According to the article, the author did not give up their personal info online, they were required by their doctors to provide or decline consent for selling t

According to the article, the author did not give up their personal info online, they were required by their doctors to provide or decline consent for selling their medical data after physically arriving at the doctor’s office as a prerequisite for obtaining the medical assistance they needed. Unfortunately, the more onerous you make the requirements for handling a type of data, the more the people who need to handle it will tend to outsource that handling to compliance-in-a-box providers whose bona fides they won’t be willing or perhaps even qualified to check, the fewer such providers there will be, and the more incentive the remaining ones will have to pull malicious stunts like this. Less regulation, a free-for-all. More regulation, regulatory capture. I don’t see how you can win here. Simple regulation, stringent enforcement with licence to punish loophole-seekers? A nice thought, but this too tends to evolve towards the BIG BALL OF MUD equilibrium as lawmakers try to improve the situation for one or another constituency, and there’s no counterbalancing force towards simplicity. Or rather there is—things gradually clog up and become less and less effective—but it works on scales far beyond the planning horizon of a legislator or the attention span of a voter. (See: the tax code just about anywhere.)