Well, the law[1] stops them, if they feel like following the law is important. And to the extent they don't, enforcement provisions in the same might compel th

Well, the law[1] stops them, if they feel like following the law is important. And to the extent they don't, enforcement provisions in the same might compel them. Same as "what's to stop anyone who wishes to from shoplifting", really. But this misunderstands the situation anyway. The overwhelming majority of web clients that interpret CA data are provided by default in devices sold by companies with a clear interest in following the law; because if they don't they can't sell products. [1] Which I won't engage on, except to say that this seems a lot more like "dumb mistake in the legislation" than "evil plot by an unelected metagovernment" to me. The hyperbole on issues like this gets out of control sometimes, and the EFF seems to be getting worse about it and not better over time. They used to be pretty cerebral.