4 ms·

> How to take power away from brokers: A more effective approach: government. California's SB 362 creates a single opt out starting 1 Jan 2026, audit obligati

by x0x0 3y ago

> How to take power away from brokers: A more effective approach: government. California's SB 362 creates a single opt out starting 1 Jan 2026, audit obligations (mandatory 3rd party every 3 years w/ submission of failures to the CPPA, California's privacy enforcement agency), etc. Plus the potential of a $200 per day per request fine for failing to act on opt outs. https://www.skadden.com/insights/publications/2023/12/californias-new-data-deletion-law-imposes https://www.skadden.com/insights/publications/2023/12/califo...

dleeftink 3y ago
While the map demonstrates a clear skew towards US (and to some degree, EU) data brokerages (likely because these are difficult to map in non-US/EU contexts, or more dire, the existing lack of oversight), regulatory differences between regions will simply push their operations elsewhere, if not already. That said, the compensation scheme as proposed would likely need government mandate, and I am all for a solution that lies halfway between the public, markets and government.
- gremlinunderway 3y ago
  >simply push their operations elsewhere, if not already. This is true of any regulation, and its sort of a tired trope. We don't make CP legal simply because its currently being pushed to regions with less regulation. Adding a higher barrier to entry and more difficult operations does reduce the amount out there, and while there would absolutely still be data brokers moving to deregulated regions, this imposes a significant cost and obstacle so that there would a much smaller market of availability and also a clear signal for companies wanting to do business with these brokers that they risk their own legitimate business by engaging with them.
throwawayqqq11 3y ago
An opt-out obfuscated with dark patterns while the data could potentially escape US jurisdiction anytime. opt-in, like the GDPR does is an even better approach, imo.
- x0x0 3y ago
  > * An opt-out obfuscated with dark patterns* No. A single opt-out run by the state, similar to the do not call list, but (at least claimed) with real enforcement by an agency dedicated to the enforcement of privacy laws constructed and funded via proposition.
tagawa 3y ago
That’s what Global Privacy Control (GPC)[0] is trying to do. So far it’s been referenced in California, Colorado and Connecticut state privacy regulations as an "opt-out preference signal” or "user-enabled universal opt-out method”[1]. Sephora paid a $1.2-million settlement in 2022 for not respecting the signal[2]. [0] https://globalprivacycontrol.org/ https://globalprivacycontrol.org/ [1] https://redcloveradvisors.com/2023/02/21/what-is-global-privacy-control/ https://redcloveradvisors.com/2023/02/21/what-is-global-priv... [2] https://oag.ca.gov/news/press-releases/attorney-general-bonta-announces-settlement-sephora-part-ongoing-enforcement https://oag.ca.gov/news/press-releases/attorney-general-bont...

by x0x0 3y ago

dleeftink 3y ago

While the map demonstrates a clear skew towards US (and to some degree, EU) data brokerages (likely because these are difficult to map in non-US/EU contexts, or more dire, the existing lack of oversight), regulatory differences between regions will simply push their operations elsewhere, if not already. That said, the compensation scheme as proposed would likely need government mandate, and I am all for a solution that lies halfway between the public, markets and government.

gremlinunderway 3y ago
>simply push their operations elsewhere, if not already. This is true of any regulation, and its sort of a tired trope. We don't make CP legal simply because its currently being pushed to regions with less regulation. Adding a higher barrier to entry and more difficult operations does reduce the amount out there, and while there would absolutely still be data brokers moving to deregulated regions, this imposes a significant cost and obstacle so that there would a much smaller market of availability and also a clear signal for companies wanting to do business with these brokers that they risk their own legitimate business by engaging with them.

throwawayqqq11 3y ago

An opt-out obfuscated with dark patterns while the data could potentially escape US jurisdiction anytime. opt-in, like the GDPR does is an even better approach, imo.

x0x0 3y ago
> * An opt-out obfuscated with dark patterns* No. A single opt-out run by the state, similar to the do not call list, but (at least claimed) with real enforcement by an agency dedicated to the enforcement of privacy laws constructed and funded via proposition.

tagawa 3y ago

That’s what Global Privacy Control (GPC)[0] is trying to do. So far it’s been referenced in California, Colorado and Connecticut state privacy regulations as an "opt-out preference signal” or "user-enabled universal opt-out method”[1]. Sephora paid a $1.2-million settlement in 2022 for not respecting the signal[2]. [0] https://globalprivacycontrol.org/ https://globalprivacycontrol.org/ [1] https://redcloveradvisors.com/2023/02/21/what-is-global-privacy-control/ https://redcloveradvisors.com/2023/02/21/what-is-global-priv... [2] https://oag.ca.gov/news/press-releases/attorney-general-bonta-announces-settlement-sephora-part-ongoing-enforcement https://oag.ca.gov/news/press-releases/attorney-general-bont...