Silicon Valley is terrified of California’s privacy law

That way it feels more transparent to the end-user, and they have to make the conscious choice of either giving a bit of their data in exchance of a free service or be prepared to pay to keep their data private.

We impose these restrictions for the good of the public. If we decide that exchanging personal data for goods and services should be illegal under certain conditions, I don't see why that's any different than the precedents I mentioned.

> - Businesses can, however, offer “financial incentives” for being allowed to collect data.

This just means your service always costs money, but you can refund the full amount for allowing you to collect data.

Not if the thing I value is my personal data. Because I, as a typical short sighted consumer, will consistently underestimate the value of my data, as well as how my data affects those around me (extreme case: my data is my social graph, which you can use to reconstruct the social graph of my acquaintances).

If I don't know the actual value of what I am giving up, I am naturally going to get swindled.

If Friendo doesn’t have the same relationship I have with Tech.co, how is Friendo benefitting? Where is the exchange there?

Any concern regarding whether consent is likely to be withheld really just points out how stupid a company's business model is. Incumbent vs. Startup is also a false premise because Facebook is an incumbent that relies on selling user data. They do make some money from purely internal advertising, but in total Facebook only makes less than $5 per user when selling data, and that's lifetime, not per year. So the only way to make real profits from selling data is if you sell millions of people's data. Their internal data use however, is just for add targeting which they make more money from each year. This internal use makes more per user and is therefore a more viable strategy for a small company than selling data.

There are already regulations that make it impossible to sell user data that would be valuable that apply to more than just internet collected information. So, any data selling strategy a startup or incumbent company might have will either not earn significant profits or is very likely already illegal.

In any case, advertising revenue rarely ever covers a company's expenses. If a company is only staying afloat because of selling data, then that company is achieving a very poor return on investment and is wasting the time of everyone involved. Either they need better business processes, strategies or they're not offering something of sufficient value to be worth the time put into the business.

In this view, a company offering a discount in exchange for sharing is inherently deceptive.

The service isn't free. The exchange just isn't money. When money is involved a price is put forth. It's an agreed to and published exchange mechanism. When it's data on someone the price isn't shared. It's kept secret. There's always a price. It's just not always money or public. This will make more information public.

I wonder if this will start to change how business operate. Right now they are skewed against consumers towards businesses. I wonder if consumer protections, like this, will cause businesses to re-evaluate business models.

Giovanni Buttarelli, European Data Protection Supervisor “There might well be a market for personal data, just like there is, tragically, a market for live human organs, but that does not mean that we can or should give that market the blessing of legislation.”

Privacy is fundamental human right that you cant trade for. Same as you cant sign a lawfull contract that you want to be someones slave, even if you want to.

However, customers aren't well informed, and if they were, they wouldn't use these services. Currently customers are getting scammed for their data. This is why we need regulation.

The problem is that these companies advertise their products as "free," which means something very different. And they usually don't mention at all that they're collecting shit tons of personal data. It's taking advantage of people's ignorance, and it's practically fraud, IMO.

Every other business tells the customer up front what the price is, and maybe it's time tech companies started doing the same.

Without telling users what data they collect, how much they collect, how they use it, and who they give it to, there's no way for users to make an informed decision.

I never explicitly stated that I'd serve these companies by giving my data. Services cannot be assumed, why do you think there are such long Terms of Service. We as users should also have Terms of Service then.

EDIT: Several comments below point out the innumerable businesses operating in such a way as to make mine an impossible claim.

Enumerating the established methods to avoid meeting the legal parameters of price discrimination is not the same as price discrimination being legal.

My bar for following just laws is higher than the minimum required to avoid being prosecuted. I’m sure experts can help work around any future privacy laws too, so why even worry?

Surveillance already creates a different product one can charge more for, though your lawyer might advise you call it “personalization” in memos.

Maybe you can show me generic ads based on your content instead of targeting them based on where I've been on vacation last month, etc.

Or simply stop building businesses based on people data. Sell something people want to pay for. Humankind has been able to do that for thousands of years, did we forget how to do it?

Couldn't a financial incentive be charging more?

