I’m curious about what you’re saying here and I’ll certainly be thinking about it more, but here’s something I was thinking about: maybe a step in the right dir

I’m curious about what you’re saying here and I’ll certainly be thinking about it more, but here’s something I was thinking about: maybe a step in the right direction would be to require permissions to offer a user configurable time limit. I think that users should be able to set the permission they grant to expire after a term of their choice—if they want to grant perpetual permission, fine. I think it would be interesting to think about the implications of apps having to come back to get reauthorization. When permission expires, maybe that just means that no more data can be collected; maybe it means the vendor has to destroy those records. Either way, I don’t want large companies to be able to exploit people who click a button they don’t read. Maybe companies should be required by law to charge users some form of consideration just like other contracts so that we can do away with companies dangling their product as a free carrot in exchange for swaths of personal data, and then leaking it.