It's hard to craft good law when the mismatch between public stated desire and public behavior is so wide.
You raise an interesting point about this apparent disconnect.
> Because behavioural psychology tests reveal
What do you know abot these "psychology tests"? Isn't the reality that both things you assert are really inferences based on anecdotal tales on forums like this one?
Do you know of any large-scale cross cultural, long term studies that show who will part with sensitive private data for small compensation? How are these studies controlled for situation, perceived reward, time pressure, trust levels?
What do we really know about widespread beliefs regarding the misuse of data? What are people's threat models? How do they assess harm?
I'm not disputing the truth of what you say - both ring true.
I think we instinctively know all rational people are strongly anti-surveillance. For complex social reasons we humans dislike creeps and snoops and treat them as social outcasts. But we also know that many people will sell their grandmother for a slight convenience or advantage. Do these two facets really clash, and if so why?
> It's hard to craft good law when the mismatch between public stated desire and public behaviour is so wide.
Is is though?
Aren't both positions reconcilable if people make no causal link between the two? What if people just don't have the capacity to make that connection? Could good laws still protect them in the way that laws about asbestos protect people from harms related to chemistry and disease they cannot possibly understand?
They may not understand the chemical mechanisms, but the end effect is super easy to understand: “hey if you breath this in you get cancer”; “hey if you eat this, you die”
Compared to the threat of something like cookies… “hey if you let these companies spy on you then…?”
Then you'll suffer multiple digital, and eventually physical harms;
- You'll lose money on bandwidth that's robbed from you
- you'll lose access to goods and services on the basis of calculated prejudice
- you risk identity theft, impersonation, having loans taken out in your name...
- you'll be exposed to manipulation, targeted disinformation
- you'll experience increased targeted attacks like phishing
- friends, relatives, spouse and others close to you will also be targeted
- your time will be wasted dealing with more spam and nuisance
- you will lose CPU, memory and battery life as the concrete resources of your devices are given over to the advertising burden
- you will eventually suffer tangible harms, loss of employment, impacted credit score, loss of medical access...
Sure, it needs more words to explain. Not quite so punchy and succinct as the real deal. But digital cancer caused by these companies' products can well be explained to the average "consumer" if they just stuck an ugly picture on the carton of a destitute homeless guy and the message "Surveillance capitalism can ruin your life".
What does it mean to have bandwidth "robbed" from me?
What do I care if my gigabytes-of-RAM multi-core CPU is burning some cycles? Have those cycles also been "stolen" by, like, articles I don't want to read or useless comments?
Is there more identity theft risk from targeted ads than, say, the LastPass breach? Google, in particular, keeps that data deeply vaulted and protected.
Am I really exposed to meaningfully targeted disinfo relative to self-sorting by watching Fox News? What about meaningfully-targeted info, like Facebook making it easy to find my elected representatives because they know my address?
Do we have evidence of correlation between targeted ads and phishing? Most phishing I'm aware of just uses big popular names and the law of averages... You don't need targeted info on a consumer to guess they use Amazon.
I worry that bans based on this shaky ground would look more like Prohibition than asbestos bans.
It's hard to support an argument that we should change the law if the harm isn't proven, and "someone directed my computer to use more CPU cycles than it otherwise would (after I voluntarily accessed their server)" isn't a story of self-evident harm.
(And that's leaving out the unsupported strong assertions that "you will eventually suffer tangible harms, loss of employment, impacted credit score, loss of medical access," which... What? Loss of employment because companies spy on me? That screams "lack of causality."
As an employed tech worker in the United States, I operate under the assumption that my employer has access to my corporate inbox. Is your assertion that I could be fired for something I say there [in which case the harm is I said something damaging to my company, not that my company knows about it] or some other mechanism?).
But it is, shadowgvt my friend please dig deeper. It absolutely is! Over and again in multiple quality peer reviewed studies and analyses by prominent security engineers and psychologists...
This "big tech = bad" thing isn't just some matter of sloppy marginal opinion. It's tediously mainstream thinking now. The only real question is what to do about it. We both know that's not easy. But at this point attacking the premise just seems like a waste of time.
A fair place to start is here, with the "ledger of harms" [1]
Good laws will protect the public from themselves, even at the cost of supposed freedoms (think schedule A drugs, production, revenge porn, tobacco).
Yet, we consume documentaries about how evil zuck is and love to hate him.
But shouldn't we take both into account or just think about it hard once and then be done with it? We're wasting a lot of time and energy.
Some people would also sell their right to vote for $5 if that was legal. It's not hard to make such a law. You simply could make it illegal e.g. to offer money for PII during a purchase that doesn't strictly require it. Or to not respect the automatically transmitted cookie choice. Those who oppose such laws are the lobbyists of the big companies, not "the people".
This was not good law. Badly-thought-out law has unintended consequences (or even maliciously-crafted intentional consequences at the cost to the public).
https://thehill.com/homenews/nexstar_media_wire/3709676-is-i...
The "Global Privacy Control" header is apparently the second attempt to cook this goose.
Oh wait - it was a thing, and was used as just another data point for tracking.