> including by charging the consumer who opts out a different price or providing the consumer a different quality of goods or services, except if the difference is reasonably related to value provided by the consumer’s dat

Doesnt that second part cancel the first part? Businesses can also pay money for data ... so facebook can switch to subsciption only, but pay its users with virtual coins for viewing ads

If people don't find your product valuable enough to pay for, then your company should go out of business.

Companies have been exploiting people's privacy behind their back, and now that they've been called on it they're throwing a tantrum.

"Something" doesn't mean "anything". You can't offer your services in exchange for e.g. my body parts. Why are we willing to ban that but not our data?

> The only reason those services are being provided at all is to get that data. That's effectively a requirement that people provide services for free.

Well, no — they could charge money for them. But even this is a false dilemma; surely we can come up with at least one business model other than "charge directly for our service" and "surveil our users".

We don’t scrap seatbelt and airbag regulations just because they’ve had some unintended side effects.

Regulations aren’t set in stone forever, either, and a functional legislative body can always modify and update them as their effects become more well known.

Or, well, maybe I sound too idealistic. But...I think most of us can all agree that consumer data protections are highly lacking.

So does a lack of regulation. That's how we ended up here.

necessarily there needs to be a way for that business to confirm your identity and link you to that data

Why would linking you to that data require confirming your identity? My password links my HN account to me and me alone, while revealing nothing about my identity.

There's no conflicting views. They're two, completely compatible aspects of the same view.

One is how much or how little data each service gets about you. The other is how much control you have over what those services do with the data they do get.

That's why technical and legislative solutions work in tandem, reducing the former (amount of data) and increasing the latter (control over data). That's also why technical solutions are preferable: there's no need to legislate control over data that services are unable to collect about you in the first place.

It today's world, data about a person is an asset. A person should own their assets, and have control over them. If there were only one option, this would have to be it - it's the only one that aligns with business interests. If you instead go purely the route of anonymous data collection, because data is such an asset it just gives businesses the strong incentive to find ways to de-anonymize your data. That is an unstable situation, and a societal counter-productive incentive.

Since data on me has value (clearly since businesses are run off it), make it a true product. Give it value, allow me as a consumer to trade it, allow businesses to quantify it's value in the market place, and explicitly bid on. That aligns incentives. As data becomes more (or less) valuable, businesses will adjust their prices for it. This aligns incentives, the more data is worth to a business, the more they'll be willing to pay for it. IMHO this is clearly the right approach.

That said, there is still a world where both methods exist. Users choose when they interact if they want to perform anonymous interaction (or pseudoanonymous), and people provide services to ensure it is anonymous. HN, reddit those are forms people would likely choose pseudoanon for, but there would be a firewall between someones pseudoanon identity and their true identity. And people would be pseudoanon knowing the risks and taking care to not divulge linking identityy info, and businesses would ensure there are limits on data preservation / recording of pseudoanon interactions. The same way people post on HN and use care in what they choose to disclose, HN would also ensur data expiry is short enough and would not share/sell pseudoanon data to 3rd parties.

Again, if you can only pick one, it has to be consumer ownership of their data, but I think they both can work together.

Basically this puts Facebook in a real tight situation, I honestly wonder how they will survive it.

For example, I think it would be legal for Verizon to get around this law by increasing their prices by $5 across the board, and offering a $5 rebate for customers who want to opt-in to their data being sold.

But it would not be legal for Verizon to allow customers to opt-out of data collection by paying an extra $5 a month.

In the first approach, Verizon will not track by default and customers have to opt-in.

In the second approach, Verizon will track by default and customers have to opt-out.

I agree that there is no practical difference between the two, but given how deceptive companies can be when disclosing various pricing and hidden fees, this might be an attempt to curb that behavior?

The second line would allow companies to pay people to permit them to collect information. I imagine that because of the first statement, a company that is charging for the service cannot take advantage of this statement.

Yes a click counts as personal data if you can reference it back to a real person. Aggregated clicks probably wouldn't.

Selling ads based on personal data is selling your personal data. The personal data provides the value to the transaction.

Yes lots of companies may need new business models, but for the most part what I've seen is dark patterns, non compliance or wriggling to avoid any real change.

