6 ms·

By the year 2030, the amount of fine print and opt-ins at the top of each website - in order to comply with every state and country's bespoke data regulations -

By the year 2030, the amount of fine print and opt-ins at the top of each website - in order to comply with every state and country's bespoke data regulations - will be larger than the warnings on cigarette packs.

gpderetta 7y ago
Considering that the regulations are there to help websites getting rid of their addiction to personal details, it seems fitting!
ginko 7y ago
Or you know, websites could just stop collecting unnecessary amounts of data by default.
- CWuestefeld 7y ago
  There would still need to be a link to a page that says that.
  - remus 7y ago
    Sorry if you're being sarcastic and it's totally gone over my head, but if you're not processing personal data you don't need to explain all the ways you don't process personal data. Otherwise you might as well explain all the other ways you're not breaking the law (which is going to be a long list).
    - nerfhammer 7y ago
      this comment, its timestamp, your username, your browser cookie, your password all could easily count as personal data
    - SpicyLemonZest 7y ago
      It's impossible to build a website that doesn't process personal information at all, because the California law explicitly defines your IP address as personal information.
      - zAy0LfpBZLC8mAC 7y ago
        Except the _website_ doesn't have to know the IP address? It is perfectly sufficient for your IP stack to know it while the connection is established, and then immediately forget it.
        lmkg 7y ago
        If you delegate the processing to a service provider, you're still responsible for it. Someone has to do it on your behalf, which is isomorphic to you doing it.
      - paulmd 7y ago
        assuming it works like GDPR, that is presumptively acceptable on multiple grounds: (a) it is necessary to provide you business services (serving you the website) and (b) you are not retaining/logging it. california didn't outlaw the internet guys, you're just being hysterical because you're going to have to ease back on your data collection a bit
        SpicyLemonZest 7y ago
        It's presumptively acceptable, yes. But the comment I responded to was saying that you don't have to even explain it, and I don't think that's true; the law makes it pretty clear you do.
- Litmus2336 7y ago
  Hacker News without cynicism would be like Disneyland without Mickey Mouse :)
- milesskorpen 7y ago
  IANAL, but my understanding is that it's not even clear you can avoid the "don't sell my data" language in CCPA even if you don't sell/share/collect data.
  - vageli 7y ago
    > IANAL, but my understanding is that it's not even clear you can avoid the "don't sell my data" language in CCPA even if you don't sell/share/collect data. This is how my company's counsel (and other attorneys with whom our counsel consults with) has read the CCPA. If you don't sell data you don't need to include language to opt out of data sales since you don't do it. If that changes you have to message customers of change and provide the button.

gpderetta 7y ago

Considering that the regulations are there to help websites getting rid of their addiction to personal details, it seems fitting!

ginko 7y ago

Or you know, websites could just stop collecting unnecessary amounts of data by default.

CWuestefeld 7y ago
There would still need to be a link to a page that says that.
- remus 7y ago
  Sorry if you're being sarcastic and it's totally gone over my head, but if you're not processing personal data you don't need to explain all the ways you don't process personal data. Otherwise you might as well explain all the other ways you're not breaking the law (which is going to be a long list).
  - nerfhammer 7y ago
    this comment, its timestamp, your username, your browser cookie, your password all could easily count as personal data
  - SpicyLemonZest 7y ago
    It's impossible to build a website that doesn't process personal information at all, because the California law explicitly defines your IP address as personal information.
    - zAy0LfpBZLC8mAC 7y ago
      Except the _website_ doesn't have to know the IP address? It is perfectly sufficient for your IP stack to know it while the connection is established, and then immediately forget it.
      - lmkg 7y ago
        If you delegate the processing to a service provider, you're still responsible for it. Someone has to do it on your behalf, which is isomorphic to you doing it.
    - paulmd 7y ago
      assuming it works like GDPR, that is presumptively acceptable on multiple grounds: (a) it is necessary to provide you business services (serving you the website) and (b) you are not retaining/logging it. california didn't outlaw the internet guys, you're just being hysterical because you're going to have to ease back on your data collection a bit
      - SpicyLemonZest 7y ago
        It's presumptively acceptable, yes. But the comment I responded to was saying that you don't have to even explain it, and I don't think that's true; the law makes it pretty clear you do.
Litmus2336 7y ago
Hacker News without cynicism would be like Disneyland without Mickey Mouse :)
milesskorpen 7y ago
IANAL, but my understanding is that it's not even clear you can avoid the "don't sell my data" language in CCPA even if you don't sell/share/collect data.
- vageli 7y ago
  > IANAL, but my understanding is that it's not even clear you can avoid the "don't sell my data" language in CCPA even if you don't sell/share/collect data. This is how my company's counsel (and other attorneys with whom our counsel consults with) has read the CCPA. If you don't sell data you don't need to include language to opt out of data sales since you don't do it. If that changes you have to message customers of change and provide the button.