Brendan Eich Writes to the US Senate: We Need a GDPR for the United States

Your annoyance is misplaced. Don't be annoyed at GDPR: be annoyed at all the companies who have spent the last decades building an entire web-infrastructure with zero respect for user privacy. We built massive amounts of technology infrastructure that just assumed that privacy and tracking wasn't an issue. Why do these websites need all these cookies in the first place? If I'm visiting a random blog with no advertising on it, why is it asking my for cookie consent? What possible purpose could that cookie serve, except tracking users?

As an analogy, imagine taking a black-light to a hotel room and realizing that the room is absolutely filthy. Would you be angry at the black-light for revealing the filth to you? Or would you be angry at the hotel, for not properly cleaning up?

If cookie consent forms or GDPR compliance forms annoy you, don't blame GDPR. Blame the sites that have no regard for your privacy and make no effort to comply beyond throwing up annoying prompts.

Of course, the state of "what the State of California knows" changes every few days, and there's no penalty for being proactive and posting your signs without actually verifying that one of the ~800 chemicals exists on your property. So every business just places a warning sign anyway, and consumers ignore the signs.

No, these are very real, very concrete negative effects of every company and their grandma spying on your internet usage.

I know it's too much to ask, and I'm happy the GDPR went through as it is, but I wish EU could nudge browsers to centralize cookie and GDPR consent forms. Both to fix the UX (a standard browser interface would be much better than most of the popups out there), and to enable me to select "decline everything" once and for all, and never be bugged by it again.

The way GDPR works out it sort of expects us to care to follow this annoying process, and I don't think people do / want to and thus ultimately won't make good choices.

GDPR demands users engage in the process on the web in a very particular way. As far as that goes I suspect it will fail on that aspect.

Hopefully you'll choose not to use those sites.

For the first couple of months, I clicked all the "manage my choices" buttons. I felt the pain, but decided it was worth it. Then I discovered that for many sites, I would have had to enable 3rd party cookies in order for the choices to stick. That made me realise that I simply didn't want the marketers to even know that I didn't want them to track me; that I didn't want to enable the malpractice of companies that hadn't offered me the choice to disable their options; that I wasn't prepared to rely on the devs behind those dialogs to implement the design implied.

So now, I just close the tab and read something else. My hope is that others make similar choices.

I don't see any such things. What I got is many emails when GDPR started and companies asked me to click a link so that they can keep my data and emails saying that they changed privacy. I didn't click any of those links.

BTW I use ad blocker and that hides many nonsense. Even before GDPR there were too many of these dickbars[1] everywhere and I'm annoyed at those. Every site has those subscribe to email popup and other dickbars floating around.

So GDPR didn't make things worse like you say. Although the internet has become worse with tracking everywhere and stupid designs making us suffer.

[1]https://daringfireball.net/2017/06/medium_dickbars

That’s just the tip of the iceberg of the problems with GDPR. Watch as the enforcement side becomes selectively weaponized as a political tool against unpopular sites and the other shoe will have dropped.

GDPR is a regulatory bandaid to a technical problem. That geeks are calling for more regulation to fix their own failings to design privacy resilient network protocols and decentralized software which truly and actually puts users in control of their own data, is shameful.

It’s a common trope that users don’t care enough to seek out and use privacy enhancing and protecting solutions. I think that’s a load of crap. The current solutions are alpha quality and are not ready for general use. But the technology will improve and I am convinced they will destroy the competition when they get there.

It might not be necessary, or even compliant, to notify and gather consent for cookies via popup. This is just something that many web site operators are assuming will bring them into compliance, but there's no way to know that yet. Just like there's no way to know if you'll still be clicking through cookie prompts 5 years from now once we have a few GDPR test cases.

Let's wait and see how this all plays out.

At this point I just want those consent forms to be standardized via ARIA tags or whatever so that some extension can click the "yea, sure, whatever" button for me.

I think an equivalent of the GDPR becoming US law would go a long way to improving the problems of enforceability.

- by default they are not allowed to collect more data than strictly necessary.

- additional collection must be opt-in, and there can be no punishment for not opting in.

- showing these dialogs that are opt-out seems like a way to beg for a fine: "We hereby declare to all our visitors that by default we collect way more information than we are allowed to."

In addition, this is a bit like fire safety regulations. Sure, they are very annoying. All of us probably have experienced the empty battery beep of a smoke sensor in the middle of the night, and many have experienced a false alarm. That's the price you pay for lowering a significant risk.

Wait a few years, and you will see significantly lower risks of your data being collected and distributed without your consent.