In Europe at least, it's back to the regulators to make a move.

HIPPA manages with "Patient data". The standard techniques include non-reversible addressing of users. Patient N has an internal number and an external number. Without having Patient N's internal record in hand, you can't correlate it back to that user, which is particularly useful in a legal defense.

I sure hope so.

> Many companies, including Google would have to significantly change their pricing model if so

Good. It would be even better if they have to change their business model.

YES YES YES YES YES.

Are you not already doing this for passwords, credit card numbers, and social security numbers?

Such a request is essentially NP-complete.

I think you mean undecidable, or equivalent to the halting problem, or subject to Rice's theorem. NP-completeness is irrelevant. I think you'll find that HN is the last place you'll win arguments by inaccurately using technical terms in the hopes that it will go over other people's heads, Legally Blonde-style (https://www.youtube.com/watch?v=8rNVaY7Stt4).

To anyone who knows what they're talking about, this an obviously nonsensical argument. It's similarly undecidable to verify whether the data that you expose publicly contains customer data, or customer passwords, or your own passwords, but you do it anyway, by restricting your engineers to only write and deploy code that they understand.

Nonsense. You write the log statements. You know what data structures you are logging.

If you're using some server's built in logging, or some logging library or middleware you don't understand, turn that off until you understand what it's logging.

I don't think this is quite the dichotomy you make it out to be.

So we can create optimizing compilers, but we can't figure out what to log?

This seems like a problem of never having motivation to solve the problem before.

"We can't do that, it's too hard" is often a mea culpa I'm industry when they oppose regulation. Then they will come up with a solution from having actually spent some effort to actually think of potential solutions.

Don't bring complexity theory into it.

The Backups question is a bit more complex. One source I've seen: "According to France’s GDPR supervisory authority, CNIL, organisations don’t have to delete backups when complying with the right to erasure. Nonetheless, they must clearly explain to the data subject that backups will be kept for a specified length of time (outlined in your retention policy)."

Paired with that is that if you're keeping data (or backups) for any length of time beyond the immediate needs of the customer then you need to be able to justify it.

Think this law is going to allow me to require 7-11 to delete me from their DVR records? Not part of the business model, it's a matter of security. Nice straw man though.

Their terrible system design can't handle "FROM PornPrefs DELETE SSN,Name,Address WHERE SSN LIKE "999-11-2222"". They brought this on themselves.

Just like I don't want startups making unsafe medicine, or losing my medical secrets.

Why? There are plenty of tech companies that collect very little data, and don't sell any of it. I fondly remember one of my customers telling me how much effort it took to come up with a wordy enough privacy policy page for one of their products so that it wouldn't look suspicious. The first draft was barely two paragraphs long and contained just a couple of items, most of them ephemeral (e.g. IP addresses, which were collected only for logging purposes and were only stored for 30 days).

If a company is unable to even articulate what data it collects and cannot do basic operations on it (e.g. remove a piece of it), then it shouldn't be in the business of handling personal information. The same way a clinic that can't even keep track of blood samples shouldn't be in business.

And if a company's earnings depend strictly on being able to collect and sell personal data, what they need is a better business plan, not having everyone turn a blind eye.

I’ve always been told that it’s good practice to take periodic backups. In the absolute worst cases, you can simply restore directly from these.

If a customer requests that their data are deleted, in addition to my production instance, does that mean that I have to remove their data from my backups? If so, I’m uncertain of the best way to do this. I’m uncertain if many managed services will allow me to mutate backups. And even if I were managing my database and backups directly, it seems painful to load each backed up database, remove the data, and rewrite the backup.

Note: I’m not saying that any of this is impossible. However, it does require a lot of ancillary engineering work difficult for a small company that’s just trying to get to product market fit.

But if that is really a problem, just apply the requirements to companies with a minimum amount of users. Venture capital funded companies don't need to cut corners and shouldn't be allowed to when it comes to privacy.

This is complete nonsense. The biotech industry is very large and vibrant and are most certainly not Big Pharma.

