Data brokers can go underground to circumvent a ban on sales, but the end users funding that industry are legitimate businesses who (hopefully) would have to follow the laws, so it's important to target them.
We need a ban on collection of that data, not just the sale or use of it. The conditions under which it is legal to collect that data should be subject to very strict regulation and involve explicit informed consent of every person tracked, ideally refreshing that consent on a regular basis so that it's not something you could consent to once years ago and forget about.
But those platforms clearly have legitimate need to collect/house that data. They need to be restricted from selling/licensing it to third parties, regardless of any amount of anonymization or differential privacy applied.
For instance, suppose I consent for Fitbit to track me five years ago. Then Fitbit gets bought by Google. It should be illegal for Fitbit to transfer that data to Google without my consent, and illegal for Google to receive that data without my consent. It shouldn't even be legal for Fitbit 5 years ago to secretly store that data on rented Google or AWS servers without telling me which company they are subcontracting my data out to.
tl;dr: Possessing any data about people should be considered a toxic liability and a huge regulatory pain in the ass. User data should not be considered a valuable asset, but rather an evil that you loath to touch at all unless there's no other way.
I think it can get tricky. I'd rather just not allow them to track me in the first place, I guess.
So, how am I supposed to use Google Maps?
Maybe you mean long-term storage?
Still - I like to be able to see all the restaurants and places I went to. What if I like that?
Most people don't even read their mortgage contract carefully.
People aren't ever going to read a EULA to read a recipe for chicken soup.
The people making those popups wouldn't be going to such great lengths to make it hard to opt-out if people didn't want to opt-out.
Anyway, the forms should all be standardized government forms, not bespoke anti-pattern devices cooked up by web designers in a competition of malicious compliance.
I personally hate being the "I told you so" guy. I try to warn people about things like security, privacy, and backups of important data, and am frequently ridiculed as "paranoid" (and much worse) right up until their cavalier attitudes about these things bite them in the ass and they lose decades of irreplaceable important data, or they get "doxxed" or worse yet, become the victims of "identity theft" and then they inevitably come crying back to me to help them "fix it". I don't want to have to tell people "Yeah, sorry. You're screwed at this point." That never feels good to say.
This uncontrolled corporate and government collection of (what should be private) data is another such situation, where people don't need it to be happening, but they've been trained by these corporate and government entities to believe it's "necessary" or "useful" somehow, and those people absolutely refuse to accept that there may be better (and safer) ways to handle such situations other than just blanket collection of data on corporate or government servers. Maybe we're "hostile" to these activities because they're hostile activities and we're trying desperately to convince folks there's better options.
Have none of these people considered that maybe other "people in the know" AREN'T "hostile" about these "data collection" actions for good reason perhaps?
Most people are aware that everything has a cost. Some people want us all to live under rocks because they don't like big companies. Other people think it's worth the cost. The vast majority of people just like "free" stuff.
They do want their data "collected", in the sense that they are happy with it being used for some kind of legitimate purpose – like providing a service to them. Most people will also accept their data being collected for various other reasonable purposes – like logging, fraud monitoring, that kind of thing. I will accept that there are probably quite a few people who don't care either way.
There's a weird kind of reaction—among some tech people in particular—to the idea of regulating data collection – all sorts of total non-sequiturs, like "but are you telling me I can't have web server logs any more!!!" or "how would we have google maps!!" that requires either a stunning lack of imagination or deliberate feigned ignorance.
Atlas data can be sent to the map application without the map application sending personal data back to the atlas provider. If that means the map application can no longer be "free" (funded by user giving up their data) then so be it. Of course the atlas provider could log users and which map regions they request, but the point is to regulate that logging so severely that the data becomes a liability not an asset.
> I like to be able to see all the restaurants and places I went to
This isn't difficult to implement either without sending any information out.
If you send me data, why shouldn't I be able to collect it?
I think we are mistaking how important recency is. Sure the current data on me has value, but there is also value in figuring out what my current behavior has meant in the past with other people, and trying to figure out what I might do next even if you haven’t tracked me specifically within an inch of my life, right now.
Knowing what I did five years ago and what people in my social groups do might be valuable enough even though you’re “protecting me” going forward. As you say, we might have to make this data a hot potato. Create situations where hoarding is a liability rather than an underutilized asset.
One of the practical problems with the "war on drugs" was its bumping up against individual privacy. Corporations have no such privacy nor right to privacy - being chartered under government authority means they need to continually file compliance reports and are essentially closer to being organs of the state rather than individual humans. So no, if a company does decide to illicitly process personal information for nonconsensual purposes, that most certainly can be enforced upon.