I'd like to add that the GDPR is truly disruptive, and it will probably take a few 'product iterations' to get it perfectly right. That alone would be a reason to wait a bit and learn from experiences before rolling such regulations out everywhere. (I'm saying this as an EU citizen)

Most of the sites you're talking about are probably in violation of the GDPR. They're hoping that by adding a big notice telling you about their violations they'll be OK. We'll have to see. But there should be a "Refuse" option that's just as prominent as the "Accept" option.

1. Private Browsing, separate sessions in web previews, etc. are all somewhat less privacy protecting than you'd hope (IP tracking[A], browser fingerprinting, etc.) the GDPR mandates that companies ask you about tracking before they do it. Those notices are a sign that they're trying to do that.

2. I do work in the tech, marketing and security arenas and the GDPR was like kicking a beehive. Everyone at least looked around and asked themselves: "Do we really need to keep this data?" and in many/most cases the answer was: "No". So they got rid of it.

The GDPR is a lot like a vaccine, the power is in the prevention. Which won't make splashy headlines, nobody is going to write: "A million records weren't leaked today b/c they were deleted off the server 6 months ago as they weren't needed."

A - every time GDPR comes up on HN, someone complains about IPs (either that it doesn't matter and/or that their Apache log file is full of them, so why bother). GDPR regs focus on what data a company is collecting, how are they using that data and did they get consent for that. In the case of IPs, you can consider implicit consent b/c they're browsing your site. But you did _not_ consent to have your IP tracked as part of a 3rd party marketplace for retargeting ads.

Nope. Likewise you aren't expected to read a car lease contract or the papers you sign to buy a house.

Of course, these fine grained access controls are also a dark pattern, make it annoying and look difficult just so you consent. There's even a few out there that take a minute with a spinner going "Please wait, storing your preferences..." even if just hitting "accept" is instant. As is "cancel". Dark patterns.

The earliest years of commercialisation were pretty good too - hundreds of small sites, all trying really hard, but all with terrible site design. :) The worst that adtech could yet come up with was an ugly animated gif and a little flash - which was super easy to block.

"Regulations like GDPR arguably make users complacent and lowers their guard"

What guard? How does a non IT expert envisage the ways that harvested data impacts their lives? Or the countless ways it can be connected up with other sources until it becomes pervasive? How are they meant to know that the news article they read has 15 different trackers on it along with the ads, or the reason some creepy retargeting ad turns up later in the day as though it knew what they were thinking?

Sometimes I wonder if _I_ know enough to take care adequately, and I've been online since before the www.

Now add the dark patterns and misinformation to completely misrepresent what most of these sites are doing with that data. Some of the big names excel at this.

"why change things?"

Facebook, Google, Microsoft and a hundred others got so greedy about data and tracking that the overreach was impossible to ignore. If GDPR wasn't already in progress, Cambridge Analytica and similar stories would have ensured it would get a reaction soon. Probably a worse reaction.

>With an unregulated internet, any internet user has to take care of their own privacy and anonymity. Barriers for entry for new websites and services are very low. Data breaches and abuses of data can lead to users being concerned about giving their data to tech monopolies, which can enable competition.

How is this the 'old internet' and not still the current internet. With exeption maybe to the EU with GDPR now, this is what the internet is: everyone has to take care of their own privacy and anonimity.

Barriers for entry for new website and services are lower than they've ever been. You don't even need your own hardware, just rent it.

>Regulations like GDPR arguably make users complacent and lowers their guard,

So according to this theory, people living outside GDPR territory, like the US, are less complacent regarding their data?

Do you really think the _average_ American is less complacent than the average European? I hardly think so.

>The internet was doing fine for decades with minimal involvement from governments - why change things?

The internet was literally built by government(s).

Why Change things? Because we are now finding out people are building massive databases with personal information, bought from small, medium and bigger websites who happily sold it without telling users they did.

GDPR prevents this.

How can I be 'less complacent' and 'have my guard up' if I don't even know that companies sell my data behind my back?

Things change on their own. The internet used to be accessed by highly sophisticated and technical users. Now it's mainstream.

And all mainstream things follow two basic rules:

1. Everything move at the speed of the slowest person.

2. The weakest members of the community need to be protected.

The old, unregulated Internet was not made of companies milking users of data and violating their privacy.

Of course it was better.

Right, but then Eternal September happened.

Nowadays, the vast, vast, vast majority of Internet users don't have the necessary background knowledge to understand how to protect their privacy online, and the people who do have that knowledge tend to concentrate into organizations that have a lot of financial incentive not to respect others' privacy.

Because the threat landscape — both malware and privacy-related — have seen a sea-change.

Not really, because much of the information data brokers have about you comes from other people. Oh, your mom gave LinkedIn access to her contact list? Now they’ve got your phone number, mailing address, email address, a contact photo for facial recognition, and lord knows what else.

