Also, if competitors do respect privacy, why would statutory protection be burdensome?
The issue is that "privacy" itself becomes ambiguous in many contexts.
For an ISP this is easy, because they can forward your traffic without ever storing any of it. They have no legitimate reason to keep it and they only want to in order to invade your privacy, so there is nothing good lost by prohibiting that.
By contrast, how do you make Waze work without user location data? How do you make recommendations based on viewing history without keeping viewing history? How do you ship a physical product to a customer without having their mailing address? In these cases it's not just a simple matter of not collecting the data.
So the problem is the complexity of the rules. "ISPs shouldn't store any user internet traffic or metadata" is simple and reasonable, and is necessary because without it the one or two local ISPs would all do the opposite and no one would have a choice.
Applying a much more complicated set of rules to companies that do have legitimate reasons to collect some data or use it for various things customers actually want has both higher costs from an administrative perspective and lower benefits because viable privacy-respecting competitors actually exist in real life for the people who don't consent.
Anyway, it's my impression that ISPs already log some traffic metadata, given that I read about requests from police etc. And of course there are capabilities under CALEA.
And it's understandable that they'd like to earn some money from it, just as Google etc (and my bloody credit providers) do.
Selling and shipping stuff obviously requires information about customers, such as names, mailing addresses, phone numbers, and credit card numbers. But why should they get to monetize that information, in ways that don't benefit me? That's arguably as clear a distinction as ISPs being unable to monetize by traffic metadata.
I agree that it's more complicated for services that require browsing and location history. But I suspect that much more processing could be done locally. And where that was unworkable, information could be firewalled from other business units.
And even about ISPs without meaningful competition, customers can always use VPN services. That's become quite common in many places.
My ISP gets nothing from me except which VPN service I use, and throughput vs time. And that VPN service gets nothing from me except which VPN services I use through it. And so on until the last VPN service, unless I'm using Tor.
Also, the availability of privacy-respecting alternatives doesn't protect people who are too clueless to use them.
Fraud isn't a huge regulatory framework. The main reason for that is that you need intent to defraud, which can be ambiguous around the edges but it's pretty damn hard to do it by accident. The analogous thing for privacy would be prohibiting the sale of private data -- and that's probably a good idea. Because it's pretty hard to do that by accident and most honest businesses don't do it at all, so you're not putting a huge compliance burden on millions of unsuspecting businesses, only the few that actually sell data.
But there are still some nasty things you can do with private data without actually selling it. That's not as easy.
> Anyway, it's my impression that ISPs already log some traffic metadata, given that I read about requests from police etc. And of course there are capabilities under CALEA.
Whether they do it or not, there's no technical necessity to do it in order to deliver internet packets. There could be a law outright prohibiting it and it wouldn't make them any worse at being an ISP.
And if there is some interesting thing the user wants that could be done by logging internet traffic, let it be done at the endpoints by some independent company which doesn't have so much leverage over the user.
> Selling and shipping stuff obviously requires information about customers, such as names, mailing addresses, phone numbers, and credit card numbers. But why should they get to monetize that information, in ways that don't benefit me?
The problem is how to distinguish what benefits you. That turns out to be a very complicated question, and governments manage complexity very inefficiently. So it's usually better to leave most of that to individual choices -- as long as the choices are available, i.e. there is adequate competition.
> I agree that it's more complicated for services that require browsing and location history. But I suspect that much more processing could be done locally. And where that was unworkable, information could be firewalled from other business units.
Right, so it's technically possible but in order to get there you have to do a detailed analysis and everybody will have different opinions about the relative trade offs.
That's hard to make a regulation out of -- either you hard-code detailed information which then quickly becomes outdated and which nobody really agreed was right to begin with, or you try to be flexible which means nobody really knows how to comply with it and huge companies with lawyers have enough ambiguity to argue their way out of anything.
Either it needs to be much simpler than that, or you need exemptions for everybody but megacorps in which case you can use the inflexible detailed long-form regulations without worrying about the compliance costs bankrupting anybody, since it only applies to entities capable of absorbing the cost. An example of which is applying it only to large ISPs.
> And even about ISPs without meaningful competition, customers can always use VPN services. That's become quite common in many places.
I think this would be a better argument if a majority of people actually used them. As it is you essentially have a knowledge barrier which prevents them from serving as viable competition.
> Also, the availability of privacy-respecting alternatives doesn't protect people who are too clueless to use them.
And maybe that's the real answer. Don't go to the government for regulations at all, instead go to them for money, DARPA style, to get the things that use local processing and aren't dependent on advertising to fund development into a state that the majority of people are actually using them.
I'd settle for sale being illegal.
> But there are still some nasty things you can do with private data without actually selling it. That's not as easy.
True. But as you say, that quickly gets complicated.
> And maybe that's the real answer. Don't go to the government for regulations at all, instead go to them for money, DARPA style, to get the things that use local processing and aren't dependent on advertising to fund development into a state that the majority of people are actually using them.
That would be very cool.