I'm impressed by the careful thought you are putting into this. On the copyright front, that body of law is not going to do it for us. And it's such a well-de

I'm impressed by the careful thought you are putting into this. On the copyright front, that body of law is not going to do it for us. And it's such a well-developed body of law motivated by very different sets of concerns, that I don't think trying to shoehorn privacy rights into it would yield the right results. Typically when laws are passed regarding these types of regulatory matters, there are penalties specified (either in the statute or in regulations) and there is a regulatory body setup to enforce the law. But you don't technically need a regulatory body, as you point out. Take the example of labor laws in California. Yes, there is a labor department and an enforcement body. But several years ago, the State of California realized that its regulatory enforcement division was understaffed and underresourced. So, the Private Attorney General Act was passed (PAGA), which allows private litigants to initiate something like a class action to enforce labor laws against their employers, without all the requirements of certifying a class action. There's no reason this couldn't be done for privacy law enforcement. Of course, there are also regular old class actions, as well. But if you wanted to encourage enforcement, a more friendly mechanism would be preferable. At the federal level (and in many states), the tides are against class actions. It's become more and more difficult to bring them. So, there's that issue. But the bigger problem here goes back to the fact that the US hasn't seen fit to enact much in the way of basic data privacy protection compared to other developed nations. That's why I point to the EU, as a comparison. I'll try to find a good resource to compare US vs. EU data privacy laws. You might be shocked. The reason I pointed to private business as a way to start is that a constituency has to develop in favor of any law requiring this type of data privacy reporting/protection. It doesn't appear to exist yet. It seems like we need a cultural shift. And the genius behind your idea is that it would provide information that might start a cultural shift. So, if one were to create an ACME INC. that would offer an easy software solution other companies could subscribe to in order to get do this type of reporting AND the market started to demand it to some extent (which might require good marketing by ACME INC.), at least that might start the ball rolling towards creating a constituency. Let me give you a non-privacy related example. You might not realize that dietary supplements (like vitamins) are not really regulated for content. False advertising laws apply to supplements, like anything else. But there is no agency verifying that your vitamins contain what the bottle says. An organization called USP, which is a private organization, has begun offering verification services. A company (like Nature Made) can pay to have a supplement verified by USP and then they can put that verification on their labels. But that's not a government verification. It's a private verification. In some ways, that's the data privacy system in the US. There's little data privacy regulation outside of certain fields (healthcare, banking, schools). In the unregulated fields (most things), companies may have a privacy policy. You can sue for violation of the privacy policy, perhaps. But that's it. Private organizations offer certifications (Trustee, for example). Yours would be another private attempt to create something akin to a regulatory system (though it would really be an information delivery system). If you wanted to get a law passed, I'd go abroad to somewhere like the EU. If one could lobby to get this passed there, plenty of companies in the US might start adopting this technology anyway.