first amendment? Does the first amendment not extend as follows: (?)

As a citizen don't I have the right to create a business and privately take notes on whatever I'd like to about my customers? If i run a dry cleaners and take notes about my customers, should I be obligated to disclose these notes or even the existence of these notes to my customers? I don't see why extending the dry cleaning business to a mobile app or website effects anything. What about journalists, are they required to disclose what data they're collecting about people as they do their job?

I feel like the state constitution granted right to privacy does not supersede the federally mandated right to freedom of speech both the right to take internal notes and documentation and the violation of one's speech rights by forcing this disclosure.

however IANAL and I don't live in California. Could someone share some insights onto the first amendment side of this?

mdavidn5• 7 years ago

IANAL, but I think a human needs to be involved in the individuals' processing as a prerequisite to "speech." An automated process has no Constitutional rights.

zbentley4• 7 years ago

An automated process has no Constitutional rights.

Yet.

krapp• 7 years ago

I feel like the state constitution granted right to privacy does not supersede the federally mandated right to freedom of speech

Gonna have to stop you there.

The First Amendment doesn't mandate a right to free speech. It only prevents Congress from passing laws abridging that right.

There's nothing, Constitutionally speaking, preventing states from doing so.

Edit: nope, Apparently I'm wrong on this one.

mdavidn5• 7 years ago

That's not the case. The Bill of Rights now does largely apply to the states.

https://en.wikipedia.org/wiki/Incorporation_of_the_Bill_of_R...

holy_city• 7 years ago

There's nothing, Constitutionally speaking, preventing states from doing so.

https://en.wikipedia.org/wiki/Gitlow_v._New_York

dragonwriter• 7 years ago

As a citizen don't I have the right to create a business

Nope. That's not an express Constitutional limit imposed on states and thus states general police powers extend to regulating that behavior. (To the extend the proposed business engages in, or impacts, interstate commerce there is also federal regulatory power under the commerce clause, but the immediate issue is the broader state regulatory power.)

SamReidHughes4• 7 years ago

The bill has an explicit carve-out for free speech. So in some sense the bill is going "la la la I don't violate the first amendment," but ultimately it depends on what that clause means.

Havoc• 7 years ago

The whole system is rotten to the core. Allowing companies to portray themselves in a positive light on privacy

“The time to act is now,”

While pushing a federal law geared towards undermining privacy rights?

Doublespeak anyone?

buboard10• 7 years ago

This:

The bill would authorize businesses to offer financial incentives for collection of personal information.

Means it's nothing like the GDPR. This might actually be a sane law. And it doesnt implement punitive fines if you get hacked. Nor does it bring about a massive cookie alert insanity.

The right to delete may work in europe , but i think in the US it is going to clash with free speech laws. So it might not work at all.

aazaa• 7 years ago

Since the law passed, tech giants have pulled out their last card: pushing for an overarching federal bill.
In doing so, the companies would be able to control their messaging through their extensive lobbying efforts, allowing them to push for a weaker statute that would nullify some of the provisions in California’s new privacy law. In doing so, companies wouldn’t have to spend a ton on more resources to ensure their compliance with a variety of statutes in multiple states.

Is it really that much easier to control a federal vs. state legislator?

I wonder if the idea might actually be to prevent the likely future scenario in which 50+ different privacy regulations need compliance. Setting a national standard could prevent such an outcome.

Privacy advocates should favor the state-by-state solution, though. The more difficult it is to comply with regulations, the more expensive it becomes to collect the data in the first place.

As the cost of compliance increases, the alternative of simply not collecting the data in the first place becomes more attractive.

But that itself can lead to unintended consequences. It would mean that only the biggest companies could afford the regulatory burden of collecting the data. And these are the very companies that have received the most negative attention.

All of which makes me wonder whether at some point we could see a private data settlement along the lines of the tobacco settlement:

https://en.wikipedia.org/wiki/Tobacco_Master_Settlement_Agre...

Nasrudith4• 7 years ago

I can't help but view it with disgust just at the headline of having the wrong kind of mentality. It is a spiteful logical fallacy of the worst kind. "Soviets terrified of plan to nuclear first strike whole world - good!" Just because even the vilest foe dislikes it doesn't mean it is a good idea.

The whole article seems to be about shutting down thinking and manipulation via playing with emotions.

