Frankly, rather than wrapping this in child protection rhetoric, this should have just been a universal privacy protection law. If they had skipped all this "Th

Frankly, rather than wrapping this in child protection rhetoric, this should have just been a universal privacy protection law. If they had skipped all this "Think of the Kids!" nonsense, and just banned the utterly abominable data gathering rampant on the internet today, this kind of negative side effect could be completely avoided. What we need is basic, common sense legislation that says: - Gather no more data than you need for business purposes. Persist even less. If you can't express a specific business purpose for the data, you can't gather it. - Share no more data than you need to for business purposes, and with as few parties as possible. - Publicize those specific business purposes paired with what categories of data you collect, and who you share it with. This should be a table, with 4 columns: "category", "justification", and "Shared With", "Duration". - Whatever data you do gather, you're liable for, with good-faith attempts at following industry best security practices being an mitigating factor but not a complete defense in civil suites following a data breach. The GDPR didn't go far enough: the law should be explicit in stating that the user CANNOT consent to data being gathered about them in excess of what a service they are actively engaging with needs for legitimate business purposes. The less wiggle room you give, the less ridiculous, user-hostile attempts to circumvent the law you'll have.