Remember last year when there was a big hoopla about that Massachusetts court case that hinted that any online vendor would now be responsible for collecting and reporting on sales tax for purchases coming from any US state (even if you as the business owner didn't have a business location there). Basically changing the requirement of the buyer to report sales tax for out of state purchases onto the business. The only problem is there's 9,998 different tax jurisdictions (as of 5 years ago)[1] spread across 50 states.

[1]: https://taxfoundation.org/state-sales-tax-jurisdictions-appr...

> (e) Many businesses collect personal information from California consumers. They may know where a consumer lives and how many children a consumer has, how fast a consumer drives, a consumer’s personality, sleep habits, biometric and health information, financial information, precise geolocation information, and social networks, to name a few categories.

As to how this will interact with free speech - in this case, speech of the company - is a bit of an open question. One of the assumptions of the bill though is that selling telemetry data about a consumer is not a form of protected speech, and that adding some restrictions to this practice is reasonable.

You will of course forgive me if I do not find economic favoritism that benefits politically connected industrialists, the restriction of freedom of thought by oppressive governments, and the general Balkanization of the Internet, to be things that we ought to celebrate.

Once upon a time the memes of Internet culture would suggest that "information wants to be free!" Oh, sweet halcyon days of yore!

Same with the laws, especially those that remove agency from the users.

As a user, I want to be able to pay or donate to a company or individual without providing them my identity or location data. This is already an extremely hard thing to do because of tax laws like VAT. Please don't make it harder for me.

As an activist, I want everyone to use technology that by-default masks their physical location from websites they access. I want them to feel free not to provide their physical location to anyone online, including businesses like Facebook.

As an activist, I want the majority of popular online payment systems to avoid revealing a buyer's physical location by default, and I want users to feel free to not provide their physical location when paying for a digital product or giving money to another individual. This is already a (nearly) impossible goal because of the sheer amount of tax and money-laundering laws that need to be addressed first. Please don't make it harder.

Laws that force websites to geo-lock based on consumer location are going to be (in the long run) bad for privacy and bad for the open Internet. I don't care about what businesses do or don't want, but the strategies we use to take down advertisers and data-hungry corporations matter.

My less-charitable reading of this situation is that people are generally fine with using user-location as an indicator of jurisdiction because the laws working on that principle are primarily pro-privacy right now. If these laws were being passed in other areas, I wonder if people would be more nervous about the precedent they set.

A completely friction free experience is exactly what you should expect.

Every political obstacle we create for data traveling through wires undermines the entire point of having an internet, and cedes more power to legislating bodies who are clueless about technology.

An individual should be empowered to serve data to another individual anywhere in the globe without barriers, period. If people can’t get behind that idea, then just get the fuck out of the way.

I am actually in favor of privacy regulations. But there are two major issues that most people don’t understand

- Compliance is not easy if you do anything much more complicated than serve a static website. Basically anything business related will have PII. And you can introduce PII accidentally with things like logging, putting it in places it shouldn’t be

- Because the internet is open by default you need to comply with basically every single regulation on the planet, and the burden is fully on you to know how and why you comply with those regulations. (Some places will just firewall you, which in many ways is better, but others just want to make money off you)

Is it so unreasonable? Given that the Internet essentially solves the problem of technically doing this, perhaps it is in fact the laws which are unreasonable.

Your statement isn't so different from saying "it's unreasonable to expect to be able to have a nearly-instant audio conversation with virtually anyone on the planet for very little cost." I would give the same response: that no, that's really not that unreasonable given that the technical problems are essentially solved, and if there are laws preventing that, perhaps the laws are unreasonable.

If I have interesting ideas, I could write a book and sell it in every country of the world. Then this product would be taxed and would need to respect the publication-related laws of that country. On the other hand, if someone reads my book and then travels across the country to hold free seminaries to teach my ideas to the masses, it is not reasonable to try to tax this value transfer, but this is exactly what governments have decided to do.

You see: values vs principles. We can have values but we need to articulate sound principles to give life to these values. What you describe are values.

And what I contend is that we already had sound principles, principles developed across decades and even centuries. The physican establishment rule is the only sound and workable principle.

What we have now is a mess encouraging anti-democratic dynamics (centralization, fingerprinting, and ironically data collection since you need to know more about consumers to know how to apply the laws), in addition preventing innovation and making business difficult.