Oh, your friend and confidant gave an app access to their text messages and email? Great, some data broker now has a copy of every email and text message sent between you. Hope there wasn’t anything private in there.

The argument that you can somehow protect your own privacy on the internet rings hollow when it’s invaded without any action on your part.

Easy to say, hard in practice when there's some really dodgy shit going on and given that most people don't actually (want to) dive into the subject, this isn't something that can apply to the modern age.

I mean while I agree, you postulate some libertarian ideal - freedom for all on the internet. And while I agree, there's some scummy companies that take liberties with that - and when they have a data leak, it's your information that's out there, despite your own protection.

I mean you could advise people to use an adblocker, but when said adblockers are exploited (so that advertisers can be unblocked if they pay a fee, mafia like schemes), or when the creator takes the money and hands over the code and effectively silently-auto-updating backdoor into the user's machine, they're fucked - not because of your best intentions, not because of their ignorance, but because something outside of their control.

When there's a big government with the power to shut down companies looming over there telling people to not allow said breaches in the first place, you'll be better off.

GDPR isn't the right to be forgotten, it's mainly about ownership of customer data, consent & privacy. You can have a look at this developer guide: https://techblog.bozho.net/gdpr-practical-guide-developers/ for what it means as a developer.

I'd agree with you if ad & tracking blocking was mainstream, or even better, built into major browsers & operating systems and enabled by default. We are not there yet (and might never be since a major OS developer - Google - has a vested interest in keeping the cancer that is called advertising alive) so we need regulation.

There are enforcement mechanism in the GDPR. IMO they also are quite good. The max fine are huge, but there are mechanism to help misbehaving companies into compliance and also protect companies from random lawsuit by individuals.

Such as... a General Data Protection Regulation? GDPR is not "tech-specific", it applies to technical solutions, yes, but also to business requirements and administration, and non-technical data collection. One non-tech consequence here is that stores are encouraged not to ask your SSID equivalent, since that exposes deeply personal information to others nearby.

> Just require details on what's shared and with whom for those seeking it

That's a big part of GDPR, actually. You're allowed to collect data, with certain rules about transparency and anonymization, and as long as there are reasonable motivators for collecting it. Within reason and with exceptions, I'm sure, but nonetheless, that's a big part of it.

> You're gonna find most people don't care anyways

I'm willing to bet few people cared about regulations on traffic safety and alcohol as well. That doesn't mean that regulations to hold bad actors responsible aren't necessary, as has been proven countless times through leaks, sometimes very large or sensitive leaks.

> And please please learn from EU mistakes and establish enforcement mechanisms.

What do you mean by this? What "mistake" has the EU made? They have enforcement mechanisms in place to target companies for violations of GDPR. It will take time to work out the details and establish case law, but I don't see anyway around that. Even if you introduce "small" regulations, companies will fight the charges or fines that you bring to establish precedent.

> If we all have to hire lawyers and/or compliance assistance, then the first step is too large.

You all don't. Larger corporations probably do, but that's unavoidable. GDPR was announced something like two years before implementation, and published in a lot of different ways beforehand. There were compliance consultants, yes, but there were also PSAs, education, advertisement, easy-to-read summaries and tons and tons of material to read up on.

> heavy-handed government regulations on the internet bring more bad than good

The view of pre-GDPR internet as something free of regulation, or free from government involvement, or as nothing but a land of milk and honey seems to me like a pretty severe case of rose-tinted glasses, especially if we're talking the last 10-15 years.

There have been a lot of issues with the internet, even without mentioning all the severe privacy breaches, or breaches that are a concern for national security.

Oddly enough, you're frustrated about "degraded UX", but for several years now - UX has been terrible with annoying popups asking you for your email, advertisement-ridden websites that attracts traffic via well-crafted titles while the content is something to be desired...

Don't be a peon. But if you decide you want to be one, think about your other fellow humans - maybe they don't want to be peons.

Neither Google nor Facebook is in compliance with GDPR. FB was busted using 2FA phone number for ad targeting. Google has been taking data for various purposes for decades and linking it all together for other purposes. These are bright-line violations of GDPR's purpose-limitation design.

Smaller companies, by contrast, can change more quickly or start with compliance by construction, as Brave has.

It's a silly slogan that GDPR only helps big incumbents. Regulation tends to help incumbents under varying degrees of regulatory capture, as in the US. Europe is different, and India, Brazil, and others jurisdictions are following suit. California's CCPA is weaker (on protected data, opt out rather than opt in, ambiguity about duress = denial of service if off-purpose data not provided, enforcement), but also in line.