Forcing consent before selling browser histories violates our free speech

Fraud isn't a huge regulatory framework. The main reason for that is that you need intent to defraud, which can be ambiguous around the edges but it's pretty damn hard to do it by accident. The analogous thing for privacy would be prohibiting the sale of private data -- and that's probably a good idea. Because it's pretty hard to do that by accident and most honest businesses don't do it at all, so you're not putting a huge compliance burden on millions of unsuspecting businesses, only the few that actually sell data.

But there are still some nasty things you can do with private data without actually selling it. That's not as easy.

> Anyway, it's my impression that ISPs already log some traffic metadata, given that I read about requests from police etc. And of course there are capabilities under CALEA.

Whether they do it or not, there's no technical necessity to do it in order to deliver internet packets. There could be a law outright prohibiting it and it wouldn't make them any worse at being an ISP.

And if there is some interesting thing the user wants that could be done by logging internet traffic, let it be done at the endpoints by some independent company which doesn't have so much leverage over the user.

> Selling and shipping stuff obviously requires information about customers, such as names, mailing addresses, phone numbers, and credit card numbers. But why should they get to monetize that information, in ways that don't benefit me?

The problem is how to distinguish what benefits you. That turns out to be a very complicated question, and governments manage complexity very inefficiently. So it's usually better to leave most of that to individual choices -- as long as the choices are available, i.e. there is adequate competition.

> I agree that it's more complicated for services that require browsing and location history. But I suspect that much more processing could be done locally. And where that was unworkable, information could be firewalled from other business units.

Right, so it's technically possible but in order to get there you have to do a detailed analysis and everybody will have different opinions about the relative trade offs.

That's hard to make a regulation out of -- either you hard-code detailed information which then quickly becomes outdated and which nobody really agreed was right to begin with, or you try to be flexible which means nobody really knows how to comply with it and huge companies with lawyers have enough ambiguity to argue their way out of anything.

Either it needs to be much simpler than that, or you need exemptions for everybody but megacorps in which case you can use the inflexible detailed long-form regulations without worrying about the compliance costs bankrupting anybody, since it only applies to entities capable of absorbing the cost. An example of which is applying it only to large ISPs.

> And even about ISPs without meaningful competition, customers can always use VPN services. That's become quite common in many places.

I think this would be a better argument if a majority of people actually used them. As it is you essentially have a knowledge barrier which prevents them from serving as viable competition.

> Also, the availability of privacy-respecting alternatives doesn't protect people who are too clueless to use them.

And maybe that's the real answer. Don't go to the government for regulations at all, instead go to them for money, DARPA style, to get the things that use local processing and aren't dependent on advertising to fund development into a state that the majority of people are actually using them.