All of this while for every non-taxed value under traditional principles, a taxable value is actually created... but for some reason nobody is interested in investigating this correlation... for example, the person holding seminaries pays a tax on the room he rents for the seminary. But government prefer to go hard on their propaganda.

If a country wants to tax the books royalty, it should focus on upping its game to attract intellectuals instead of hacking together unsustainable notions to tax "learning".

Similar things could be said for advertising company. When an advertiser advertises in a country, it is by definition to sell a product that most of the time will be taxed into the country (and even if it doesn't, this value transfer will at the 2nd or 3rd degree lead to an activity that can be taxed).

This is why principles based on physical presence and not abstract fictions are not only sufficient and sound but they are also fair. The same is true for privacy, which are after all transactions of their own kind. If you want to regulate data, make sure people use services based in your country by creating the proper environment instead of hacking together extraterritorial laws based on wacky principles.

Just compare these new frameworks, with the readability of the physical establishment principles, that been able to accomodate even the most complex business models for centuries.

Principles should be a foundation, not something you throw out of the window as soon as you start losing to avoid confronting your difficult challenges at the cost of creating an international mess. Digital is not complex, and does not require complex regulations. Trying not to adapt to the world and not to confront your true problems is the only that is complex.

In the case of visiting a website, the customer is the one visiting you, there is no good rational to put the burden on the business. It is much more sound and natural to either put it on the consumer, a business may be visited by nationals from hundreds of juridisction, while a consumer will only visit 1 or 2 businesses.

You can also decide that the laws of the country in which the business is based apply.

You make it sound more difficult than it actually is, every website selling software products already mentions the address of the owner, at the very least to define a party for the contract / terms of service.

If the EU made a law that made the NYC bookstore liable in the EU for selling "obscene" books to europeans, and then arrested the unaware bookstore owner in a vacation to france, is that really right?

That is a big issue with the GDPR in general.

Are you sure your comment you've just made comply with the law of all the 200 countries in the world?

In B2B transactions, there are often international standards. Even where the supplier's location is set to be the relevant jurisdiction, this only follows from the assumption that a purchaser of industrial goods tends to have the experience to navigate foreign law. This cannot be assumed for consumers.

I mean, that's exactly what's going on. You can choose to follow State Y's laws when serving customers in State Y, or you can choose to not serve customers in State Y. But if you choose to not follow State Y's laws while serving customers in State Y, then State Y can use whatever leverage they can get their hands on to keep you out of State Y. That's State Y flexing their own sovereignty when it comes to protecting their citizens, which is the flipside of your argument about your state protecting you.

Surely the purchaser has some rights to sovereignity?

https://en.wikipedia.org/wiki/Incorporation_of_the_Bill_of_R...

https://en.wikipedia.org/wiki/Gitlow_v._New_York

Yet.

Hah!

It is an old trick narrative for pushing terrible "tough on crime" laws for advancement. If you point out that it isn't a well thought out idea you support bad people!

I suppose the argument would have to be made that it’s not personal data; it’s an act of public publishing or something. So in this case it’s akin to me publishing a blog and other people quoting it years later. I can delete the original blog but not the reprints in newspapers or quotes.

Or that it stops becoming “your” data and becomes instead “the other user’s” once eg the Django project accepts the PR. So you can delete user A’s PR but not the Django project’s now-integrated copy. I think this rationale makes the most sense. After all, someone could still have the repository on their computer and push it back to GitHub again.

I realize this is an edge case that doesn’t apply to 99.9999% of companies, but as an engineer I find it interesting!

Edit: after thinking this through more, I suspect that e.g. GitHub could argue they comply as long as they delete User A’s repo. Subsequently integrated PRs, etc wouldn’t have to be deleted because they could argue they’re no longer User A’s.

I kinda feel like if language to allow this was added to the law explicitly it would be open to abuse, so I suppose this kind of thing has to remain vague and open to interpretation in e.g. the courts if someone is being nasty.

He's both rightfully pointing out that TechCrunch is preaching to one minority choir and asking for another publication to preach to a different choir. Ironically the publication he's asking for was TechCrunch before it was bought by AOL and ruined.