I am probably an outlier but I view that as an active sign that is terrible because otherwise they would lead on better points. The article made me /less/ supportive of it. It is perhaps unduly harsh but I would call it an outright propaganda piece not because of the message but how it was delivered.

notTyler• 7 years ago

"Shutting down thinking." Reporting on transgressions and laws designed to hold parties accountable is designed to shut down thinking now, and how those who would be affected by it are literally trying to kill the bill is considered "shutting down thinking." This is literally what you just said.

Nasrudith4• 7 years ago

You proved my point ironically. It is all about "punishing the bad ones for their past sins" as opposed to going forward the impact of the law - the part to actually think about. Instead straight to emotionally knee jerk driven narratives of "they are bad and must be punished" instead of what the law is actually about. See emotions come out and the thinking on the topic like "would it actually help with Cambridge Analytica 2.0" go kaput.

It is an old trick narrative for pushing terrible "tough on crime" laws for advancement. If you point out that it isn't a well thought out idea you support bad people!

atoav• 7 years ago

In short: laws against things that never sbould have been.

One can only hope they make sure it hits big actors more than any other ones, because they are what makes this kind of data collection dangerous for societies.

gojomo2• 7 years ago

Anyone remember when TechCrunch actually took the side of "Silicon Valley"?

dillondoyle• 7 years ago

I'm pretty concerned about it, and we are a tiny political digital agency. My reading is that basically any small sized email list, website, service etc that 'receives for the business’ commercial purposes' data on more than 50k 'devices' or 'consumers' must be compliant which is a very low bar. Like small business email lists would hit this, though maybe burden falls onto Mailchimp for most.

It should be fairly easy to add a contact us address for delete and info requests to the bottom of websites. A lot harder and would take development time to automate a UI for a person to see all data associated automatically (e.g. lots of separate analytics; would have to build api to lookup ip/device/user data match across tables/dbs, and then how do I verify a user is requesting their data and not someone else's). Also harder to 'block' new data collection of device/consumer post delete request.

What I'm less sure about is 'inform consumers before the point of collection.'

Does a privacy policy link in footer count? If not what is required for compliance? What about advertising?

Another big concern for me is that this is going to be weaponized in my industry (politics). I think a political campaign wont fit the bill's definition of 'business' (profit seeking for shareholders) but I think it will still be weaponized by opposition campaigns and service providers.

Sephr• 7 years ago

Sounds like you need a Data Privacy Infrastructure provider so you don't have to worry about the implementation details. The startup I'm working at, https://transcend.io, offers that.

EGreg• 7 years ago

Can someone who has actually READ this law summarize the main provisions from it?

rpastuszak2• 7 years ago

As much as most browsers have implemented a standardised payment API, a generic, browser-level Privacy related GUI would be helpful. By that I mean something less repetitive than the multitude of consent screens people have to deal with (not to mention dark UX patterns in the existing solutions).

ptest15• 7 years ago

Yes, please!!

nicky19890202• 7 years ago

I think everyone's data must belong to their own.

systematical• 7 years ago

I wish I lived in California. I'd be requesting the deletion of my data ALL OVER the internet.

Aperocky• 7 years ago

LMAO, Google should just make itself unavailable in California due to 'involuntary violation' of this law to see it repealed real quick. Those who complain can use bing.

xhruso00• 7 years ago

Instead of complying with the law they are wasting time lobbying. If they don't comply on 1st of JAN what excuse are they going to have?

classified• 7 years ago

Project Gutenberg currently blocks users from Europe to avoid having to comply with GDPR. Logically the next step would be to block users from California as well.

tempodox• 7 years ago

Many comments here make the false dichotomy of paying for a service with money vs paying with your data. That ship has sailed. In the current market selling user data will win every time. Only laws can make sure that a company you pay for “premium service” or “no ads” won't turn around and sell your data anyway.

jkp562• 7 years ago

This law is a step in the right direction, although in its current form it's toothless and uses disgustingly submissive language (e.g. the user may not out or the user needs to be informed about how theur data is going to be abused). The final goal of such laws should be to poison user data: so that collecting it and storing would open all sorts of legal and criminal troubles and that no company would want to touch user data with even 10 foot pole. This will open more ethical business opportunities that currently can't compete with data mining model. An analogy in real world. If theft and robberry was legal, no other business model could exist: if you sell gas for 3 bucks a gallon and your neighbor sells it for a negative price, but sells user address to theft agencies, you'd be out of business long before everybody realises the true cost of that "free" gas.

Silicon Valley is terrified of California’s privacy law

Related Stories